Imported WebKit commit c4b613825abd39ac739a47d7b4410468fcef66dc (http://svn.webkit.org/repository/webkit/trunk@121147)

New snapshot that includes Win32 debug build fix (use SVGAllInOne)

842 files changed, 21921 insertions, 4167 deletions

diff --git a/Source/JavaScriptCore/API/JSBase.h b/Source/JavaScriptCore/API/JSBase.h
index f46a41755..fed54fe23 100644
--- a/Source/JavaScriptCore/API/JSBase.h
+++ b/Source/JavaScriptCore/API/JSBase.h
@@ -71,7 +71,7 @@ typedef struct OpaqueJSValue* JSObjectRef;
 #elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
 #define JS_EXPORT __attribute__((visibility("default")))
 #elif defined(WIN32) || defined(_WIN32) || defined(_WIN32_WCE) || defined(__CC_ARM) || defined(__ARMCC__)
-#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORT __declspec(dllexport)
 #else
 #define JS_EXPORT __declspec(dllimport)
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 24e67b940..06139a4d2 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -54,6 +54,7 @@ SET(JavaScriptCore_SOURCES
     bytecode/PolymorphicPutByIdList.cpp
     bytecode/SpeculatedType.cpp
     bytecode/PutByIdStatus.cpp
+    bytecode/ResolveGlobalStatus.cpp
     bytecode/SamplingTool.cpp
     bytecode/StructureStubInfo.cpp
     bytecode/Watchpoint.cpp
@@ -71,6 +72,7 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGConstantFoldingPhase.cpp
     dfg/DFGCorrectableJumpPoint.cpp
     dfg/DFGCSEPhase.cpp
+    dfg/DFGDisassembler.cpp
     dfg/DFGDominators.cpp
     dfg/DFGDriver.cpp
     dfg/DFGFixupPhase.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 3907efc13..20df558bb 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,33 +1,608 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC::HeapTimer::timerDidFire):
+        (JSC):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork):
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::sharedInstance):
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::createJSLockCount):
+        (JSC::JSLock::lockCount):
+        (JSC::setLockCount):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (JSLock):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
 
-        [Qt][Win] Fix broken QtWebKit5.lib linking
-        https://bugs.webkit.org/show_bug.cgi?id=88321
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
 
-        Reviewed by NOBODY (OOPS!).
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
 
-        Also update the Wx build to use the new define.
+        Reviewed by Dean Jackson.
 
-        * API/JSBase.h:
-        * runtime/JSExportMacros.h:
-        * wscript:
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        * Configurations/FeatureDefines.xcconfig:
 
-2012-06-13  Patrick Gansterer  <paroga@webkit.org>
+2012-06-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG tier-up should happen in prologues, not epilogues
+        https://bugs.webkit.org/show_bug.cgi?id=89752
+
+        Reviewed by Geoffrey Garen.
+
+        This change has two outcomes:
+        
+        1) Slightly reduces the likelihood that a function will be optimized both
+        standalone and via inlining.  Previously, if you had a call sequence like foo() 
+        calls bar() exactly once, and nobody else calls bar(), then bar() would get
+        optimized first (because it returns first) and then foo() gets optimized.  If foo()
+        can inline bar() then that means that bar() gets optimized twice.  But now, if we
+        optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
+        that means that there will no longer be any calls to bar().
+        
+        2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
+        loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
+        requires OSR (albeit really easy OSR since it's the top of the compilation unit),
+        so it becomes just like loop tier-up.  As a result, we now have one optimization
+        hook (cti_optimize) instead of two (cti_optimize_from_loop and
+        cti_optimize_from_ret).
+        
+        As a consequence of not having an optimization check in epilogues, the OSR exit
+        code must now trigger reoptimization itself instead of just signaling the epilogue
+        check to fire.
+        
+        This also adds the ability to count the number of DFG compilations, which was
+        useful for debugging this patch and might be useful for other things in the future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reoptimize):
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (DFG):
+        (JSC::DFG::getNumCompilations):
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        (DFG):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_enter):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
 
-        [WIN] Remove dependency on pthread from MachineStackMarker
-        https://bugs.webkit.org/show_bug.cgi?id=68429
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * API/APIShims.h:
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to 
+        determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the 
+        HeapTimer class because timerDidFire could run after somebody has started to tear down that particular 
+        JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after 
+        its destruction has begun. 
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
+        Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
+        and before we've released it, which can only done in APIEntryShim.
+        (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they 
+        are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
+        and the IncrementalSweeper to make sure they're the last things that get initialized during construction to 
+        prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
+        (Heap):
+        * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC):
+        (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread 
+        that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the 
+        HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
+        (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
+        out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
+        but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case 
+        we were interrupted between releasing our mutex and trying to grab the APILock.
+        * heap/HeapTimer.h: 
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles 
+        all of that for us. 
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
+        that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity 
+        it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the 
+        APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
+        (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and 
+        de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
+        (JSGlobalData):
+        (JSC::JSGlobalData::apiLock):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that 
+        it can successfully unlock it later without it disappearing from underneath it.
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for 
+        actually waiting for long periods. 
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock): 
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (GlobalJSLock):
+        (JSLockHolder):
+        (JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-06-21  Filip Pizlo  <fpizlo@apple.com>
+
+        op_resolve_global should not prevent DFG inlining
+        https://bugs.webkit.org/show_bug.cgi?id=89726
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/GlobalResolveInfo.h:
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (GlobalResolveInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline 'new Array()'
+        https://bugs.webkit.org/show_bug.cgi?id=89632
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds support for treating InternalFunction like intrinsics. The code
+        to do so is actually quite clean, so I don't feel bad about perpetuating
+        the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
+        
+        Currently this newfound power is only used to inline 'new Array()'.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isInternalFunctionConstant):
+        (JSC::DFG::Graph::valueOfInternalFunctionConstant):
 
-        Reviewed by NOBODY (OOPS!).
+2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
 
-        Implement pthread TLS functionality with native windows functions.
+        Adding copyrights to new files.
 
-        * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly.
-        * heap/MachineStackMarker.h:
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecificKeyCreate): Added wrapper around pthread_key_create.
-        (WTF::ThreadSpecificKeyDelete): Added wrapper around pthread_key_delete.
-        (WTF::ThreadSpecificSet): Added wrapper around pthread_setspecific.
-        (WTF::ThreadSpecificGet): Added wrapper around pthread_getspecific.
-        * wtf/ThreadSpecificWin.cpp:
+        * heap/HeapTimer.cpp:
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        * heap/IncrementalSweeper.h:
+
+2012-06-21  Arnaud Renevier  <arno@renevier.net>
+
+        make sure headers are included only once per file
+        https://bugs.webkit.org/show_bug.cgi?id=88922
+
+        Reviewed by Alexey Proskuryakov.
+
+        * bytecode/CodeBlock.h:
+        * heap/MachineStackMarker.cpp:
+        * runtime/JSVariableObject.h:
+
+2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL][WK2] Make WebKit2/Efl headers and resources installable.
+        https://bugs.webkit.org/show_bug.cgi?id=88207
+
+        Reviewed by Chang Shu.
+
+        * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
+
+2012-06-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reduced (but did not eliminate) use of "berzerker GC"
+        https://bugs.webkit.org/show_bug.cgi?id=89237
+
+        Reviewed by Gavin Barraclough.
+
+        (PART 1)
+
+        This patch turned out to be crashy, so I'm landing the non-crashy bits
+        first.
+
+        This part is pre-requisite refactoring. I didn't actually turn off
+        "berzerker GC" or turn on incremental shrinking.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
+        we throw away the block we're currently allocating out of. Otherwise, we'll
+        allocate out of a stale free list.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::Free::Free):
+        (JSC::Free::operator()):
+        (JSC::Free::returnValue): Refactored this functor to use a shared helper
+        function, so we can share our implementation with the incremental sweeper.
+
+        Also changed to freeing individual blocks immediately instead of linking
+        them into a list for later freeing. This makes the programming interface
+        simpler, and it's slightly more efficient to boot.
+
+        (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
+
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
+        with the incremental sweeper.
+
+        (JSC::MarkedSpace::shrink): Updated for new functor behavior.
+
+        * heap/MarkedSpace.h: Statically typed languages are awesome.
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize ResolveGlobal
+        https://bugs.webkit.org/show_bug.cgi?id=89617
+
+        Reviewed by Oliver Hunt.
+        
+        This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
+        adds the specific function optimization to ResolveGlobal, when it is inlined. And,
+        it makes internal functions act like specific functions, since that will be the
+        most common use-case of this optimization.
+        
+        This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
+        with this optimization, which is to completely inline common "globally resolved"
+        function and constructor calls, like "new Array()".
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::numberOfGlobalResolveInfos):
+        * bytecode/GlobalResolveInfo.h:
+        (JSC::getGlobalResolveInfoBytecodeOffset):
+        (JSC):
+        * bytecode/ResolveGlobalStatus.cpp: Added.
+        (JSC):
+        (JSC::computeForStructure):
+        (JSC::computeForLLInt):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h: Added.
+        (JSC):
+        (ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::state):
+        (JSC::ResolveGlobalStatus::isSet):
+        (JSC::ResolveGlobalStatus::operator!):
+        (JSC::ResolveGlobalStatus::isSimple):
+        (JSC::ResolveGlobalStatus::takesSlowPath):
+        (JSC::ResolveGlobalStatus::structure):
+        (JSC::ResolveGlobalStatus::offset):
+        (JSC::ResolveGlobalStatus::specificValue):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/JSObject.cpp:
+        (JSC::getCallableObjectSlow):
+        (JSC):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::putDirectAccessor):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSC::getCallableObject):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Functions on global objects should be specializable
+        https://bugs.webkit.org/show_bug.cgi?id=89615
+
+        Reviewed by Oliver Hunt.
+        
+        I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
+        and it didn't. Bug 33343 was the reason why we disabled global object function specialization
+        to begin with. So I'm guessing this is safe.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        build-webkit failure due to illegal 32-bit integer constants in code
+        generated by offlineasm
+        https://bugs.webkit.org/show_bug.cgi?id=89347
+
+        Reviewed by Geoffrey Garen.
+        
+        The offending constants are the magic numbers used by offlineasm to find
+        offsets in the generated machine code. Added code to turn them into what
+        the C++ compiler will believe to be valid 32-bit values.
+
+        * offlineasm/offsets.rb:
+
+2012-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Made the incremental sweeper more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=89527
+
+        Reviewed by Oliver Hunt.
+
+        This is a pre-requisite to getting rid of "berzerker GC" because we need
+        the sweeper to reclaim memory in a timely fashion, or we'll see a memory
+        footprint regression.
+
+        * heap/IncrementalSweeper.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
+        no need to use a data member to record it.
+
+        (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
+        small time slice. This is better than sweeping only one block per timer
+        fire because that strategy has a heavy timer overhead, and artificially
+        delays memory reclamation.
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to print disassembly interleaved with the IR
+        https://bugs.webkit.org/show_bug.cgi?id=89551
+
+        Reviewed by Geoffrey Garen.
+        
+        This change also removes running Dominators unconditionally on every DFG
+        compile. Dominators are designed to be computed on-demand, and currently
+        the only demand is graph dumps.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
+        (ARMv7Assembler):
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::labelIgnoringWatchpoints):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+        (DFG):
+        * dfg/DFGDisassembler.cpp: Added.
+        (DFG):
+        (JSC::DFG::Disassembler::Disassembler):
+        (JSC::DFG::Disassembler::dump):
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * dfg/DFGDisassembler.h: Added.
+        (DFG):
+        (Disassembler):
+        (JSC::DFG::Disassembler::setStartOfCode):
+        (JSC::DFG::Disassembler::setForBlock):
+        (JSC::DFG::Disassembler::setForNode):
+        (JSC::DFG::Disassembler::setEndOfMainPath):
+        (JSC::DFG::Disassembler::setEndOfCode):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::amountOfNodeWhiteSpace):
+        (DFG):
+        (JSC::DFG::Graph::printNodeWhiteSpace):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (DFG):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::setStartOfCode):
+        (JSC::DFG::JITCompiler::setForBlock):
+        (JSC::DFG::JITCompiler::setForNode):
+        (JSC::DFG::JITCompiler::setEndOfMainPath):
+        (JSC::DFG::JITCompiler::setEndOfCode):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::willHaveCodeGen):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
 
 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
 
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index b96b21db3..ae2c393b1 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -40,6 +40,7 @@ ENABLE_CSP_NEXT = ;
 ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_VARIABLES = ;
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index 77409fe93..84d6e60ff 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -126,6 +126,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/PutByIdStatus.cpp \
 	Source/JavaScriptCore/bytecode/PutByIdStatus.h \
 	Source/JavaScriptCore/bytecode/PutKind.h \
+	Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp \
+	Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h \
 	Source/JavaScriptCore/bytecode/SamplingTool.cpp \
 	Source/JavaScriptCore/bytecode/SamplingTool.h \
 	Source/JavaScriptCore/bytecode/StructureSet.h \
@@ -168,6 +170,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.h \
 	Source/JavaScriptCore/dfg/DFGCSEPhase.cpp \
 	Source/JavaScriptCore/dfg/DFGCSEPhase.h \
+	Source/JavaScriptCore/dfg/DFGDisassembler.cpp \
+	Source/JavaScriptCore/dfg/DFGDisassembler.h \
 	Source/JavaScriptCore/dfg/DFGDominators.cpp \
 	Source/JavaScriptCore/dfg/DFGDominators.h \
 	Source/JavaScriptCore/dfg/DFGDoubleFormatState.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index 8da950f5e..c60a2e68d 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -47,7 +47,7 @@
     ],
   },
   'conditions': [
-    ['os_posix == 1 and OS != "mac" and OS != "android" and gcc_version==46', {
+    ['os_posix == 1 and OS != "mac" and gcc_version==46', {
       'target_defaults': {
         # Disable warnings about c++0x compatibility, as some names (such as nullptr) conflict
         # with upcoming c++0x types.
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index f6580c51f..380bbaf1b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -34,6 +34,12 @@ INCLUDEPATH += \
 
 win32-* {
     LIBS += -lwinmm
+
+    win32-g++* {
+        LIBS += -lpthreadGC2
+    } else:win32-msvc* {
+        LIBS += -lpthreadVC2
+    }
 }
 
 wince* {
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 365038cee..c48ef49c6 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -189,6 +189,7 @@ EXPORTS
     ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z
     ?getCalculatedDisplayName@JSC@@YA?AVUString@1@PAVExecState@1@PAVJSObject@1@@Z
     ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z
+    ?getCallableObjectSlow@JSC@@YAPAVJSCell@1@PAV21@@Z
     ?getConstructData@JSCell@JSC@@SA?AW4ConstructType@2@PAV12@AATConstructData@2@@Z
     ?getCurrentLocalTime@WTF@@YAXPAUtm@@@Z
     ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 2ffc9e266..a64a1065f 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -209,6 +209,10 @@
 		0FF4274B158EBE91004CB9FF /* udis86.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4273F158EBD94004CB9FF /* udis86.h */; };
 		0FF4274D158EBFE6004CB9FF /* udis86_itab_holder.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4274C158EBFE1004CB9FF /* udis86_itab_holder.c */; };
 		0FF4275715914A20004CB9FF /* LinkBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4275615914A20004CB9FF /* LinkBuffer.cpp */; };
+		0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */; };
+		0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */; };
+		0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
 		0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */; };
 		0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -929,6 +933,10 @@
 		0FF4273F158EBD94004CB9FF /* udis86.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86.h; path = disassembler/udis86/udis86.h; sourceTree = "<group>"; };
 		0FF4274C158EBFE1004CB9FF /* udis86_itab_holder.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86_itab_holder.c; path = disassembler/udis86/udis86_itab_holder.c; sourceTree = "<group>"; };
 		0FF4275615914A20004CB9FF /* LinkBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkBuffer.cpp; sourceTree = "<group>"; };
+		0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDisassembler.cpp; path = dfg/DFGDisassembler.cpp; sourceTree = "<group>"; };
+		0FF427621591A1C9004CB9FF /* DFGDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDisassembler.h; path = dfg/DFGDisassembler.h; sourceTree = "<group>"; };
+		0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResolveGlobalStatus.cpp; sourceTree = "<group>"; };
+		0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResolveGlobalStatus.h; sourceTree = "<group>"; };
 		0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
 		0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCFAPhase.cpp; path = dfg/DFGCFAPhase.cpp; sourceTree = "<group>"; };
 		0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFAPhase.h; path = dfg/DFGCFAPhase.h; sourceTree = "<group>"; };
@@ -2201,6 +2209,8 @@
 				0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */,
 				0FC0979D146B271E00CF2442 /* DFGCorrectableJumpPoint.cpp */,
 				0FC0979A146A772000CF2442 /* DFGCorrectableJumpPoint.h */,
+				0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */,
+				0FF427621591A1C9004CB9FF /* DFGDisassembler.h */,
 				0FD81ACF154FB4EB00983E72 /* DFGDominators.cpp */,
 				0FD81AD0154FB4EB00983E72 /* DFGDominators.h */,
 				0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */,
@@ -2341,6 +2351,8 @@
 				0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */,
 				0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */,
 				0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */,
+				0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */,
+				0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */,
 				0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
 				0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */,
 				0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */,
@@ -2759,6 +2771,8 @@
 				0FF42748158EBE91004CB9FF /* udis86_syn.h in Headers */,
 				0FF42749158EBE91004CB9FF /* udis86_types.h in Headers */,
 				0FF4274B158EBE91004CB9FF /* udis86.h in Headers */,
+				0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */,
+				0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3345,6 +3359,8 @@
 				C2E526BD1590EF000054E48D /* HeapTimer.cpp in Sources */,
 				0FF4275715914A20004CB9FF /* LinkBuffer.cpp in Sources */,
 				C2D58C3415912FEE0021A844 /* GCActivityCallback.cpp in Sources */,
+				0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */,
+				0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index e3488c74e..2f479222a 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -64,6 +64,7 @@ SOURCES += \
     bytecode/Opcode.cpp \
     bytecode/PolymorphicPutByIdList.cpp \
     bytecode/PutByIdStatus.cpp \
+    bytecode/ResolveGlobalStatus.cpp \
     bytecode/SamplingTool.cpp \
     bytecode/SpeculatedType.cpp \
     bytecode/StructureStubInfo.cpp \
@@ -102,6 +103,7 @@ SOURCES += \
     dfg/DFGConstantFoldingPhase.cpp \
     dfg/DFGCorrectableJumpPoint.cpp \
     dfg/DFGCSEPhase.cpp \
+    dfg/DFGDisassembler.cpp \
     dfg/DFGDominators.cpp \
     dfg/DFGDriver.cpp \
     dfg/DFGFixupPhase.cpp \
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index 95c812c94..81977e2bd 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1827,6 +1827,11 @@ public:
         m_formatter.oneWordOp8Imm8(OP_NOP_T1, 0);
     }
     
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_formatter.label();
+    }
+
     AssemblerLabel labelForWatchpoint()
     {
         AssemblerLabel result = m_formatter.label();
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 27b8a58d1..0080446c2 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -555,6 +555,15 @@ public:
 
 
     // Section 3: Misc admin methods
+#if ENABLE(DFG_JIT)
+    Label labelIgnoringWatchpoints()
+    {
+        Label result;
+        result.m_label = m_assembler.labelIgnoringWatchpoints();
+        return result;
+    }
+#endif
+    
     Label label()
     {
         return Label(this);
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index 8c5606972..9c35be8b5 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -1730,6 +1730,11 @@ public:
         m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
         return result;
     }
+    
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_formatter.label();
+    }
 
     AssemblerLabel label()
     {
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 60596d1c2..bcbb51f63 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -1583,7 +1583,7 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_source(other.m_source)
     , m_sourceOffset(other.m_sourceOffset)
 #if ENABLE(JIT)
-    , m_globalResolveInfos(other.m_globalResolveInfos)
+    , m_globalResolveInfos(other.m_globalResolveInfos.size())
 #endif
 #if ENABLE(VALUE_PROFILER)
     , m_executionEntryCount(0)
@@ -1609,6 +1609,11 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     optimizeAfterWarmUp();
     jitAfterWarmUp();
 
+#if ENABLE(JIT)
+    for (unsigned i = m_globalResolveInfos.size(); i--;)
+        m_globalResolveInfos[i] = GlobalResolveInfo(other.m_globalResolveInfos[i].bytecodeOffset);
+#endif
+
     if (other.m_rareData) {
         createRareDataIfNecessary();
         
@@ -2258,6 +2263,10 @@ bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
         return false;
     return true;
 }
+GlobalResolveInfo& CodeBlock::globalResolveInfoForBytecodeOffset(unsigned bytecodeOffset)
+{
+    return *(binarySearch<GlobalResolveInfo, unsigned, getGlobalResolveInfoBytecodeOffset>(m_globalResolveInfos.begin(), m_globalResolveInfos.size(), bytecodeOffset));
+}
 #endif
 
 void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
@@ -2269,7 +2278,8 @@ void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
 #endif
 #if ENABLE(JIT)
     m_structureStubInfos.shrinkToFit();
-    m_globalResolveInfos.shrinkToFit();
+    if (shrinkMode == EarlyShrink)
+        m_globalResolveInfos.shrinkToFit();
     m_callLinkInfos.shrinkToFit();
     m_methodCallLinkInfos.shrinkToFit();
 #endif
@@ -2454,6 +2464,16 @@ void CodeBlock::copyPostParseDataFromAlternative()
 }
 
 #if ENABLE(JIT)
+void CodeBlock::reoptimize()
+{
+    ASSERT(replacement() != this);
+    ASSERT(replacement()->alternative() == this);
+    replacement()->tallyFrequentExitSites();
+    replacement()->jettison();
+    countReoptimization();
+    optimizeAfterWarmUp();
+}
+
 CodeBlock* ProgramCodeBlock::replacement()
 {
     return &static_cast<ProgramExecutable*>(ownerExecutable())->generatedBytecode();
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 573d422d3..b73dcb2b6 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -69,7 +69,6 @@
 #include <wtf/RefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
-#include "StructureStubInfo.h"
 
 namespace JSC {
 
@@ -553,6 +552,8 @@ namespace JSC {
         }
         GlobalResolveInfo& globalResolveInfo(int index) { return m_globalResolveInfos[index]; }
         bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
+        GlobalResolveInfo& globalResolveInfoForBytecodeOffset(unsigned bytecodeOffset);
+        unsigned numberOfGlobalResolveInfos() { return m_globalResolveInfos.size(); }
 
         void setNumberOfCallLinkInfos(size_t size) { m_callLinkInfos.grow(size); }
         size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
@@ -1104,15 +1105,7 @@ namespace JSC {
 #endif
         
 #if ENABLE(JIT)
-        void reoptimize()
-        {
-            ASSERT(replacement() != this);
-            ASSERT(replacement()->alternative() == this);
-            replacement()->tallyFrequentExitSites();
-            replacement()->jettison();
-            countReoptimization();
-            optimizeAfterWarmUp();
-        }
+        void reoptimize();
 #endif
 
 #if ENABLE(VERBOSE_VALUE_PROFILE)
diff --git a/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
index 5576cfacd..c466c750d 100644
--- a/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
+++ b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
@@ -31,6 +31,8 @@
 namespace JSC {
 
 struct GlobalResolveInfo {
+    GlobalResolveInfo() { }
+    
     GlobalResolveInfo(unsigned bytecodeOffset)
         : offset(0)
         , bytecodeOffset(bytecodeOffset)
@@ -39,9 +41,14 @@ struct GlobalResolveInfo {
     
     WriteBarrier<Structure> structure;
     unsigned offset;
-    unsigned bytecodeOffset;
+    unsigned bytecodeOffset; // Only valid in old JIT code. This means nothing in the DFG.
 };
 
+inline unsigned getGlobalResolveInfoBytecodeOffset(GlobalResolveInfo* globalResolveInfo)
+{
+    return globalResolveInfo->bytecodeOffset;
+}
+
 } // namespace JSC
 
 #endif // GlobalResolveInfo_h
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
new file mode 100644
index 000000000..ff138704c
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ResolveGlobalStatus.h"
+
+#include "CodeBlock.h"
+#include "JSValue.h"
+#include "Structure.h"
+
+namespace JSC {
+
+static ResolveGlobalStatus computeForStructure(CodeBlock* codeBlock, Structure* structure, Identifier& identifier)
+{
+    unsigned attributesIgnored;
+    JSCell* specificValue;
+    size_t offset = structure->get(
+        *codeBlock->globalData(), identifier, attributesIgnored, specificValue);
+    if (offset == notFound)
+        return ResolveGlobalStatus();
+    
+    return ResolveGlobalStatus(ResolveGlobalStatus::Simple, structure, offset, specificValue);
+}
+
+static ResolveGlobalStatus computeForLLInt(CodeBlock* codeBlock, unsigned bytecodeIndex, Identifier& identifier)
+{
+#if ENABLE(LLINT)
+    Instruction* instruction = codeBlock->instructions().begin() + bytecodeIndex;
+    
+    ASSERT(instruction[0].u.opcode == llint_op_resolve_global);
+    
+    Structure* structure = instruction[3].u.structure.get();
+    if (!structure)
+        return ResolveGlobalStatus();
+    
+    return computeForStructure(codeBlock, structure, identifier);
+#else
+    UNUSED_PARAM(codeBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(identifier);
+    return ResolveGlobalStatus();
+#endif
+}
+
+ResolveGlobalStatus ResolveGlobalStatus::computeFor(CodeBlock* codeBlock, unsigned bytecodeIndex, Identifier& identifier)
+{
+#if ENABLE(JIT) && ENABLE(VALUE_PROFILER)
+    if (!codeBlock->numberOfGlobalResolveInfos())
+        return computeForLLInt(codeBlock, bytecodeIndex, identifier);
+    
+    if (codeBlock->likelyToTakeSlowCase(bytecodeIndex))
+        return ResolveGlobalStatus(TakesSlowPath);
+    
+    GlobalResolveInfo& globalResolveInfo = codeBlock->globalResolveInfoForBytecodeOffset(bytecodeIndex);
+    
+    if (!globalResolveInfo.structure)
+        return computeForLLInt(codeBlock, bytecodeIndex, identifier);
+    
+    return computeForStructure(codeBlock, globalResolveInfo.structure.get(), identifier);
+#else
+    return computeForLLInt(codeBlock, bytecodeIndex, identifier);
+#endif
+}
+
+} // namespace JSC
+
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h
new file mode 100644
index 000000000..4698332f7
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ResolveGlobalStatus_h
+#define ResolveGlobalStatus_h
+
+#include "JSValue.h"
+#include <wtf/NotFound.h>
+
+namespace JSC {
+
+class CodeBlock;
+class Identifier;
+class Structure;
+
+class ResolveGlobalStatus {
+public:
+    enum State {
+        NoInformation,
+        Simple,
+        TakesSlowPath
+    };
+    
+    ResolveGlobalStatus()
+        : m_state(NoInformation)
+        , m_structure(0)
+        , m_offset(notFound)
+    {
+    }
+    
+    ResolveGlobalStatus(
+        State state, Structure* structure = 0, size_t offset = notFound,
+        JSValue specificValue = JSValue())
+        : m_state(state)
+        , m_structure(structure)
+        , m_offset(offset)
+        , m_specificValue(specificValue)
+    {
+    }
+    
+    static ResolveGlobalStatus computeFor(CodeBlock*, unsigned bytecodeIndex, Identifier&);
+    
+    State state() const { return m_state; }
+    
+    bool isSet() const { return m_state != NoInformation; }
+    bool operator!() const { return !isSet(); }
+    bool isSimple() const { return m_state == Simple; }
+    bool takesSlowPath() const { return m_state == TakesSlowPath; }
+    
+    Structure* structure() const { return m_structure; }
+    size_t offset() const { return m_offset; }
+    JSValue specificValue() const { return m_specificValue; }
+
+private:
+    State m_state;
+    Structure* m_structure;
+    size_t m_offset;
+    JSValue m_specificValue;
+}; // class ResolveGlobalStatus
+
+} // namespace JSC
+
+#endif // ResolveGlobalStatus_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 317a08504..75611972e 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(DFG_JIT)
 
+#include "ArrayConstructor.h"
 #include "CallLinkStatus.h"
 #include "CodeBlock.h"
 #include "DFGByteCodeCache.h"
@@ -35,6 +36,7 @@
 #include "GetByIdStatus.h"
 #include "MethodCallLinkStatus.h"
 #include "PutByIdStatus.h"
+#include "ResolveGlobalStatus.h"
 #include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 
@@ -94,6 +96,10 @@ private:
     void setIntrinsicResult(bool usesResult, int resultOperand, NodeIndex);
     // Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.
     bool handleIntrinsic(bool usesResult, int resultOperand, Intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction);
+    bool handleConstantInternalFunction(bool usesResult, int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, CodeSpecializationKind);
+    void handleGetByOffset(
+        int destinationOperand, SpeculatedType, NodeIndex base, unsigned identifierNumber,
+        bool useInlineStorage, size_t offset);
     void handleGetById(
         int destinationOperand, SpeculatedType, NodeIndex base, unsigned identifierNumber,
         const GetByIdStatus&);
@@ -1124,7 +1130,12 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
     ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct));
     
     NodeIndex callTarget = get(currentInstruction[1].u.operand);
-    enum { ConstantFunction, LinkedFunction, UnknownFunction } callType;
+    enum {
+        ConstantFunction,
+        ConstantInternalFunction,
+        LinkedFunction,
+        UnknownFunction
+    } callType;
             
     CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(
         m_inlineStackTop->m_profiledBlock, m_currentIndex);
@@ -1147,6 +1158,13 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
                 m_graph.valueOfFunctionConstant(callTarget),
                 m_graph.valueOfFunctionConstant(callTarget)->executable());
 #endif
+    } else if (m_graph.isInternalFunctionConstant(callTarget)) {
+        callType = ConstantInternalFunction;
+#if DFG_ENABLE(DEBUG_VERBOSE)
+        dataLog("Call at [@%lu, bc#%u] has an internal function constant: %p.\n",
+                m_graph.size(), m_currentIndex,
+                m_graph.valueOfInternalFunctionConstant(callTarget));
+#endif
     } else if (callLinkStatus.isSet() && !callLinkStatus.couldTakeSlowPath()
                && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)) {
         callType = LinkedFunction;
@@ -1179,6 +1197,16 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
             prediction = getPrediction();
             nextOffset += OPCODE_LENGTH(op_call_put_result);
         }
+
+        if (callType == ConstantInternalFunction) {
+            if (handleConstantInternalFunction(usesResult, resultOperand, m_graph.valueOfInternalFunctionConstant(callTarget), registerOffset, argumentCountIncludingThis, prediction, kind))
+                return;
+            
+            // Can only handle this using the generic call handler.
+            addCall(interpreter, currentInstruction, op);
+            return;
+        }
+        
         JSFunction* expectedFunction;
         Intrinsic intrinsic;
         bool certainAboutExpectedFunction;
@@ -1210,7 +1238,7 @@ void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentIn
         } else if (handleInlining(usesResult, currentInstruction[1].u.operand, callTarget, resultOperand, certainAboutExpectedFunction, expectedFunction, registerOffset, argumentCountIncludingThis, nextOffset, kind))
             return;
     }
-            
+    
     addCall(interpreter, currentInstruction, op);
 }
 
@@ -1567,6 +1595,60 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
     }
 }
 
+bool ByteCodeParser::handleConstantInternalFunction(
+    bool usesResult, int resultOperand, InternalFunction* function, int registerOffset,
+    int argumentCountIncludingThis, SpeculatedType prediction, CodeSpecializationKind kind)
+{
+    // If we ever find that we have a lot of internal functions that we specialize for,
+    // then we should probably have some sort of hashtable dispatch, or maybe even
+    // dispatch straight through the MethodTable of the InternalFunction. But for now,
+    // it seems that this case is hit infrequently enough, and the number of functions
+    // we know about is small enough, that having just a linear cascade of if statements
+    // is good enough.
+    
+    UNUSED_PARAM(registerOffset); // Remove this once we do more things to the arguments.
+    UNUSED_PARAM(prediction); // Remove this once we do more things.
+    UNUSED_PARAM(kind); // Remove this once we do more things.
+    
+    if (function->classInfo() == &ArrayConstructor::s_info) {
+        // We could handle this but don't for now.
+        if (argumentCountIncludingThis != 1)
+            return false;
+        
+        setIntrinsicResult(
+            usesResult, resultOperand,
+            addToGraph(Node::VarArg, NewArray, OpInfo(0), OpInfo(0)));
+        return true;
+    }
+    
+    return false;
+}
+
+void ByteCodeParser::handleGetByOffset(
+    int destinationOperand, SpeculatedType prediction, NodeIndex base, unsigned identifierNumber,
+    bool useInlineStorage, size_t offset)
+{
+    NodeIndex propertyStorage;
+    size_t offsetOffset;
+    if (useInlineStorage) {
+        propertyStorage = base;
+        ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
+        offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
+    } else {
+        propertyStorage = addToGraph(GetPropertyStorage, base);
+        offsetOffset = 0;
+    }
+    set(destinationOperand,
+        addToGraph(
+            GetByOffset, OpInfo(m_graph.m_storageAccessData.size()), OpInfo(prediction),
+            propertyStorage));
+        
+    StorageAccessData storageAccessData;
+    storageAccessData.offset = offset + offsetOffset;
+    storageAccessData.identifierNumber = identifierNumber;
+    m_graph.m_storageAccessData.append(storageAccessData);
+}
+
 void ByteCodeParser::handleGetById(
     int destinationOperand, SpeculatedType prediction, NodeIndex base, unsigned identifierNumber,
     const GetByIdStatus& getByIdStatus)
@@ -1620,25 +1702,9 @@ void ByteCodeParser::handleGetById(
         return;
     }
     
-    NodeIndex propertyStorage;
-    size_t offsetOffset;
-    if (useInlineStorage) {
-        propertyStorage = base;
-        ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
-        offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
-    } else {
-        propertyStorage = addToGraph(GetPropertyStorage, base);
-        offsetOffset = 0;
-    }
-    set(destinationOperand,
-        addToGraph(
-            GetByOffset, OpInfo(m_graph.m_storageAccessData.size()), OpInfo(prediction),
-            propertyStorage));
-        
-    StorageAccessData storageAccessData;
-    storageAccessData.offset = getByIdStatus.offset() + offsetOffset;
-    storageAccessData.identifierNumber = identifierNumber;
-    m_graph.m_storageAccessData.append(storageAccessData);
+    handleGetByOffset(
+        destinationOperand, prediction, base, identifierNumber, useInlineStorage,
+        getByIdStatus.offset());
 }
 
 void ByteCodeParser::prepareToParseBlock()
@@ -2648,10 +2714,39 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         case op_resolve_global: {
             SpeculatedType prediction = getPrediction();
             
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[
+                currentInstruction[2].u.operand];
+            
+            ResolveGlobalStatus status = ResolveGlobalStatus::computeFor(
+                m_inlineStackTop->m_profiledBlock, m_currentIndex,
+                m_codeBlock->identifier(identifierNumber));
+            if (status.isSimple()) {
+                ASSERT(status.structure());
+                
+                NodeIndex globalObject = addStructureTransitionCheck(
+                    m_inlineStackTop->m_codeBlock->globalObject(), status.structure());
+                
+                if (status.specificValue()) {
+                    ASSERT(status.specificValue().isCell());
+                    
+                    set(currentInstruction[1].u.operand,
+                        cellConstant(status.specificValue().asCell()));
+                } else {
+                    handleGetByOffset(
+                        currentInstruction[1].u.operand, prediction, globalObject,
+                        identifierNumber, status.structure()->isUsingInlineStorage(),
+                        status.offset());
+                }
+                
+                m_globalResolveNumber++; // Skip over the unused global resolve info.
+                
+                NEXT_OPCODE(op_resolve_global);
+            }
+            
             NodeIndex resolve = addToGraph(ResolveGlobal, OpInfo(m_graph.m_resolveGlobalData.size()), OpInfo(prediction));
             m_graph.m_resolveGlobalData.append(ResolveGlobalData());
             ResolveGlobalData& data = m_graph.m_resolveGlobalData.last();
-            data.identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
+            data.identifierNumber = identifierNumber;
             data.resolveInfoIndex = m_globalResolveNumber++;
             set(currentInstruction[1].u.operand, resolve);
 
@@ -3077,6 +3172,8 @@ ByteCodeParser::InlineStackEntry::InlineStackEntry(
             }
             m_constantRemap[i] = result.iterator->second;
         }
+        for (unsigned i = 0; i < codeBlock->numberOfGlobalResolveInfos(); ++i)
+            byteCodeParser->m_codeBlock->addGlobalResolveInfo(std::numeric_limits<unsigned>::max());
         
         m_callsiteBlockHeadNeedsLinking = true;
     } else {
@@ -3160,6 +3257,9 @@ void ByteCodeParser::parseCodeBlock()
                     ASSERT(m_inlineStackTop->m_unlinkedBlocks.isEmpty() || m_graph.m_blocks[m_inlineStackTop->m_unlinkedBlocks.last().m_blockIndex]->bytecodeBegin < m_currentIndex);
                     m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(m_graph.m_blocks.size()));
                     m_inlineStackTop->m_blockLinkingTargets.append(m_graph.m_blocks.size());
+                    // The first block is definitely an OSR target.
+                    if (!m_graph.m_blocks.size())
+                        block->isOSRTarget = true;
                     m_graph.m_blocks.append(block.release());
                     prepareToParseBlock();
                 }
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index 027b0f78b..1aec0bca1 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -193,7 +193,6 @@ inline bool canInlineOpcode(OpcodeID opcodeID, CodeBlock* codeBlock, Instruction
     case op_put_scoped_var:
     case op_resolve:
     case op_resolve_base:
-    case op_resolve_global:
         
     // Constant buffers aren't copied correctly. This is easy to fix, but for
     // now we just disable inlining for functions that use them.
diff --git a/Source/JavaScriptCore/dfg/DFGCommon.h b/Source/JavaScriptCore/dfg/DFGCommon.h
index fce76c68c..c9d3cbc32 100644
--- a/Source/JavaScriptCore/dfg/DFGCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGCommon.h
@@ -134,6 +134,11 @@ enum NoResultTag { NoResult };
 
 enum OptimizationFixpointState { FixpointConverged, FixpointNotConverged };
 
+inline bool shouldShowDisassembly()
+{
+    return Options::showDisassembly || Options::showDFGDisassembly;
+}
+
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGDisassembler.cpp b/Source/JavaScriptCore/dfg/DFGDisassembler.cpp
new file mode 100644
index 000000000..1dde37cf2
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGDisassembler.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDisassembler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+Disassembler::Disassembler(Graph& graph)
+    : m_graph(graph)
+{
+    m_labelForBlockIndex.resize(graph.m_blocks.size());
+    m_labelForNodeIndex.resize(graph.size());
+}
+
+void Disassembler::dump(LinkBuffer& linkBuffer)
+{
+    m_graph.m_dominators.computeIfNecessary(m_graph);
+    
+    dataLog("Generated JIT code for DFG CodeBlock %p:\n", m_graph.m_codeBlock);
+    dataLog("    Code at [%p, %p):\n", linkBuffer.debugAddress(), static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.debugSize());
+    
+    const char* prefix = "    ";
+    const char* disassemblyPrefix = "        ";
+    
+    NodeIndex lastNodeIndex = NoNode;
+    MacroAssembler::Label previousLabel = m_startOfCode;
+    for (size_t blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+        BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        dumpDisassembly(disassemblyPrefix, linkBuffer, previousLabel, m_labelForBlockIndex[blockIndex], lastNodeIndex);
+        m_graph.dumpBlockHeader(prefix, blockIndex, Graph::DumpLivePhisOnly);
+        NodeIndex lastNodeIndexForDisassembly = block->at(0);
+        for (size_t i = 0; i < block->size(); ++i) {
+            if (!m_graph[block->at(i)].willHaveCodeGen())
+                continue;
+            MacroAssembler::Label currentLabel;
+            if (m_labelForNodeIndex[block->at(i)].isSet())
+                currentLabel = m_labelForNodeIndex[block->at(i)];
+            else {
+                // Dump the last instruction by using the first label of the next block
+                // as the end point. This case is hit either during peephole compare
+                // optimizations (the Branch won't have its own label) or if we have a
+                // forced OSR exit.
+                if (blockIndex + 1 < m_graph.m_blocks.size())
+                    currentLabel = m_labelForBlockIndex[blockIndex + 1];
+                else
+                    currentLabel = m_endOfMainPath;
+            }
+            dumpDisassembly(disassemblyPrefix, linkBuffer, previousLabel, currentLabel, lastNodeIndexForDisassembly);
+            m_graph.dumpCodeOrigin(prefix, lastNodeIndex, block->at(i));
+            m_graph.dump(prefix, block->at(i));
+            lastNodeIndex = block->at(i);
+            lastNodeIndexForDisassembly = block->at(i);
+        }
+    }
+    dumpDisassembly(disassemblyPrefix, linkBuffer, previousLabel, m_endOfMainPath, lastNodeIndex);
+    dataLog("%s(End Of Main Path)\n", prefix);
+    dumpDisassembly(disassemblyPrefix, linkBuffer, previousLabel, m_endOfCode, NoNode);
+}
+
+void Disassembler::dumpDisassembly(const char* prefix, LinkBuffer& linkBuffer, MacroAssembler::Label& previousLabel, MacroAssembler::Label currentLabel, NodeIndex context)
+{
+    size_t prefixLength = strlen(prefix);
+    int amountOfNodeWhiteSpace;
+    if (context == NoNode)
+        amountOfNodeWhiteSpace = 0;
+    else
+        amountOfNodeWhiteSpace = Graph::amountOfNodeWhiteSpace(m_graph[context]);
+    OwnArrayPtr<char> prefixBuffer = adoptArrayPtr(new char[prefixLength + amountOfNodeWhiteSpace + 1]);
+    strcpy(prefixBuffer.get(), prefix);
+    for (int i = 0; i < amountOfNodeWhiteSpace; ++i)
+        prefixBuffer[i + prefixLength] = ' ';
+    prefixBuffer[prefixLength + amountOfNodeWhiteSpace] = 0;
+    
+    CodeLocationLabel start = linkBuffer.locationOf(previousLabel);
+    CodeLocationLabel end = linkBuffer.locationOf(currentLabel);
+    previousLabel = currentLabel;
+    ASSERT(bitwise_cast<uintptr_t>(end.executableAddress()) >= bitwise_cast<uintptr_t>(start.executableAddress()));
+    if (tryToDisassemble(start, bitwise_cast<uintptr_t>(end.executableAddress()) - bitwise_cast<uintptr_t>(start.executableAddress()), prefixBuffer.get(), WTF::dataFile()))
+        return;
+    
+    dataLog("%s    disassembly not available for range %p...%p\n", prefixBuffer.get(), start.executableAddress(), end.executableAddress());
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGDisassembler.h b/Source/JavaScriptCore/dfg/DFGDisassembler.h
new file mode 100644
index 000000000..470a989ef
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGDisassembler.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGDisassembler_h
+#define DFGDisassembler_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class Disassembler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    Disassembler(Graph&);
+    
+    void setStartOfCode(MacroAssembler::Label label) { m_startOfCode = label; }
+    void setForBlock(BlockIndex blockIndex, MacroAssembler::Label label)
+    {
+        m_labelForBlockIndex[blockIndex] = label;
+    }
+    void setForNode(NodeIndex nodeIndex, MacroAssembler::Label label)
+    {
+        m_labelForNodeIndex[nodeIndex] = label;
+    }
+    void setEndOfMainPath(MacroAssembler::Label label)
+    {
+        m_endOfMainPath = label;
+    }
+    void setEndOfCode(MacroAssembler::Label label)
+    {
+        m_endOfCode = label;
+    }
+    
+    void dump(LinkBuffer&);
+    
+private:
+    void dumpDisassembly(const char* prefix, LinkBuffer&, MacroAssembler::Label& previousLabel, MacroAssembler::Label currentLabel, NodeIndex context);
+    
+    Graph& m_graph;
+    MacroAssembler::Label m_startOfCode;
+    Vector<MacroAssembler::Label> m_labelForBlockIndex;
+    Vector<MacroAssembler::Label> m_labelForNodeIndex;
+    MacroAssembler::Label m_endOfMainPath;
+    MacroAssembler::Label m_endOfCode;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGDisassembler_h
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index e932792df..5033aa2c0 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -43,11 +43,20 @@
 
 namespace JSC { namespace DFG {
 
+static unsigned numCompilations;
+
+unsigned getNumCompilations()
+{
+    return numCompilations;
+}
+
 enum CompileMode { CompileFunction, CompileOther };
 inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlock, JITCode& jitCode, MacroAssemblerCodePtr* jitCodeWithArityCheck)
 {
     SamplingRegion samplingRegion("DFG Compilation (Driver)");
     
+    numCompilations++;
+    
     ASSERT(codeBlock);
     ASSERT(codeBlock->alternative());
     ASSERT(codeBlock->alternative()->getJITType() == JITCode::BaselineJIT);
@@ -92,7 +101,6 @@ inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlo
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("DFG optimization fixpoint converged in %u iterations.\n", cnt);
 #endif
-    dfg.m_dominators.compute(dfg);
     performVirtualRegisterAllocation(dfg);
 
     GraphDumpMode modeForFinalValidate = DumpGraph;
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.h b/Source/JavaScriptCore/dfg/DFGDriver.h
index ce798d0a6..a6e82fef5 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.h
+++ b/Source/JavaScriptCore/dfg/DFGDriver.h
@@ -38,6 +38,8 @@ class MacroAssemblerCodePtr;
 
 namespace DFG {
 
+JS_EXPORT_PRIVATE unsigned getNumCompilations();
+
 #if ENABLE(DFG_JIT)
 bool tryCompile(ExecState*, CodeBlock*, JITCode&);
 bool tryCompileFunction(ExecState*, CodeBlock*, JITCode&, MacroAssemblerCodePtr& jitCodeWithArityCheck);
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index 93de024d7..4689470c8 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -89,7 +89,7 @@ static void printWhiteSpace(unsigned amount)
         dataLog(" ");
 }
 
-void Graph::dumpCodeOrigin(NodeIndex prevNodeIndex, NodeIndex nodeIndex)
+void Graph::dumpCodeOrigin(const char* prefix, NodeIndex prevNodeIndex, NodeIndex nodeIndex)
 {
     if (prevNodeIndex == NoNode)
         return;
@@ -112,18 +112,30 @@ void Graph::dumpCodeOrigin(NodeIndex prevNodeIndex, NodeIndex nodeIndex)
     
     // Print the pops.
     for (unsigned i = previousInlineStack.size(); i-- > indexOfDivergence;) {
+        dataLog("%s", prefix);
         printWhiteSpace(i * 2);
         dataLog("<-- %p\n", previousInlineStack[i].inlineCallFrame->executable.get());
     }
     
     // Print the pushes.
     for (unsigned i = indexOfDivergence; i < currentInlineStack.size(); ++i) {
+        dataLog("%s", prefix);
         printWhiteSpace(i * 2);
         dataLog("--> %p\n", currentInlineStack[i].inlineCallFrame->executable.get());
     }
 }
 
-void Graph::dump(NodeIndex nodeIndex)
+int Graph::amountOfNodeWhiteSpace(Node& node)
+{
+    return (node.codeOrigin.inlineDepth() - 1) * 2;
+}
+
+void Graph::printNodeWhiteSpace(Node& node)
+{
+    printWhiteSpace(amountOfNodeWhiteSpace(node));
+}
+
+void Graph::dump(const char* prefix, NodeIndex nodeIndex)
 {
     Node& node = at(nodeIndex);
     NodeType op = node.op();
@@ -134,7 +146,8 @@ void Graph::dump(NodeIndex nodeIndex)
     if (mustGenerate)
         --refCount;
     
-    printWhiteSpace((node.codeOrigin.inlineDepth() - 1) * 2);
+    dataLog("%s", prefix);
+    printNodeWhiteSpace(node);
 
     // Example/explanation of dataflow dump output
     //
@@ -288,6 +301,54 @@ void Graph::dump(NodeIndex nodeIndex)
     dataLog("\n");
 }
 
+void Graph::dumpBlockHeader(const char* prefix, BlockIndex blockIndex, PhiNodeDumpMode phiNodeDumpMode)
+{
+    BasicBlock* block = m_blocks[blockIndex].get();
+
+    dataLog("%sBlock #%u (bc#%u): %s%s\n", prefix, (int)blockIndex, block->bytecodeBegin, block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "");
+    dataLog("%s  Predecessors:", prefix);
+    for (size_t i = 0; i < block->m_predecessors.size(); ++i)
+        dataLog(" #%u", block->m_predecessors[i]);
+    dataLog("\n");
+    if (m_dominators.isValid()) {
+        dataLog("%s  Dominated by:", prefix);
+        for (size_t i = 0; i < m_blocks.size(); ++i) {
+            if (!m_dominators.dominates(i, blockIndex))
+                continue;
+            dataLog(" #%lu", static_cast<unsigned long>(i));
+        }
+        dataLog("\n");
+        dataLog("%s  Dominates:", prefix);
+        for (size_t i = 0; i < m_blocks.size(); ++i) {
+            if (!m_dominators.dominates(blockIndex, i))
+                continue;
+            dataLog(" #%lu", static_cast<unsigned long>(i));
+        }
+        dataLog("\n");
+    }
+    dataLog("%s  Phi Nodes:", prefix);
+    unsigned count = 0;
+    for (size_t i = 0; i < block->phis.size(); ++i) {
+        NodeIndex phiNodeIndex = block->phis[i];
+        Node& phiNode = at(phiNodeIndex);
+        if (!phiNode.shouldGenerate() && phiNodeDumpMode == DumpLivePhisOnly)
+            continue;
+        if (!((++count) % 4))
+            dataLog("\n%s      ", prefix);
+        dataLog(" @%u->(", phiNodeIndex);
+        if (phiNode.child1()) {
+            dataLog("@%u", phiNode.child1().index());
+            if (phiNode.child2()) {
+                dataLog(", @%u", phiNode.child2().index());
+                if (phiNode.child3())
+                    dataLog(", @%u", phiNode.child3().index());
+            }
+        }
+        dataLog(")%s", i + 1 < block->phis.size() ? "," : "");
+    }
+    dataLog("\n");
+}
+
 void Graph::dump()
 {
     NodeIndex lastNodeIndex = NoNode;
@@ -295,33 +356,7 @@ void Graph::dump()
         BasicBlock* block = m_blocks[b].get();
         if (!block)
             continue;
-        dataLog("Block #%u (bc#%u): %s%s\n", (int)b, block->bytecodeBegin, block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "");
-        dataLog("  Predecessors:");
-        for (size_t i = 0; i < block->m_predecessors.size(); ++i)
-            dataLog(" #%u", block->m_predecessors[i]);
-        dataLog("\n");
-        if (m_dominators.isValid()) {
-            dataLog("  Dominated by:");
-            for (size_t i = 0; i < m_blocks.size(); ++i) {
-                if (!m_dominators.dominates(i, b))
-                    continue;
-                dataLog(" #%lu", static_cast<unsigned long>(i));
-            }
-            dataLog("\n");
-            dataLog("  Dominates:");
-            for (size_t i = 0; i < m_blocks.size(); ++i) {
-                if (!m_dominators.dominates(b, i))
-                    continue;
-                dataLog(" #%lu", static_cast<unsigned long>(i));
-            }
-            dataLog("\n");
-        }
-        dataLog("  Phi Nodes:\n");
-        for (size_t i = 0; i < block->phis.size(); ++i) {
-            dumpCodeOrigin(lastNodeIndex, block->phis[i]);
-            dump(block->phis[i]);
-            lastNodeIndex = block->phis[i];
-        }
+        dumpBlockHeader("", b, DumpAllPhis);
         dataLog("  vars before: ");
         if (block->cfaHasVisited)
             dumpOperands(block->valuesAtHead, WTF::dataFile());
@@ -332,8 +367,8 @@ void Graph::dump()
         dumpOperands(block->variablesAtHead, WTF::dataFile());
         dataLog("\n");
         for (size_t i = 0; i < block->size(); ++i) {
-            dumpCodeOrigin(lastNodeIndex, block->at(i));
-            dump(block->at(i));
+            dumpCodeOrigin("", lastNodeIndex, block->at(i));
+            dump("", block->at(i));
             lastNodeIndex = block->at(i);
         }
         dataLog("  vars after: ");
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index acc9ff472..9e4a28fc3 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -179,11 +179,15 @@ public:
 
     // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
     void dump();
-    void dump(NodeIndex);
+    enum PhiNodeDumpMode { DumpLivePhisOnly, DumpAllPhis };
+    void dumpBlockHeader(const char* prefix, BlockIndex, PhiNodeDumpMode);
+    void dump(const char* prefix, NodeIndex);
+    static int amountOfNodeWhiteSpace(Node&);
+    static void printNodeWhiteSpace(Node&);
 
     // Dump the code origin of the given node as a diff from the code origin of the
     // preceding node.
-    void dumpCodeOrigin(NodeIndex, NodeIndex);
+    void dumpCodeOrigin(const char* prefix, NodeIndex, NodeIndex);
 
     BlockIndex blockIndexForBytecodeOffset(Vector<BlockIndex>& blocks, unsigned bytecodeBegin);
 
@@ -273,6 +277,18 @@ public:
             return false;
         return true;
     }
+    bool isInternalFunctionConstant(NodeIndex nodeIndex)
+    {
+        if (!isJSConstant(nodeIndex))
+            return false;
+        JSValue value = valueOfJSConstant(nodeIndex);
+        if (!value.isCell() || !value)
+            return false;
+        JSCell* cell = value.asCell();
+        if (!cell->inherits(&InternalFunction::s_info))
+            return false;
+        return true;
+    }
     // Helper methods get constant values from nodes.
     JSValue valueOfJSConstant(NodeIndex nodeIndex)
     {
@@ -296,6 +312,10 @@ public:
         ASSERT(function);
         return jsCast<JSFunction*>(function);
     }
+    InternalFunction* valueOfInternalFunctionConstant(NodeIndex nodeIndex)
+    {
+        return jsCast<InternalFunction*>(valueOfJSConstant(nodeIndex).asCell());
+    }
 
     static const char *opName(NodeType);
     
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index 561f51615..3c85cc77c 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -40,6 +40,15 @@
 
 namespace JSC { namespace DFG {
 
+JITCompiler::JITCompiler(Graph& dfg)
+    : CCallHelpers(&dfg.m_globalData, dfg.m_codeBlock)
+    , m_graph(dfg)
+    , m_currentCodeOriginIndex(0)
+{
+    if (shouldShowDisassembly())
+        m_disassembler = adoptPtr(new Disassembler(dfg));
+}
+
 void JITCompiler::linkOSRExits()
 {
     for (unsigned i = 0; i < codeBlock()->numberOfOSRExits(); ++i) {
@@ -201,9 +210,11 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
 
 bool JITCompiler::compile(JITCode& entry)
 {
+    setStartOfCode();
     compileEntry();
     SpeculativeJIT speculative(*this);
     compileBody(speculative);
+    setEndOfMainPath();
 
     // Generate slow path code.
     speculative.runSlowPathGenerators();
@@ -213,6 +224,7 @@ bool JITCompiler::compile(JITCode& entry)
     
     // Create OSR entry trampolines if necessary.
     speculative.createOSREntries();
+    setEndOfCode();
 
     LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock, JITCompilationCanFail);
     if (linkBuffer.didFailToAllocate())
@@ -220,14 +232,18 @@ bool JITCompiler::compile(JITCode& entry)
     link(linkBuffer);
     speculative.linkOSREntries(linkBuffer);
 
+    if (m_disassembler)
+        m_disassembler->dump(linkBuffer);
+
     entry = JITCode(
-        FINALIZE_CODE(linkBuffer, ("DFG program/eval CodeBlock %p", m_codeBlock)),
+        linkBuffer.finalizeCodeWithoutDisassembly(),
         JITCode::DFGJIT);
     return true;
 }
 
 bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
 {
+    setStartOfCode();
     compileEntry();
 
     // === Function header code generation ===
@@ -246,6 +262,7 @@ bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     // === Function body code generation ===
     SpeculativeJIT speculative(*this);
     compileBody(speculative);
+    setEndOfMainPath();
 
     // === Function footer code generation ===
     //
@@ -290,7 +307,7 @@ bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     
     // Create OSR entry trampolines if necessary.
     speculative.createOSREntries();
-
+    setEndOfCode();
 
     // === Link ===
     LinkBuffer linkBuffer(*m_globalData, this, m_codeBlock, JITCompilationCanFail);
@@ -302,10 +319,13 @@ bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWi
     // FIXME: switch the register file check & arity check over to DFGOpertaion style calls, not JIT stubs.
     linkBuffer.link(callRegisterFileCheck, cti_register_file_check);
     linkBuffer.link(callArityCheck, m_codeBlock->m_isConstructor ? cti_op_construct_arityCheck : cti_op_call_arityCheck);
+    
+    if (m_disassembler)
+        m_disassembler->dump(linkBuffer);
 
     entryWithArityCheck = linkBuffer.locationOf(arityCheck);
     entry = JITCode(
-        FINALIZE_CODE(linkBuffer, ("DFG function CodeBlock %p", m_codeBlock)),
+        linkBuffer.finalizeCodeWithoutDisassembly(),
         JITCode::DFGJIT);
     return true;
 }
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index 9d69ec9f3..ed16459cc 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "DFGCCallHelpers.h"
+#include "DFGDisassembler.h"
 #include "DFGFPRInfo.h"
 #include "DFGGPRInfo.h"
 #include "DFGGraph.h"
@@ -208,12 +209,7 @@ struct PropertyAccessRecord {
 // call to be linked).
 class JITCompiler : public CCallHelpers {
 public:
-    JITCompiler(Graph& dfg)
-        : CCallHelpers(&dfg.m_globalData, dfg.m_codeBlock)
-        , m_graph(dfg)
-        , m_currentCodeOriginIndex(0)
-    {
-    }
+    JITCompiler(Graph& dfg);
     
     bool compile(JITCode& entry);
     bool compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck);
@@ -221,6 +217,42 @@ public:
     // Accessors for properties.
     Graph& graph() { return m_graph; }
     
+    // Methods to set labels for the disassembler.
+    void setStartOfCode()
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setStartOfCode(labelIgnoringWatchpoints());
+    }
+    
+    void setForBlock(BlockIndex blockIndex)
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setForBlock(blockIndex, labelIgnoringWatchpoints());
+    }
+    
+    void setForNode(NodeIndex nodeIndex)
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setForNode(nodeIndex, labelIgnoringWatchpoints());
+    }
+    
+    void setEndOfMainPath()
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setEndOfMainPath(labelIgnoringWatchpoints());
+    }
+    
+    void setEndOfCode()
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setEndOfCode(labelIgnoringWatchpoints());
+    }
+    
     // Get a token for beginning a call, and set the current code origin index in
     // the call frame.
     CallBeginToken beginCall()
@@ -353,6 +385,8 @@ private:
     // The dataflow graph currently being generated.
     Graph& m_graph;
 
+    OwnPtr<Disassembler> m_disassembler;
+    
     // Vector of calls out from JIT code, including exception handler information.
     // Count of the number of CallRecords with exception handlers.
     Vector<CallLinkRecord> m_calls;
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 64e6fe097..40701c3bd 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -730,6 +730,11 @@ struct Node {
     {
         return m_refCount;
     }
+    
+    bool willHaveCodeGen()
+    {
+        return shouldGenerate() && op() != Phantom && op() != Nop;
+    }
 
     unsigned refCount()
     {
diff --git a/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp b/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp
index ca6257401..480a7dab9 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp
+++ b/Source/JavaScriptCore/dfg/DFGNodeFlags.cpp
@@ -46,19 +46,19 @@ const char* nodeFlagsAsString(NodeFlags flags)
     if (flags & NodeResultMask) {
         switch (flags & NodeResultMask) {
         case NodeResultJS:
-            ptr.strcat("ResultJS");
+            ptr.strcat("JS");
             break;
         case NodeResultNumber:
-            ptr.strcat("ResultNumber");
+            ptr.strcat("Number");
             break;
         case NodeResultInt32:
-            ptr.strcat("ResultInt32");
+            ptr.strcat("Int32");
             break;
         case NodeResultBoolean:
-            ptr.strcat("ResultBoolean");
+            ptr.strcat("Boolean");
             break;
         case NodeResultStorage:
-            ptr.strcat("ResultStorage");
+            ptr.strcat("Storage");
             break;
         default:
             ASSERT_NOT_REACHED();
@@ -70,21 +70,21 @@ const char* nodeFlagsAsString(NodeFlags flags)
     if (flags & NodeMustGenerate) {
         if (hasPrinted)
             ptr.strcat("|");
-        ptr.strcat("MustGenerate");
+        ptr.strcat("MustGen");
         hasPrinted = true;
     }
     
     if (flags & NodeHasVarArgs) {
         if (hasPrinted)
             ptr.strcat("|");
-        ptr.strcat("HasVarArgs");
+        ptr.strcat("VarArgs");
         hasPrinted = true;
     }
     
     if (flags & NodeClobbersWorld) {
         if (hasPrinted)
             ptr.strcat("|");
-        ptr.strcat("ClobbersWorld");
+        ptr.strcat("Clobbers");
         hasPrinted = true;
     }
     
@@ -95,18 +95,23 @@ const char* nodeFlagsAsString(NodeFlags flags)
         hasPrinted = true;
     }
     
-    if (flags & NodeUsedAsNumber) {
-        if (hasPrinted)
-            ptr.strcat("|");
-        ptr.strcat("UsedAsNum");
-        hasPrinted = true;
-    }
-    
-    if (flags & NodeNeedsNegZero) {
-        if (hasPrinted)
-            ptr.strcat("|");
-        ptr.strcat("NeedsNegZero");
-        hasPrinted = true;
+    if (flags & NodeResultMask) {
+        if (!(flags & NodeUsedAsNumber) && !(flags & NodeNeedsNegZero)) {
+            if (hasPrinted)
+                ptr.strcat("|");
+            ptr.strcat("PureInt");
+            hasPrinted = true;
+        } else if (!(flags & NodeUsedAsNumber)) {
+            if (hasPrinted)
+                ptr.strcat("|");
+            ptr.strcat("PureInt(w/ neg zero)");
+            hasPrinted = true;
+        } else if (!(flags & NodeNeedsNegZero)) {
+            if (hasPrinted)
+                ptr.strcat("|");
+            ptr.strcat("PureNum");
+            hasPrinted = true;
+        }
     }
     
     if (flags & NodeMayOverflow) {
@@ -126,7 +131,7 @@ const char* nodeFlagsAsString(NodeFlags flags)
     if (flags & NodeUsedAsInt) {
         if (hasPrinted)
             ptr.strcat("|");
-        ptr.strcat("UsedAsInt");
+        ptr.strcat("UseAsInt");
         hasPrinted = true;
     }
     
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
index d46d59650..e617b5479 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
@@ -115,7 +115,10 @@ void OSRExitCompiler::handleExitCounts(const OSRExit& exit)
         m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfForcedOSRExitCounter()));
         m_jit.store32(GPRInfo::regT1, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()));
         
+        m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
+
         tooFewFails.append(m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(Options::forcedOSRExitCountForReoptimization)));
+
     } else {
         // Proceed based on the assumption that we can handle these exits so long as they
         // don't get too frequent.
@@ -136,8 +139,14 @@ void OSRExitCompiler::handleExitCounts(const OSRExit& exit)
     }
 
     // Reoptimize as soon as possible.
-    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
-    m_jit.store32(AssemblyHelpers::TrustedImm32(0), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
+#if !NUMBER_OF_ARGUMENT_REGISTERS
+    m_jit.poke(GPRInfo::regT0);
+#else
+    m_jit.move(GPRInfo::regT0, GPRInfo::argumentGPR0);
+    ASSERT(GPRInfo::argumentGPR0 != GPRInfo::regT1);
+#endif
+    m_jit.move(AssemblyHelpers::TrustedImmPtr(bitwise_cast<void*>(triggerReoptimizationNow)), GPRInfo::regT1);
+    m_jit.call(GPRInfo::regT1);
     AssemblyHelpers::Jump doneAdjusting = m_jit.jump();
     
     tooFewFails.link(&m_jit);
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 06a1cf883..b056a3c6d 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -32,14 +32,15 @@
 #include "DFGRepatch.h"
 #include "HostCallReturnValue.h"
 #include "GetterSetter.h"
-#include <wtf/InlineASM.h>
 #include "Interpreter.h"
+#include "JIT.h"
 #include "JITExceptions.h"
 #include "JSActivation.h"
 #include "JSGlobalData.h"
 #include "JSStaticScopeObject.h"
 #include "NameInstance.h"
 #include "Operations.h"
+#include <wtf/InlineASM.h>
 
 #if ENABLE(DFG_JIT)
 
@@ -968,13 +969,11 @@ EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState* exec, Iden
     return JSValue::encode(base);
 }
 
-EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState* exec, GlobalResolveInfo* resolveInfo, Identifier* propertyName)
+EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState* exec, GlobalResolveInfo* resolveInfo, JSGlobalObject* globalObject, Identifier* propertyName)
 {
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
-    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(exec, *propertyName, slot)) {
         JSValue result = slot.getValue(exec, *propertyName);
@@ -1253,6 +1252,27 @@ void DFG_OPERATION debugOperationPrintSpeculationFailure(ExecState* exec, void*
 }
 #endif
 
+extern "C" void DFG_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock)
+{
+#if ENABLE(JIT_VERBOSE_OSR)
+    dataLog("%p: Entered reoptimize\n", codeBlock);
+#endif
+    // We must be called with the baseline code block.
+    ASSERT(JITCode::isBaselineCode(codeBlock->getJITType()));
+
+    // If I am my own replacement, then reoptimization has already been triggered.
+    // This can happen in recursive functions.
+    if (codeBlock->replacement() == codeBlock)
+        return;
+
+    // Otherwise, the replacement must be optimized code. Use this as an opportunity
+    // to check our logic.
+    ASSERT(codeBlock->hasOptimizedReplacement());
+    ASSERT(codeBlock->replacement()->getJITType() == JITCode::DFGJIT);
+
+    codeBlock->reoptimize();
+}
+
 } // extern "C"
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index 38166a83f..7477ab2fc 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -65,7 +65,7 @@ typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EA)(ExecState*, JSArray*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECC)(ExecState*, JSCell*, JSCell*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECI)(ExecState*, JSCell*, Identifier*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
-typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EGI)(ExecState*, GlobalResolveInfo*, Identifier*);
+typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EGriJsgI)(ExecState*, GlobalResolveInfo*, JSGlobalObject*, Identifier*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EI)(ExecState*, Identifier*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EJ)(ExecState*, EncodedJSValue);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EJA)(ExecState*, EncodedJSValue, JSArray*);
@@ -121,7 +121,7 @@ void DFG_OPERATION operationNotifyGlobalVarWrite(WatchpointSet* watchpointSet) W
 EncodedJSValue DFG_OPERATION operationResolve(ExecState*, Identifier*) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationResolveBase(ExecState*, Identifier*) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState*, Identifier*) WTF_INTERNAL;
-EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState*, GlobalResolveInfo*, Identifier*) WTF_INTERNAL;
+EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState*, GlobalResolveInfo*, JSGlobalObject*, Identifier*) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationToPrimitive(ExecState*, EncodedJSValue) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationStrCat(ExecState*, void*, size_t) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationNewArray(ExecState*, void*, size_t) WTF_INTERNAL;
@@ -227,6 +227,8 @@ size_t DFG_OPERATION dfgConvertJSValueToBoolean(ExecState*, EncodedJSValue) WTF_
 void DFG_OPERATION debugOperationPrintSpeculationFailure(ExecState*, void*) WTF_INTERNAL;
 #endif
 
+void DFG_OPERATION triggerReoptimizationNow(CodeBlock*) WTF_INTERNAL;
+
 } // extern "C"
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 852f74387..d9a79f13a 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -1026,6 +1026,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
 
     for (m_indexInBlock = 0; m_indexInBlock < block.size(); ++m_indexInBlock) {
         m_compileIndex = block[m_indexInBlock];
+        m_jit.setForNode(m_compileIndex);
         Node& node = at(m_compileIndex);
         m_codeOriginForOSR = node.codeOrigin;
         if (!node.shouldGenerate()) {
@@ -1321,6 +1322,7 @@ bool SpeculativeJIT::compile()
 
     ASSERT(!m_compileIndex);
     for (m_block = 0; m_block < m_jit.graph().m_blocks.size(); ++m_block) {
+        m_jit.setForBlock(m_block);
         BasicBlock* block = m_jit.graph().m_blocks[m_block].get();
         if (block)
             compile(*block);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 933784685..6c6948b90 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -1229,9 +1229,9 @@ public:
         m_jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, result);
         return call;
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EGI operation, GPRReg result, GPRReg arg1, Identifier* identifier)
+    JITCompiler::Call callOperation(J_DFGOperation_EGriJsgI operation, GPRReg result, GPRReg arg1, GPRReg arg2, Identifier* identifier)
     {
-        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(identifier));
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(identifier));
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
     JITCompiler::Call callOperation(J_DFGOperation_EI operation, GPRReg result, Identifier* identifier)
@@ -1482,9 +1482,9 @@ public:
         m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(pointer));
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
-    JITCompiler::Call callOperation(J_DFGOperation_EGI operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, Identifier* identifier)
+    JITCompiler::Call callOperation(J_DFGOperation_EGriJsgI operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2, Identifier* identifier)
     {
-        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(identifier));
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(identifier));
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
     JITCompiler::Call callOperation(J_DFGOperation_EP operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1)
@@ -2369,7 +2369,7 @@ public:
     
     Vector<SlowPathGenerator*, 8> m_slowPathGenerators; // doesn't use OwnPtr<> because I don't want to include DFGSlowPathGenerator.h
     Vector<SilentRegisterSavePlan> m_plans;
-
+    
     ValueRecovery computeValueRecoveryFor(const ValueSource&);
 
     ValueRecovery computeValueRecoveryFor(int operand)
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 0c33e0748..21d94e9e8 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -3840,7 +3840,7 @@ void SpeculativeJIT::compile(Node& node)
         addSlowPathGenerator(
             slowPathCall(
                 structuresNotMatch, this, operationResolveGlobal,
-                JSValueRegs(resultTagGPR, resultPayloadGPR), resolveInfoGPR,
+                JSValueRegs(resultTagGPR, resultPayloadGPR), resolveInfoGPR, globalObjectGPR,
                 &m_jit.codeBlock()->identifier(data.identifierNumber)));
 
         jsValueResult(resultTagGPR, resultPayloadGPR, m_compileIndex);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 0b7606b2c..a6c283584 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -3843,11 +3843,11 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
         m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(GlobalResolveInfo, offset)), resolveInfoGPR);
         m_jit.loadPtr(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::ScalePtr), resultGPR);
-
+        
         addSlowPathGenerator(
             slowPathCall(
                 structuresDontMatch, this, operationResolveGlobal,
-                resultGPR, resolveInfoGPR,
+                resultGPR, resolveInfoGPR, globalObjectGPR,
                 &m_jit.codeBlock()->identifier(data.identifierNumber)));
 
         jsValueResult(resultGPR, m_compileIndex);
diff --git a/Source/JavaScriptCore/heap/HeapTimer.cpp b/Source/JavaScriptCore/heap/HeapTimer.cpp
index bc42032f5..b4d928a34 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.cpp
+++ b/Source/JavaScriptCore/heap/HeapTimer.cpp
@@ -1,3 +1,28 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
 #include "config.h"
 #include "HeapTimer.h"
 
diff --git a/Source/JavaScriptCore/heap/HeapTimer.h b/Source/JavaScriptCore/heap/HeapTimer.h
index ccd6ba8c5..fea013975 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.h
+++ b/Source/JavaScriptCore/heap/HeapTimer.h
@@ -1,3 +1,28 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
 #ifndef HeapTimer_h
 #define HeapTimer_h
 
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
index 0d0116f42..165bfeaff 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
@@ -1,3 +1,28 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
 #include "config.h"
 #include "IncrementalSweeper.h"
 
@@ -14,9 +39,10 @@ namespace JSC {
 
 #if USE(CF)
 
-static const CFTimeInterval sweepTimeSlicePerBlock = 0.01;
-static const CFTimeInterval sweepTimeMultiplier = 1.0 / sweepTimeSlicePerBlock;
- 
+static const CFTimeInterval sweepTimeSlice = .01; // seconds
+static const CFTimeInterval sweepTimeTotal = .10;
+static const CFTimeInterval sweepTimeMultiplier = 1.0 / sweepTimeTotal;
+
 void IncrementalSweeper::doWork()
 {
     APIEntryShim shim(m_globalData);
@@ -26,7 +52,6 @@ void IncrementalSweeper::doWork()
 IncrementalSweeper::IncrementalSweeper(Heap* heap, CFRunLoopRef runLoop)
     : HeapTimer(heap->globalData(), runLoop)
     , m_currentBlockToSweepIndex(0)
-    , m_lengthOfLastSweepIncrement(0.0)
 {
 }
 
@@ -37,7 +62,7 @@ PassOwnPtr<IncrementalSweeper> IncrementalSweeper::create(Heap* heap)
 
 void IncrementalSweeper::scheduleTimer()
 {
-    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + (m_lengthOfLastSweepIncrement * sweepTimeMultiplier));
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + (sweepTimeSlice * sweepTimeMultiplier));
 }
 
 void IncrementalSweeper::cancelTimer()
@@ -47,14 +72,17 @@ void IncrementalSweeper::cancelTimer()
 
 void IncrementalSweeper::doSweep(double sweepBeginTime)
 {
-    for (; m_currentBlockToSweepIndex < m_blocksToSweep.size(); m_currentBlockToSweepIndex++) {
-        MarkedBlock* nextBlock = m_blocksToSweep[m_currentBlockToSweepIndex];
-        if (!nextBlock->needsSweeping())
+    while (m_currentBlockToSweepIndex < m_blocksToSweep.size()) {
+        MarkedBlock* block = m_blocksToSweep[m_currentBlockToSweepIndex++];
+        if (!block->needsSweeping())
+            continue;
+
+        block->sweep();
+
+        CFTimeInterval elapsedTime = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
+        if (elapsedTime < sweepTimeSlice)
             continue;
 
-        nextBlock->sweep();
-        m_blocksToSweep[m_currentBlockToSweepIndex++] = 0;
-        m_lengthOfLastSweepIncrement = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
         scheduleTimer();
         return;
     }
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.h b/Source/JavaScriptCore/heap/IncrementalSweeper.h
index 80d674ca9..20f4e3ca8 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.h
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.h
@@ -1,3 +1,28 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
 #ifndef IncrementalSweeper_h
 #define IncrementalSweeper_h
 
@@ -27,7 +52,6 @@ private:
     void cancelTimer();
     
     unsigned m_currentBlockToSweepIndex;
-    double m_lengthOfLastSweepIncrement; 
     Vector<MarkedBlock*> m_blocksToSweep;
 #else
     
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 06190f118..7eb57479b 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -45,7 +45,6 @@
 
 #elif OS(UNIX)
 
-#include <stdlib.h>
 #include <sys/mman.h>
 #include <unistd.h>
 
@@ -142,8 +141,10 @@ MachineThreads::MachineThreads(Heap* heap)
 
 MachineThreads::~MachineThreads()
 {
-    if (m_threadSpecific)
-        ThreadSpecificKeyDelete(m_threadSpecific);
+    if (m_threadSpecific) {
+        int error = pthread_key_delete(m_threadSpecific);
+        ASSERT_UNUSED(error, !error);
+    }
 
     MutexLocker registeredThreadsLock(m_registeredThreadsMutex);
     for (Thread* t = m_registeredThreads; t;) {
@@ -180,17 +181,19 @@ void MachineThreads::makeUsableFromMultipleThreads()
     if (m_threadSpecific)
         return;
 
-    ThreadSpecificKeyCreate(&m_threadSpecific, removeThread);
+    int error = pthread_key_create(&m_threadSpecific, removeThread);
+    if (error)
+        CRASH();
 }
 
 void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_threadSpecific || ThreadSpecificGet(m_threadSpecific))
+    if (!m_threadSpecific || pthread_getspecific(m_threadSpecific))
         return;
 
-    ThreadSpecificSet(m_threadSpecific, this);
+    pthread_setspecific(m_threadSpecific, this);
     Thread* thread = new Thread(getCurrentPlatformThread(), wtfThreadData().stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.h b/Source/JavaScriptCore/heap/MachineStackMarker.h
index 2209f97e9..0f5a4c3aa 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.h
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.h
@@ -22,8 +22,8 @@
 #ifndef MachineThreads_h
 #define MachineThreads_h
 
+#include <pthread.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/ThreadSpecific.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace JSC {
@@ -55,7 +55,7 @@ namespace JSC {
         Heap* m_heap;
         Mutex m_registeredThreadsMutex;
         Thread* m_registeredThreads;
-        WTF::ThreadSpecificKey m_threadSpecific;
+        pthread_key_t m_threadSpecific;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.cpp b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
index 9552a54ea..9cac906a1 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.cpp
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
@@ -107,8 +107,10 @@ void MarkedAllocator::addBlock(MarkedBlock* block)
 
 void MarkedAllocator::removeBlock(MarkedBlock* block)
 {
-    if (m_currentBlock == block)
-        m_currentBlock = 0;
+    if (m_currentBlock == block) {
+        m_currentBlock = static_cast<MarkedBlock*>(m_currentBlock->next());
+        m_freeList = MarkedBlock::FreeList();
+    }
     m_blockList.remove(block);
 }
 
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
index 42247a385..a742d8d9a 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
@@ -30,38 +30,37 @@ namespace JSC {
 
 class Structure;
 
-class Take {
+class Free {
 public:
     typedef MarkedBlock* ReturnType;
 
-    enum TakeMode { TakeIfEmpty, TakeAll };
+    enum FreeMode { FreeOrShrink, FreeAll };
 
-    Take(TakeMode, MarkedSpace*);
+    Free(FreeMode, MarkedSpace*);
     void operator()(MarkedBlock*);
     ReturnType returnValue();
     
 private:
-    TakeMode m_takeMode;
+    FreeMode m_freeMode;
     MarkedSpace* m_markedSpace;
     DoublyLinkedList<MarkedBlock> m_blocks;
 };
 
-inline Take::Take(TakeMode takeMode, MarkedSpace* newSpace)
-    : m_takeMode(takeMode)
+inline Free::Free(FreeMode freeMode, MarkedSpace* newSpace)
+    : m_freeMode(freeMode)
     , m_markedSpace(newSpace)
 {
 }
 
-inline void Take::operator()(MarkedBlock* block)
+inline void Free::operator()(MarkedBlock* block)
 {
-    if (m_takeMode == TakeIfEmpty && !block->isEmpty())
-        return;
-    
-    m_markedSpace->allocatorFor(block).removeBlock(block);
-    m_blocks.append(block);
+    if (m_freeMode == FreeOrShrink)
+        m_markedSpace->freeOrShrinkBlock(block);
+    else
+        m_markedSpace->freeBlock(block);
 }
 
-inline Take::ReturnType Take::returnValue()
+inline Free::ReturnType Free::returnValue()
 {
     return m_blocks.head();
 }
@@ -93,9 +92,8 @@ MarkedSpace::MarkedSpace(Heap* heap)
 
 MarkedSpace::~MarkedSpace()
 {
-    // We record a temporary list of empties to avoid modifying m_blocks while iterating it.
-    Take take(Take::TakeAll, this);
-    freeBlocks(forEachBlock(take));
+    Free free(Free::FreeAll, this);
+    forEachBlock(free);
 }
 
 struct LastChanceToFinalize : MarkedBlock::VoidFunctor {
@@ -160,17 +158,21 @@ bool MarkedSpace::isPagedOut(double deadline)
     return false;
 }
 
-void MarkedSpace::freeBlocks(MarkedBlock* head)
+void MarkedSpace::freeBlock(MarkedBlock* block)
 {
-    MarkedBlock* next;
-    for (MarkedBlock* block = head; block; block = next) {
-        next = static_cast<MarkedBlock*>(block->next());
-        
-        m_blocks.remove(block);
-        block->sweep();
+    allocatorFor(block).removeBlock(block);
+    m_blocks.remove(block);
+    m_heap->blockAllocator().deallocate(MarkedBlock::destroy(block));
+}
 
-        m_heap->blockAllocator().deallocate(MarkedBlock::destroy(block));
+void MarkedSpace::freeOrShrinkBlock(MarkedBlock* block)
+{
+    if (!block->isEmpty()) {
+        block->shrink();
+        return;
     }
+
+    freeBlock(block);
 }
 
 struct Shrink : MarkedBlock::VoidFunctor {
@@ -179,11 +181,8 @@ struct Shrink : MarkedBlock::VoidFunctor {
 
 void MarkedSpace::shrink()
 {
-    // We record a temporary list of empties to avoid modifying m_blocks while iterating it.
-    Take takeIfEmpty(Take::TakeIfEmpty, this);
-    freeBlocks(forEachBlock(takeIfEmpty));
-
-    forEachBlock<Shrink>();
+    Free freeOrShrink(Free::FreeOrShrink, this);
+    forEachBlock(freeOrShrink);
 }
 
 #if ENABLE(GGC)
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.h b/Source/JavaScriptCore/heap/MarkedSpace.h
index 3f82bac96..62d4e5d9e 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.h
+++ b/Source/JavaScriptCore/heap/MarkedSpace.h
@@ -98,7 +98,8 @@ public:
     template<typename Functor> typename Functor::ReturnType forEachBlock();
     
     void shrink();
-    void freeBlocks(MarkedBlock* head);
+    void freeBlock(MarkedBlock*);
+    void freeOrShrinkBlock(MarkedBlock*);
 
     void didAddBlock(MarkedBlock*);
     void didConsumeFreeList(MarkedBlock*);
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 2aca35146..e1e034b19 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -100,9 +100,10 @@ void JIT::emitOptimizationCheck(OptimizationCheckKind kind)
         return;
     
     Jump skipOptimize = branchAdd32(Signed, TrustedImm32(kind == LoopOptimizationCheck ? Options::executionCounterIncrementForLoop : Options::executionCounterIncrementForReturn), AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter()));
-    JITStubCall stubCall(this, kind == LoopOptimizationCheck ? cti_optimize_from_loop : cti_optimize_from_ret);
-    if (kind == LoopOptimizationCheck)
-        stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
+    JITStubCall stubCall(this, cti_optimize);
+    stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
+    if (kind == EnterOptimizationCheck)
+        ASSERT(!m_bytecodeOffset);
     stubCall.call();
     skipOptimize.link(this);
 }
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 6491edbed..6d4c578c0 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -806,7 +806,7 @@ namespace JSC {
         // Loads the character value of a single character string into dst.
         void emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures);
         
-        enum OptimizationCheckKind { LoopOptimizationCheck, RetOptimizationCheck };
+        enum OptimizationCheckKind { LoopOptimizationCheck, EnterOptimizationCheck };
 #if ENABLE(DFG_JIT)
         void emitOptimizationCheck(OptimizationCheckKind);
 #else
diff --git a/Source/JavaScriptCore/jit/JITCall32_64.cpp b/Source/JavaScriptCore/jit/JITCall32_64.cpp
index 81266052b..7d86e615f 100644
--- a/Source/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITCall32_64.cpp
@@ -56,8 +56,6 @@ void JIT::emit_op_call_put_result(Instruction* instruction)
 
 void JIT::emit_op_ret(Instruction* currentInstruction)
 {
-    emitOptimizationCheck(RetOptimizationCheck);
-    
     unsigned dst = currentInstruction[1].u.operand;
 
     emitLoad(dst, regT1, regT0);
@@ -70,8 +68,6 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 
 void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
 {
-    emitOptimizationCheck(RetOptimizationCheck);
-    
     unsigned result = currentInstruction[1].u.operand;
     unsigned thisReg = currentInstruction[2].u.operand;
 
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index ad7a56e12..2e448dd52 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -576,8 +576,6 @@ void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 
 void JIT::emit_op_ret(Instruction* currentInstruction)
 {
-    emitOptimizationCheck(RetOptimizationCheck);
-    
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
     ASSERT(returnValueRegister != callFrameRegister);
@@ -598,8 +596,6 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 
 void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
 {
-    emitOptimizationCheck(RetOptimizationCheck);
-    
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
     ASSERT(returnValueRegister != callFrameRegister);
@@ -1218,13 +1214,14 @@ void JIT::emit_op_neq_null(Instruction* currentInstruction)
 
 void JIT::emit_op_enter(Instruction*)
 {
+    emitOptimizationCheck(EnterOptimizationCheck);
+    
     // Even though CTI doesn't use them, we initialize our constant
     // registers to zap stale pointers, to avoid unnecessarily prolonging
     // object lifetime and increasing GC pressure.
     size_t count = m_codeBlock->m_numVars;
     for (size_t j = 0; j < count; ++j)
         emitInitRegister(j);
-
 }
 
 void JIT::emit_op_create_activation(Instruction* currentInstruction)
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 57ef7ef2f..4f8589557 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -1487,6 +1487,8 @@ void JIT::emit_op_debug(Instruction* currentInstruction)
 
 void JIT::emit_op_enter(Instruction*)
 {
+    emitOptimizationCheck(EnterOptimizationCheck);
+    
     // Even though JIT code doesn't use them, we initialize our constant
     // registers to zap stale pointers, to avoid unnecessarily prolonging
     // object lifetime and increasing GC pressure.
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 12f3ec344..b0ff4a0c7 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -1919,17 +1919,16 @@ DEFINE_STUB_FUNCTION(void, op_check_has_instance)
 }
 
 #if ENABLE(DFG_JIT)
-DEFINE_STUB_FUNCTION(void, optimize_from_loop)
+DEFINE_STUB_FUNCTION(void, optimize)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     
     CallFrame* callFrame = stackFrame.callFrame;
     CodeBlock* codeBlock = callFrame->codeBlock();
-
     unsigned bytecodeIndex = stackFrame.args[0].int32();
-    
+
 #if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("%p: Entered optimize_from_loop with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
+    dataLog("%p: Entered optimize with bytecodeIndex = %u, executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, bytecodeIndex, codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
 #endif
 
     if (!codeBlock->checkIfOptimizationThresholdReached())
@@ -1937,7 +1936,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
 
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Considering loop OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+        dataLog("Considering OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
 #endif
         if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
@@ -1959,14 +1958,14 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
         JSObject* error = codeBlock->compileOptimized(callFrame, scopeChain);
 #if ENABLE(JIT_VERBOSE_OSR)
         if (error)
-            dataLog("WARNING: optimized compilation from loop failed.\n");
+            dataLog("WARNING: optimized compilation failed.\n");
 #else
         UNUSED_PARAM(error);
 #endif
         
         if (codeBlock->replacement() == codeBlock) {
 #if ENABLE(JIT_VERBOSE_OSR)
-            dataLog("Optimizing %p from loop failed.\n", codeBlock);
+            dataLog("Optimizing %p failed.\n", codeBlock);
 #endif
             
             ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
@@ -1980,7 +1979,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     
     if (void* address = DFG::prepareOSREntry(callFrame, optimizedCodeBlock, bytecodeIndex)) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Optimizing %p from loop succeeded, performing OSR after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
+        dataLog("Optimizing %p succeeded, performing OSR after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
 #endif
 
         codeBlock->optimizeSoon();
@@ -1990,7 +1989,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     }
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("Optimizing %p from loop succeeded, OSR failed, after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
+    dataLog("Optimizing %p succeeded, OSR failed, after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
 #endif
 
     // Count the OSR failure as a speculation failure. If this happens a lot, then
@@ -1998,7 +1997,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     optimizedCodeBlock->countSpeculationFailure();
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("Encountered loop OSR failure into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+    dataLog("Encountered OSR failure into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
 #endif
 
     // We are a lot more conservative about triggering reoptimization after OSR failure than
@@ -2011,7 +2010,7 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     // reoptimization trigger.
     if (optimizedCodeBlock->shouldReoptimizeNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Triggering reoptimization of %p(%p) (in loop after OSR fail).\n", codeBlock, codeBlock->replacement());
+        dataLog("Triggering reoptimization of %p(%p) (after OSR fail).\n", codeBlock, codeBlock->replacement());
 #endif
         codeBlock->reoptimize();
         return;
@@ -2021,71 +2020,6 @@ DEFINE_STUB_FUNCTION(void, optimize_from_loop)
     // longer and then try again.
     codeBlock->optimizeAfterWarmUp();
 }
-
-DEFINE_STUB_FUNCTION(void, optimize_from_ret)
-{
-    STUB_INIT_STACK_FRAME(stackFrame);
-    
-    CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    
-#if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("Entered optimize_from_ret with executeCounter = %d, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock->jitExecuteCounter(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
-#endif
-
-    if (!codeBlock->checkIfOptimizationThresholdReached())
-        return;
-
-    if (codeBlock->hasOptimizedReplacement()) {
-#if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Returning from old JIT call frame with optimized replacement %p(%p), with success/fail %u/%u", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
-        CallFrame* callerFrame = callFrame->callerFrame();
-        if (callerFrame)
-            dataLog(", callerFrame = %p, returnPC = %p, caller code block = %p", callerFrame, callFrame->returnPC().value(), callerFrame->codeBlock());
-        dataLog("\n");
-#endif
-        if (codeBlock->replacement()->shouldReoptimizeNow()) {
-#if ENABLE(JIT_VERBOSE_OSR)
-            dataLog("Triggering reoptimization of %p(%p) (in return).\n", codeBlock, codeBlock->replacement());
-#endif
-            codeBlock->reoptimize();
-        }
-        
-        codeBlock->optimizeSoon();
-        return;
-    }
-    
-    if (!codeBlock->shouldOptimizeNow()) {
-#if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Delaying optimization for %p (in return) because of insufficient profiling.\n", codeBlock);
-#endif
-        return;
-    }
-    
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    JSObject* error = codeBlock->compileOptimized(callFrame, scopeChain);
-    if (error)
-        dataLog("WARNING: optimized compilation from ret failed.\n");
-    
-    if (codeBlock->replacement() == codeBlock) {
-#if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Optimizing %p from return failed.\n", codeBlock);
-#endif
-
-        ASSERT(codeBlock->getJITType() == JITCode::BaselineJIT);
-        codeBlock->dontOptimizeAnytimeSoon();
-        return;
-    }
-    
-    ASSERT(codeBlock->replacement()->getJITType() == JITCode::DFGJIT);
-
-#if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("Optimizing %p from return succeeded after a delay of %u.\n", codeBlock, codeBlock->optimizationDelayCounter());
-#endif
-    
-    codeBlock->optimizeSoon();
-}
 #endif // ENABLE(DFG_JIT)
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 251776075..d2bc15e64 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -450,8 +450,7 @@ extern "C" {
     void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     void JIT_STUB cti_op_throw_reference_error(STUB_ARGS_DECLARATION) WTF_INTERNAL;
 #if ENABLE(DFG_JIT)
-    void JIT_STUB cti_optimize_from_loop(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    void JIT_STUB cti_optimize_from_ret(STUB_ARGS_DECLARATION) WTF_INTERNAL;
+    void JIT_STUB cti_optimize(STUB_ARGS_DECLARATION) WTF_INTERNAL;
 #endif
     void* JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     void* JIT_STUB cti_op_construct_arityCheck(STUB_ARGS_DECLARATION) WTF_INTERNAL;
diff --git a/Source/JavaScriptCore/offlineasm/offsets.rb b/Source/JavaScriptCore/offlineasm/offsets.rb
index 63af014bb..4f2734f86 100644
--- a/Source/JavaScriptCore/offlineasm/offsets.rb
+++ b/Source/JavaScriptCore/offlineasm/offsets.rb
@@ -23,8 +23,15 @@
 
 require "ast"
 
-OFFSET_HEADER_MAGIC_NUMBERS = [ 0x9e43fd66, 0x4379bfba ]
-OFFSET_MAGIC_NUMBERS = [ 0xec577ac7, 0x0ff5e755 ]
+def to32Bit(value)
+    if value > 0x7fffffff
+        value -= 1 << 32
+    end
+    value
+end
+
+OFFSET_HEADER_MAGIC_NUMBERS = [ to32Bit(0x9e43fd66), to32Bit(0x4379bfba) ]
+OFFSET_MAGIC_NUMBERS = [ to32Bit(0xec577ac7), to32Bit(0x0ff5e755) ]
 
 #
 # MissingMagicValuesException
diff --git a/Source/JavaScriptCore/runtime/JSExportMacros.h b/Source/JavaScriptCore/runtime/JSExportMacros.h
index 19e2c286f..884805f86 100644
--- a/Source/JavaScriptCore/runtime/JSExportMacros.h
+++ b/Source/JavaScriptCore/runtime/JSExportMacros.h
@@ -36,7 +36,7 @@
 // See note in wtf/Platform.h for more info on EXPORT_MACROS.
 #if USE(EXPORT_MACROS)
 
-#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#if defined(BUILDING_JavaScriptCore)
 #define JS_EXPORT_PRIVATE WTF_EXPORT
 #else
 #define JS_EXPORT_PRIVATE WTF_IMPORT
@@ -50,7 +50,7 @@
 
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 
-#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#if defined(BUILDING_JavaScriptCore)
 #define JS_EXPORTDATA __declspec(dllexport)
 #else
 #define JS_EXPORTDATA __declspec(dllimport)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 7b6109599..d38570dfb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -132,8 +132,6 @@ void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(JSLock::currentThreadIsHoldingLock());
     
-    structure()->disableSpecificFunctionTracking();
-
     m_globalScopeChain.set(globalData(), this, ScopeChainNode::create(0, this, &globalData(), this, thisValue));
 
     JSGlobalObject::globalExec()->init(0, 0, m_globalScopeChain.get(), CallFrame::noCaller(), 0, 0);
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index aa71b8a7b..66cc89809 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -43,6 +43,16 @@
 
 namespace JSC {
 
+JSCell* getCallableObjectSlow(JSCell* cell)
+{
+    Structure* structure = cell->structure();
+    if (structure->typeInfo().type() == JSFunctionType)
+        return cell;
+    if (structure->classInfo()->isSubClassOf(&InternalFunction::s_info))
+        return cell;
+    return 0;
+}
+
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 ASSERT_CLASS_FITS_IN_CELL(JSNonFinalObject);
 ASSERT_CLASS_FITS_IN_CELL(JSFinalObject);
@@ -133,7 +143,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
         for (JSObject* obj = thisObject; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
             prototype = obj->prototype();
             if (prototype.isNull()) {
-                if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
+                if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getCallableObject(value)) && slot.isStrictMode())
                     throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
                 return;
             }
@@ -180,7 +190,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
             break;
     }
     
-    if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
+    if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getCallableObject(value)) && slot.isStrictMode())
         throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
     return;
 }
@@ -196,7 +206,7 @@ void JSObject::putDirectVirtual(JSObject* object, ExecState* exec, PropertyName
 {
     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
     PutPropertySlot slot;
-    object->putDirectInternal<PutModeDefineOwnProperty>(exec->globalData(), propertyName, value, attributes, slot, getJSFunction(value));
+    object->putDirectInternal<PutModeDefineOwnProperty>(exec->globalData(), propertyName, value, attributes, slot, getCallableObject(value));
 }
 
 bool JSObject::setPrototypeWithCycleCheck(JSGlobalData& globalData, JSValue prototype)
@@ -226,7 +236,7 @@ void JSObject::putDirectAccessor(JSGlobalData& globalData, PropertyName property
     ASSERT(value.isGetterSetter() && (attributes & Accessor));
 
     PutPropertySlot slot;
-    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getJSFunction(value));
+    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getCallableObject(value));
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index ac8601deb..fdb708dd9 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -46,6 +46,15 @@ namespace JSC {
         return 0;
     }
 
+    JS_EXPORT_PRIVATE JSCell* getCallableObjectSlow(JSCell*);
+
+    inline JSCell* getCallableObject(JSValue value)
+    {
+        if (!value.isCell())
+            return 0;
+        return getCallableObjectSlow(value.asCell());
+    }
+
     class GetterSetter;
     class HashEntry;
     class InternalFunction;
@@ -759,20 +768,20 @@ inline bool JSObject::putOwnDataProperty(JSGlobalData& globalData, PropertyName
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
     ASSERT(!structure()->hasGetterSetterProperties());
 
-    return putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value));
+    return putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getCallableObject(value));
 }
 
 inline void JSObject::putDirect(JSGlobalData& globalData, PropertyName propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
     PutPropertySlot slot;
-    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getJSFunction(value));
+    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getCallableObject(value));
 }
 
 inline void JSObject::putDirect(JSGlobalData& globalData, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!value.isGetterSetter());
-    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, 0, slot, getJSFunction(value));
+    putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, 0, slot, getCallableObject(value));
 }
 
 inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, PropertyName propertyName, JSValue value, unsigned attributes)
@@ -781,7 +790,7 @@ inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, Prope
     PropertyStorage newStorage = propertyStorage();
     if (structure()->shouldGrowPropertyStorage())
         newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
-    size_t offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, getJSFunction(value));
+    size_t offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, getCallableObject(value));
     setPropertyStorage(globalData, newStorage, structure());
     putDirectOffset(globalData, offset, value);
 }
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 46fe72684..2f0dd42e5 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -35,7 +35,6 @@
 #include "SymbolTable.h"
 #include <wtf/UnusedParam.h>
 #include <wtf/OwnArrayPtr.h>
-#include <wtf/UnusedParam.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index ec228f82a..7b6da6536 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,6 +48,7 @@ namespace JSC { namespace Options {
 bool useJIT;
 
 bool showDisassembly;
+bool showDFGDisassembly;
 
 unsigned maximumOptimizationCandidateInstructionCount;
 
@@ -165,6 +166,7 @@ void initializeOptions()
     SET(useJIT, true);
     
     SET(showDisassembly, false);
+    SET(showDFGDisassembly, false);
     
     SET(maximumOptimizationCandidateInstructionCount, 10000);
     
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index e5cc99590..0adb59e9b 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,6 +33,7 @@ namespace JSC { namespace Options {
 extern bool useJIT;
 
 extern bool showDisassembly;
+extern bool showDFGDisassembly; // showDisassembly implies showDFGDisassembly.
 
 extern unsigned maximumOptimizationCandidateInstructionCount;
 
diff --git a/Source/JavaScriptCore/shell/CMakeLists.txt b/Source/JavaScriptCore/shell/CMakeLists.txt
index 561d779dd..71b8963cc 100644
--- a/Source/JavaScriptCore/shell/CMakeLists.txt
+++ b/Source/JavaScriptCore/shell/CMakeLists.txt
@@ -20,5 +20,5 @@ IF (JSC_LINK_FLAGS)
 ENDIF ()
 
 IF (SHOULD_INSTALL_JS_SHELL)
-    INSTALL(TARGETS ${JSC_EXECUTABLE_NAME} DESTINATION bin)
+    INSTALL(TARGETS ${JSC_EXECUTABLE_NAME} DESTINATION "${EXEC_INSTALL_DIR}")
 ENDIF ()
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index 58696d9c5..4afb4d26a 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -66,7 +66,7 @@ def build(bld):
         features = 'cc cxx cshlib',
         includes = '. .. assembler ../WTF ' + ' '.join(includes),
         source = sources,
-        defines = ['BUILDING_JavaScriptCore', 'STATICALLY_LINKED_WITH_WTF'],
+        defines = ['BUILDING_JavaScriptCore'],
         target = 'jscore',
         uselib = 'WX ICU ' + get_config(),
         uselib_local = '',
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 4bc74cb3c..8ecf10b3e 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,66 @@
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121064.
+        http://trac.webkit.org/changeset/121064
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Broke Chromium Mac build.
+
+        * Platform.gypi:
+        * chromium/public/WebLayerTreeView.h:
+        (WebKit):
+        (WebLayerTreeView):
+        * chromium/public/WebRenderingStats.h: Removed.
+
+2012-06-22  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Expose rendering statistics to WebWidget.
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Reviewed by James Robinson.
+
+        The WebKit side of a basic framework for exposing rendering statistics
+        to Chromium's --enable-benchmarking extension.
+
+        * chromium/public/WebLayerTreeView.h:
+        (WebRenderingStatistics):
+        (WebKit):
+        (WebLayerTreeView):
+
+2012-06-22  Jeff Timanus  <twiz@chromium.org>
+
+        [Chromium] Change implementing a fast-path for copying GPU-accelerated Canvas2D instances to WebGL textures.
+        https://bugs.webkit.org/show_bug.cgi?id=86275
+
+        This change adds the necessary plumbing to the various rendering contexts to copy the backing store texture of
+        a Canvas2D instance to be copied to a WebGL texture.  The GL_CHROMIUM_copy_texture extension is necessary
+        because the backing-store for a GPU-accelerated skia Canvas2D is normally in BGRA format, which is not supported
+        by glCopyTexImage.
+
+        Reviewed by Kenneth Russell.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::copyTextureCHROMIUM):
+
+2012-06-20  Christopher Cameron  <ccameron@chromium.org>
+
+        [chromium] webkit-backface-visibility doesn't work with video
+        https://bugs.webkit.org/show_bug.cgi?id=88908
+
+        When determining a contents layer's backface culling, use the parent
+        layer's transform and backface-visibility properties. Track which
+        layers need this special treatment with useParentBackfaceVisibility
+        and setUseParentBackfaceVisibility functions in WebCore::LayerChromium,
+        WebKit::WebLayer, and WebCore::CCLayerImpl.
+
+        Reviewed by Adrienne Walker.
+
+        * chromium/public/WebLayer.h:
+            (WebLayer):
+                Add an accessor to specify that a layer should use its parent's
+                backface culling behavior.
+
 2012-06-19  Tony Payne  <tpayne@chromium.org>
 
         Add monitor profile support for Win
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
index 0e40f5faa..dc035aed1 100644
--- a/Source/Platform/chromium/public/WebGraphicsContext3D.h
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -411,6 +411,10 @@ public:
     virtual void getQueryivEXT(WGC3Denum target, WGC3Denum pname, WGC3Dint* params) { }
     virtual void getQueryObjectuivEXT(WebGLId query, WGC3Denum pname, WGC3Duint* params) { }
 
+    // GL_CHROMIUM_copy_texture
+    virtual void copyTextureCHROMIUM(WGC3Denum target, WGC3Duint sourceId,
+                                     WGC3Duint destId, WGC3Dint level, WGC3Denum internalFormat) { }
+
     GrGLInterface* createGrGLInterface();
 
 protected:
diff --git a/Source/Platform/chromium/public/WebLayer.h b/Source/Platform/chromium/public/WebLayer.h
index 8fc3d2d03..ca529f7fc 100644
--- a/Source/Platform/chromium/public/WebLayer.h
+++ b/Source/Platform/chromium/public/WebLayer.h
@@ -108,6 +108,16 @@ public:
     WEBKIT_EXPORT bool drawsContent() const;
 
     WEBKIT_EXPORT void setPreserves3D(bool);
+
+    // Mark that this layer should use its parent's transform and double-sided
+    // properties in determining this layer's backface visibility instead of
+    // using its own properties. If this property is set, this layer must
+    // have a parent, and the parent may not have this property set.
+    // Note: This API is to work around issues with visibility the handling of
+    // WebKit layers that have a contents layer (canvas, plugin, WebGL, video,
+    // etc).
+    WEBKIT_EXPORT void setUseParentBackfaceVisibility(bool);
+
     WEBKIT_EXPORT void setBackgroundColor(WebColor);
 
     // Clear the filters in use by passing in a newly instantiated
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
index 502920749..47a8da7f4 100644
--- a/Source/ThirdParty/ANGLE/ChangeLog
+++ b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,14 @@
+2012-06-22  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Sanitize GLSL code using ANGLE.
+
+        BlackBerry port does not sanitize GLSL code with ANGLE
+        https://bugs.webkit.org/show_bug.cgi?id=89583
+
+        Reviewed by Rob Buis.
+
+        * src/compiler/osinclude.h: Recognises QNX as POSIX
+
 2012-03-26  Dean Jackson  <dino@apple.com>
 
         Update ANGLE in WebKit
diff --git a/Source/ThirdParty/ANGLE/src/compiler/osinclude.h b/Source/ThirdParty/ANGLE/src/compiler/osinclude.h
index 9b3acdf2b..9f9393a71 100644
--- a/Source/ThirdParty/ANGLE/src/compiler/osinclude.h
+++ b/Source/ThirdParty/ANGLE/src/compiler/osinclude.h
@@ -17,7 +17,7 @@
 #elif defined(__APPLE__) || defined(__linux__) || \
       defined(__FreeBSD__) || defined(__OpenBSD__) || \
       defined(__sun) || defined(ANDROID) || \
-      defined(__GLIBC__) || defined(__GNU__)
+      defined(__GLIBC__) || defined(__GNU__) || defined(__QNX__)
 #define ANGLE_OS_POSIX
 #else
 #error Unsupported platform.
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index b01ed25bb..8a3746769 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,17 +1,103 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-06-25  Kent Tamura  <tkent@chromium.org>
 
-        [Qt][Win] Fix broken QtWebKit5.lib linking
-        https://bugs.webkit.org/show_bug.cgi?id=88321
+        Change the serialization format of form control state to make the code simple
+        https://bugs.webkit.org/show_bug.cgi?id=89847
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Hajime Morita.
 
-        Instead of letting a module's headers know which other modules depend on them,
-        have depending modules define explicitely that they want its symbols exported too.
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::appendEscaped): Added. This function adds the
+        escaped form of the input string. e.g. if stiring="foo,bar" escape='\'
+        special=',', the appended string is foo\,bar.
 
-        JavaScriptCore should then be compiled with both BUILDING_JavaScriptCore and
-        STATICALLY_LINKED_WITH_WTF.
+2012-06-24  Adam Barth  <abarth@webkit.org>
 
-        * wtf/ExportMacros.h:
+        Remove USE(CHROMIUM_NET) because it is unused
+        https://bugs.webkit.org/show_bug.cgi?id=89850
+
+        Reviewed by Eric Seidel.
+
+        I didn't see any mentions of CHROMIUM_NET when I grepped the Source
+        directory. Also, this USE macro isn't defined on OS(DARWIN) or
+        OS(ANDROID), which seems a bit odd given that Chromium uses the same
+        network stack on all platforms.
+
+        * wtf/Platform.h:
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * WTF.gyp/WTF.gyp:
+
+2012-06-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.com>
+
+        Causes crashes in LLVMPipe
+        https://bugs.webkit.org/show_bug.cgi?id=89358
+
+        Reviewed by Martin Robinson.
+
+        Change suggested by Dave Airlie and Xan Lopez.
+
+        * wtf/Platform.h: disable global fastMalloc for GTK+
+
+2012-06-22  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Memory corruption on HashTable.h
+        https://bugs.webkit.org/show_bug.cgi?id=88419
+
+        Reviewed by Martin Robinson.
+
+        Simplify definition of WTF_USE_PTHREADS and HAVE_PTHREAD_RWLOCK
+        for the GTK platform using OS(LINUX) instead of HAVE(PTHREAD_H).
+
+        * wtf/Platform.h:
+
+2012-06-21  Parth Patel  <parpatel@rim.com>
+
+        [Blackberry] BlackBerry::Platform::Settings::get() rename to BlackBerry::Platform::Settings::instance() to make it consistent with our other singletons
+        https://bugs.webkit.org/show_bug.cgi?id=89684
+
+        Reviewed by Yong Li.
+        
+        Update setting instance access to use instance() instead of get().
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::createThreadInternal):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix NPAPI plugins on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=54531
+
+        Reviewed by Martin Robinson.
+
+        Define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for the GTK+ port, and
+        include OwnPtrWin.cpp in the list of files built on Windows.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * wtf/Platform.h:
+
+2012-06-21  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Compile error: 'bool std::isinf(float)' is not 'constexpr' with GCC 4.6 in C++11 mode
+        https://bugs.webkit.org/show_bug.cgi?id=88721
+
+        Reviewed by Csaba Osztrogonác.
+
+        Don't define these as consexpr because with gcc 4.6
+        they call non constexpr functions.
+        * wtf/MathExtras.h:
+        (std::wtf_isinf):
+        (std::wtf_isnan):
 
 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
 
diff --git a/Source/WTF/GNUmakefile.am b/Source/WTF/GNUmakefile.am
index 2633bbbd9..7eab5c657 100644
--- a/Source/WTF/GNUmakefile.am
+++ b/Source/WTF/GNUmakefile.am
@@ -15,6 +15,11 @@ libWTF_la_LIBADD = \
 	$(WINMM_LIBS) \
 	-lpthread
 
+if TARGET_WIN32
+# OwnPtrWin.cpp needs the symbols from gdi32 dll
+libWTF_la_LIBADD += -lgdi32
+endif
+
 libWTF_la_CXXFLAGS = \
 	$(global_cxxflags) \
 	$(libWTF_la_CFLAGS)
diff --git a/Source/WTF/GNUmakefile.list.am b/Source/WTF/GNUmakefile.list.am
index 3dfc1dbd3..c5f48a6ce 100644
--- a/Source/WTF/GNUmakefile.list.am
+++ b/Source/WTF/GNUmakefile.list.am
@@ -227,7 +227,8 @@ wtf_sources += \
     Source/WTF/wtf/OSAllocatorWin.cpp \
     Source/WTF/wtf/ThreadFunctionInvocation.h \
     Source/WTF/wtf/ThreadingWin.cpp \
-    Source/WTF/wtf/ThreadSpecificWin.cpp
+    Source/WTF/wtf/ThreadSpecificWin.cpp \
+    Source/WTF/wtf/win/OwnPtrWin.cpp
 else
 wtf_sources += \
     Source/WTF/wtf/OSAllocatorPosix.cpp
diff --git a/Source/WTF/WTF.gyp/WTF.gyp b/Source/WTF/WTF.gyp/WTF.gyp
index 92cefc144..bca8366f0 100644
--- a/Source/WTF/WTF.gyp/WTF.gyp
+++ b/Source/WTF/WTF.gyp/WTF.gyp
@@ -44,7 +44,7 @@
     ],
   },
   'conditions': [
-    ['os_posix == 1 and OS != "mac" and OS != "android" and gcc_version==46', {
+    ['os_posix == 1 and OS != "mac" and gcc_version==46', {
       'target_defaults': {
         # Disable warnings about c++0x compatibility, as some names (such as nullptr) conflict
         # with upcoming c++0x types.
diff --git a/Source/WTF/wtf/ExportMacros.h b/Source/WTF/wtf/ExportMacros.h
index d50d6d117..efa0c8f81 100644
--- a/Source/WTF/wtf/ExportMacros.h
+++ b/Source/WTF/wtf/ExportMacros.h
@@ -72,7 +72,7 @@
 
 // FIXME: When all ports are using the export macros, we should replace
 // WTF_EXPORTDATA with WTF_EXPORT_PRIVATE macros.
-#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF)
+#if defined(BUILDING_WTF)  || defined(BUILDING_JavaScriptCore)
 #define WTF_EXPORTDATA WTF_EXPORT
 #else
 #define WTF_EXPORTDATA WTF_IMPORT
@@ -81,7 +81,7 @@
 #else // !USE(EXPORT_MACROS)
 
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !COMPILER(GCC)
-#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF)
+#if defined(BUILDING_WTF) || defined(BUILDING_JavaScriptCore)
 #define WTF_EXPORTDATA __declspec(dllexport)
 #else
 #define WTF_EXPORTDATA __declspec(dllimport)
@@ -98,7 +98,7 @@
 
 #endif // USE(EXPORT_MACROS)
 
-#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF)
+#if defined(BUILDING_WTF)  || defined(BUILDING_JavaScriptCore)
 #define WTF_EXPORT_PRIVATE WTF_EXPORT
 #else
 #define WTF_EXPORT_PRIVATE WTF_IMPORT
diff --git a/Source/WTF/wtf/MathExtras.h b/Source/WTF/wtf/MathExtras.h
index 3cc947447..e44ab6c6b 100644
--- a/Source/WTF/wtf/MathExtras.h
+++ b/Source/WTF/wtf/MathExtras.h
@@ -282,10 +282,10 @@ using std::signbit;
 #if COMPILER_QUIRK(GCC11_GLOBAL_ISINF_ISNAN)
 // A workaround to avoid conflicting declarations of isinf and isnan when compiling with GCC in C++11 mode.
 namespace std {
-    constexpr bool wtf_isinf(float f) { return std::isinf(f); }
-    constexpr bool wtf_isinf(double d) { return std::isinf(d); }
-    constexpr bool wtf_isnan(float f) { return std::isnan(f); }
-    constexpr bool wtf_isnan(double d) { return std::isnan(d); }
+    inline bool wtf_isinf(float f) { return std::isinf(f); }
+    inline bool wtf_isinf(double d) { return std::isinf(d); }
+    inline bool wtf_isnan(float f) { return std::isnan(f); }
+    inline bool wtf_isnan(double d) { return std::isnan(d); }
 };
 
 using std::wtf_isinf;
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index 3da0cd73f..4a68e49d2 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -476,7 +476,6 @@
 #define WTF_USE_SKIA 1
 #else
 #define WTF_USE_SKIA 1
-#define WTF_USE_CHROMIUM_NET 1
 #define WTF_USE_ICCJPEG 1
 #define WTF_USE_QCMSLIB 1
 #endif
@@ -490,6 +489,7 @@
 
 #if PLATFORM(GTK)
 #define WTF_USE_CAIRO 1
+#define ENABLE_GLOBAL_FASTMALLOC_NEW 0
 #endif
 
 
@@ -648,12 +648,7 @@
 #endif
 #endif
 
-#if PLATFORM(GTK)
-#if HAVE(PTHREAD_H)
-#define WTF_USE_PTHREADS 1
-#define HAVE_PTHREAD_RWLOCK 1
-#endif
-#elif PLATFORM(QT) && OS(UNIX)
+#if OS(UNIX) && (PLATFORM(GTK) || PLATFORM(QT))
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
 #endif
@@ -1026,7 +1021,7 @@
 #define WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK 1
 #endif
 
-#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((OS(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK) || PLATFORM(EFL)))
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((OS(UNIX) && (PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(EFL)))
 #define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
 #endif
 
diff --git a/Source/WTF/wtf/ThreadSpecific.h b/Source/WTF/wtf/ThreadSpecific.h
index 60c9907bd..f51ab4cf2 100644
--- a/Source/WTF/wtf/ThreadSpecific.h
+++ b/Source/WTF/wtf/ThreadSpecific.h
@@ -1,7 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -103,33 +102,6 @@ private:
 };
 
 #if USE(PTHREADS)
-
-typedef pthread_key_t ThreadSpecificKey;
-
-inline void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    int error = pthread_key_create(key, destructor);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    int error = pthread_key_delete(key);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificSet(ThreadSpecificKey key, void* value)
-{
-    pthread_setspecific(key, value);
-}
-
-inline void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return pthread_getspecific(key);
-}
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
 {
@@ -167,14 +139,6 @@ const int kMaxTlsKeySize = 256;
 WTF_EXPORT_PRIVATE long& tlsKeyCount();
 WTF_EXPORT_PRIVATE DWORD* tlsKeys();
 
-class ThreadSpecificKeyValue;
-typedef ThreadSpecificKeyValue* ThreadSpecificKey;
-
-void ThreadSpecificKeyCreate(ThreadSpecificKey*, void (*)(void *));
-void ThreadSpecificKeyDelete(ThreadSpecificKey);
-void ThreadSpecificSet(ThreadSpecificKey, void*);
-void* ThreadSpecificGet(ThreadSpecificKey);
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
diff --git a/Source/WTF/wtf/ThreadSpecificWin.cpp b/Source/WTF/wtf/ThreadSpecificWin.cpp
index 61a594251..d72996a7a 100644
--- a/Source/WTF/wtf/ThreadSpecificWin.cpp
+++ b/Source/WTF/wtf/ThreadSpecificWin.cpp
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,72 +19,15 @@
  */
 
 #include "config.h"
-#include "ThreadSpecific.h"
 
-#include "StdLibExtras.h"
-#include "ThreadingPrimitives.h"
+#include "ThreadSpecific.h"
 
-#if !USE(PTHREADS)
+#if USE(PTHREADS)
+#error This file should not be compiled by ports that do not use Windows native ThreadSpecific implementation.
+#endif
 
 namespace WTF {
 
-static Mutex& destructorsMutex()
-{
-    DEFINE_STATIC_LOCAL(Mutex, staticMutex, ());
-    return staticMutex;
-}
-
-class ThreadSpecificKeyValue {
-public:
-    ThreadSpecificKeyValue(void (*destructor)(void *))
-        : m_destructor(destructor)
-    {
-        m_tlsKey = TlsAlloc();
-        if (m_tlsKey == TLS_OUT_OF_INDEXES)
-            CRASH();
-
-        MutexLocker locker(destructorsMutex());
-        m_next = m_first;
-        m_first = this;
-    }
-
-    ~ThreadSpecificKeyValue()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue** next = &m_first;
-        while (*next != this) {
-            ASSERT(*next);
-            next = &(*next)->m_next;
-        }
-        *next = (*next)->m_next;
-
-        TlsFree(m_tlsKey);
-    }
-
-    void setValue(void* data) { TlsSetValue(m_tlsKey, data); }
-    void* value() { return TlsGetValue(m_tlsKey); }
-
-    static void callDestructors()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue* next = m_first;
-        while (next) {
-            if (void* data = next->value())
-                next->m_destructor(data);
-            next = next->m_next;
-        }
-    }
-
-private:
-    void (*m_destructor)(void *);
-    DWORD m_tlsKey;
-    ThreadSpecificKeyValue* m_next;
-
-    static ThreadSpecificKeyValue* m_first;
-};
-
-ThreadSpecificKeyValue* ThreadSpecificKeyValue::m_first = 0;
-
 long& tlsKeyCount()
 {
     static long count;
@@ -98,26 +40,6 @@ DWORD* tlsKeys()
     return keys;
 }
 
-void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    *key = new ThreadSpecificKeyValue(destructor);
-}
-
-void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    delete key;
-}
-
-void ThreadSpecificSet(ThreadSpecificKey key, void* data)
-{
-    key->setValue(data);
-}
-
-void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return key->value();
-}
-
 void ThreadSpecificThreadExit()
 {
     for (long i = 0; i < tlsKeyCount(); i++) {
@@ -126,10 +48,6 @@ void ThreadSpecificThreadExit()
         if (data)
             data->destructor(data);
     }
-
-    ThreadSpecificKeyValue::callDestructors();
 }
 
 } // namespace WTF
-
-#endif // !USE(PTHREADS)
diff --git a/Source/WTF/wtf/ThreadingPthreads.cpp b/Source/WTF/wtf/ThreadingPthreads.cpp
index f57f3224a..510173d09 100644
--- a/Source/WTF/wtf/ThreadingPthreads.cpp
+++ b/Source/WTF/wtf/ThreadingPthreads.cpp
@@ -178,7 +178,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     if (pthread_attr_getstack(&attr, &stackAddr, &stackSize))
         LOG_ERROR("pthread_attr_getstack() failed: %d", errno);
     else {
-        stackSize = BlackBerry::Platform::Settings::get()->secondaryThreadStackSize();
+        stackSize = BlackBerry::Platform::Settings::instance()->secondaryThreadStackSize();
         if (pthread_attr_setstack(&attr, stackAddr, stackSize))
             LOG_ERROR("pthread_attr_getstack() failed: %d", errno);
     }
diff --git a/Source/WTF/wtf/text/StringBuilder.h b/Source/WTF/wtf/text/StringBuilder.h
index d896d17b1..c73d46372 100644
--- a/Source/WTF/wtf/text/StringBuilder.h
+++ b/Source/WTF/wtf/text/StringBuilder.h
@@ -130,6 +130,21 @@ public:
         append(static_cast<LChar>(c));
     }
 
+    void appendEscaped(const String& string, UChar escape, UChar special)
+    {
+        if (string.isEmpty())
+            return;
+        unsigned requiredSize = length() + string.length();
+        if (capacity() < requiredSize)
+            reserveCapacity(requiredSize);
+        for (unsigned i = 0; i < string.length(); ++i) {
+            UChar ch = string[i];
+            if (ch == escape || ch == special)
+                append(escape);
+            append(ch);
+        }
+    }
+
     String toString()
     {
         shrinkToFit();
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index e3a057232..fcdeaba93 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -396,6 +396,7 @@ SET(WebCore_IDL_FILES
     page/PerformanceEntry.idl
     page/PerformanceEntryList.idl
     page/PerformanceNavigation.idl
+    page/PerformanceResourceTiming.idl
     page/PerformanceTiming.idl
     page/Screen.idl
     page/SpeechInputEvent.idl
@@ -566,8 +567,8 @@ SET(WebCore_SOURCES
     dom/DeviceMotionController.cpp
     dom/DeviceMotionData.cpp
     dom/DeviceMotionEvent.cpp
-    dom/DeviceOrientation.cpp
     dom/DeviceOrientationController.cpp
+    dom/DeviceOrientationData.cpp
     dom/DeviceOrientationEvent.cpp
     dom/Document.cpp
     dom/DocumentMarkerController.cpp
@@ -934,6 +935,8 @@ SET(WebCore_SOURCES
     inspector/InjectedScriptBase.cpp
     inspector/InjectedScriptHost.cpp
     inspector/InjectedScriptManager.cpp
+    inspector/InjectedScriptModule.cpp
+    inspector/InjectedScriptWebGLModule.cpp
     inspector/InspectorAgent.cpp
     inspector/InspectorApplicationCacheAgent.cpp
     inspector/InspectorBaseAgent.cpp
@@ -1085,6 +1088,7 @@ SET(WebCore_SOURCES
     page/PerformanceEntry.cpp
     page/PerformanceEntryList.cpp
     page/PerformanceNavigation.cpp
+    page/PerformanceResourceTiming.cpp
     page/PerformanceTiming.cpp
     page/PrintContext.cpp
     page/Screen.cpp
@@ -1203,7 +1207,7 @@ SET(WebCore_SOURCES
     platform/graphics/filters/CustomFilterGlobalContext.cpp
     platform/graphics/filters/CustomFilterMesh.cpp
     platform/graphics/filters/CustomFilterProgram.cpp
-    platform/graphics/filters/CustomFilterShader.cpp
+    platform/graphics/filters/CustomFilterCompiledProgram.cpp
     platform/graphics/filters/DistantLightSource.cpp
     platform/graphics/filters/FEBlend.cpp
     platform/graphics/filters/FEColorMatrix.cpp
@@ -1349,6 +1353,7 @@ SET(WebCore_SOURCES
     rendering/RenderFieldset.cpp
     rendering/RenderFileUploadControl.cpp
     rendering/RenderFlexibleBox.cpp
+    rendering/RenderGrid.cpp
     rendering/RenderFlowThread.cpp
     rendering/RenderFrame.cpp
     rendering/RenderFrameBase.cpp
@@ -2291,22 +2296,27 @@ IF (ENABLE_MHTML)
 ENDIF ()
 
 IF (ENABLE_WEBGL)
+    #ANGLE
     LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+        ${OPENGL_INCLUDE_DIR}
         ${THIRDPARTY_DIR}/ANGLE/src
-        ${THIRDPARTY_DIR}/ANGLE/include
+       #${THIRDPARTY_DIR}/ANGLE/include #Defined as SYSTEM include in order to have less priority than actual system headers
         ${THIRDPARTY_DIR}/ANGLE/include/GLSLANG
-        ${WEBCORE_DIR}/platform/graphics/gpu
+    )
+    LIST(APPEND WebCore_LIBRARIES
+        ${OPENGL_gl_LIBRARY}
     )
     LIST(APPEND WebCore_SOURCES
         ${DERIVED_SOURCES_WEBCORE_DIR}/glslang.cpp
         ${DERIVED_SOURCES_WEBCORE_DIR}/glslang_tab.cpp
-        ${THIRDPARTY_DIR}/ANGLE/src/compiler/CodeGenGLSL.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/BuiltInFunctionEmulator.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/CodeGenGLSL.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/Compiler.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/debug.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/DetectRecursion.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/ForLoopUnroll.cpp
+        ${THIRDPARTY_DIR}/ANGLE/src/compiler/glslang_lex.cpp
+        ${THIRDPARTY_DIR}/ANGLE/src/compiler/glslang_tab.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/InfoSink.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/Initialize.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/InitializeDll.cpp
@@ -2334,7 +2344,6 @@ IF (ENABLE_WEBGL)
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/SearchSymbol.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/ShaderLang.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/SymbolTable.cpp
-        ${THIRDPARTY_DIR}/ANGLE/src/compiler/VersionGLSL.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/TranslatorESSL.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/TranslatorGLSL.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/TranslatorHLSL.cpp
@@ -2342,6 +2351,13 @@ IF (ENABLE_WEBGL)
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/util.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/ValidateLimitations.cpp
         ${THIRDPARTY_DIR}/ANGLE/src/compiler/VariableInfo.cpp
+        ${THIRDPARTY_DIR}/ANGLE/src/compiler/VersionGLSL.cpp
+    )
+
+    LIST(APPEND WebCore_SOURCES
+        html/canvas/OESStandardDerivatives.cpp
+        html/canvas/OESTextureFloat.cpp
+        html/canvas/OESVertexArrayObject.cpp
         html/canvas/WebGLBuffer.cpp
         html/canvas/WebGLCompressedTextureS3TC.cpp
         html/canvas/WebGLContextAttributes.cpp
@@ -2676,14 +2692,14 @@ ADD_CUSTOM_COMMAND(
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptSource.h)
 
 
-# Generate InjectedWebGLScriptSource.h
+# Generate InjectedScriptWebGLModuleSource.h
 IF (ENABLE_WEBGL)
     ADD_CUSTOM_COMMAND(
-        OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedWebGLScriptSource.h
-        MAIN_DEPENDENCY inspector/InjectedWebGLScriptSource.js
-        COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl InjectedWebGLScriptSource_js ${WEBCORE_DIR}/inspector/InjectedWebGLScriptSource.js ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedWebGLScriptSource.h
+        OUTPUT ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptWebGLModuleSource.h
+        MAIN_DEPENDENCY inspector/InjectedScriptWebGLModuleSource.js
+        COMMAND ${PERL_EXECUTABLE} ${WEBCORE_DIR}/inspector/xxd.pl InjectedScriptWebGLModuleSource_js ${WEBCORE_DIR}/inspector/InjectedScriptWebGLModuleSource.js ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptWebGLModuleSource.h
         VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedWebGLScriptSource.h)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/InjectedScriptWebGLModuleSource.h)
 ENDIF ()
 
 
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 09cc0d159..c09c1f4ea 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,11 +1,5625 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        [Qt][Win] Fix broken QtWebKit5.lib linking
-        https://bugs.webkit.org/show_bug.cgi?id=88321
+        [Qt] Fix Win32 debug build
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Tor Arne Vestbø.
+
+        Consistently use use_all_in_one_files when requested in the configuration. The previous
+        Linux condition has been moved to Tools/qmake/mkspecs/features/unix/default_pre.prf
+
+        * Target.pri:
+
+2012-06-25  Philip Rogers  <pdr@google.com>
+
+        Fix rewinding of SVG animations
+        https://bugs.webkit.org/show_bug.cgi?id=89846
+
+        Reviewed by Nikolas Zimmermann.
+
+        r116451 introduced an optimization to only clear non-freeze animations when
+        calling setCurrentTime (via reset()). This causes fill=freeze animations to
+        not clear which breaks rewinding of an animation.
+
+        In the presence of multiple animations, we reset the first animation to the
+        base value and accumulate all results into that; this masked the problem because
+        2 animations were required to hit the bug (our tests primarily cover just 1).
+
+        Test: svg/animations/animate-reset-freeze.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::reset):
+
+2012-06-25  Kent Tamura  <tkent@chromium.org>
+
+        Change the serialization format of form control state to make the code simple
+        https://bugs.webkit.org/show_bug.cgi?id=89847
+
+        Reviewed by Hajime Morita.
+
+        We used multiple strings to represent state of single form control. It
+        made the code complex. We change the serialization format so that one
+        CSV string represents state.
+
+        Examples in the old format:
+            "0"
+            "1", "value"
+            "3", "value1", "value2,value2", "value3"
+
+        Examples in the new format:
+            ""
+            ",value"
+            ",value1,value2\,value2,value3"
+
+        Test: fast/forms/state-restore-various-values.html
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serialize):
+        Generate comma-separated string.
+        ',' in a value is serialized as "\,".
+        We changed the signature because we don't need the out-argument.
+        (WebCore::FormControlState::deserialize):
+        Parses the input comma-separated string.
+        We changed the signature because we don't need multiple input strings.
+        (formStateSignature):
+        Bump up the version because of the representation change.
+        (WebCore::FormController::formElementsState):
+        The new serialized format occupies just one string for one control.
+        - Expected size is now 3n+1.
+        - Use FormControlState::serialize().
+        (WebCore::FormController::setStateForNewFormElements):
+        The new serialized format occupies just one string for one control.
+        So we can check the vector size before the iteration.
+        * html/FormController.h:
+        (FormControlState): Change the function signatures.
+
+        * html/shadow/CalendarPickerElement.cpp:
+        (WebCore::addJavaScriptString): Use StringBuilder::appendEscaped().
+
+2012-06-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add external resources size to the native memory diagram
+        https://bugs.webkit.org/show_bug.cgi?id=89754
+
+        Reviewed by Vsevolod Vlasov.
+
+        Size of external strings and arrays is now reported through the inspector
+        protocol and displayed on the native memory chart.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (WebCore::ScriptProfiler::visitJSDOMWrappers):
+        (WebCore::ScriptProfiler::visitExternalJSStrings):
+        (WebCore::ScriptProfiler::visitExternalJSArrays):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::visitJSDOMWrappers):
+        (WebCore::ScriptProfiler::visitExternalJSStrings):
+        (WebCore::ScriptProfiler::visitExternalJSArrays):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::visitStrings):
+        (WebCore::V8BindingPerIsolateData::visitJSExternalStrings):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        (V8BindingPerIsolateData):
+        * inspector/BindingVisitors.h: Renamed from Source/WebCore/inspector/DOMWrapperVisitor.h.
+        (WTF):
+        (WebCore):
+        (NodeWrapperVisitor):
+        (WebCore::NodeWrapperVisitor::~NodeWrapperVisitor):
+        (ExternalStringVisitor):
+        (WebCore::ExternalStringVisitor::~ExternalStringVisitor):
+        (ExternalArrayVisitor):
+        (WebCore::ExternalArrayVisitor::~ExternalArrayVisitor):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::jsExternalResourcesInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+
+2012-06-24  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed compile error fix of Chromium Win Release.
+        Touch header files for ENABLE(CSS_VARIABLES) so that
+        it forces to rebuild files by changing ENABLE(CSS_VARIABLES)
+        in Sources/WebKit/chromium/features.gypi at r121129
+
+        * css/CSSParserMode.h:
+        * css/CSSValue.h:
+        (WebCore):
+        * css/CSSVariableValue.h:
+        * page/Settings.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareInheritedData.h:
+        * rendering/style/StyleVariableData.h:
+
+2012-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Texmap] Minor cleanup for TextureMapper::accelerationMode()
+        https://bugs.webkit.org/show_bug.cgi?id=89825
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Replace the virtual method with a simple member variable.
+
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::TextureMapper::accelerationMode):
+        (WebCore::TextureMapper::TextureMapper):
+        (TextureMapper):
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::TextureMapperGL):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+        (WebCore::TextureMapperImageBuffer::TextureMapperImageBuffer):
+
+2012-06-24  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: transitions starting and ending with a calc expression move to end state
+        https://bugs.webkit.org/show_bug.cgi?id=89738
+
+        Reviewed by Tony Chang.
+
+        The equality operator for CalculationValue was not working as expected. The 
+        equality operator for OwnPtr is private, as OwnPtrs should always be different.
+        The OwnPtrs ended up getting cast to bool before being compared, and the 
+        comparison was always returning true.
+
+        The comparison between OwnPtrs has been removed. It doesn't add value to compare
+        the raw pointers either, since OwnPtrs should always be unique. We cannot
+        ASSERT the uniqueness though, as it is legitimate to compare a CalculationValue
+        to itself.
+
+        Test: css3/calc/transition-start-end-with-calc.html
+
+        * platform/CalculationValue.h:
+        (WebCore::CalculationValue::operator==):
+
+2012-06-24  MORITA Hajime  <morrita@google.com>
+
+        NodeRenderingContext::AttachingPhase is redundant.
+        https://bugs.webkit.org/show_bug.cgi?id=79220
+
+        Reviewed by Dimitri Glazkov.
+
+        This change removes NodeRenderingContext::AttachingPhase and
+        NodeRenderingContext::m_phase respectively. The state originally
+        represented as m_phase is naturally encoded into other member variables.
+
+        NodeRenderingContext::m_visualParentShadow is also replaced, with
+        a local variable parentScope.
+
+        Basically, what NodeRenderingContext wants to know is the parent of
+        the composed shadow tree and an optional insertion point where the
+        node is distributed. Once these becomes clear, m_phase is no longer required.
+        It was rather a historical artifact.
+
+        No new tests. No behavioral change.
+
+        * dom/NodeRenderingContext.cpp: Replaced m_phase with implicit states.
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        (WebCore::NodeRenderingContext::isOnUpperEncapsulationBoundary):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle): Removed an assert which checks m_phase.
+        (WebCore::NodeRenderingContext::resetStyleInheritance): Removed an assert which checks m_phase.
+        * html/shadow/InsertionPoint.h:
+        (WebCore::isInsertionPoint): Fix null case check.
+        (WebCore::isLowerEncapsulationBoundary): Renamed from isShadowBoundary()
+
+2012-06-24  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION(r121124): LayoutTests/fast/block/inline-children-root-linebox-crash.html asserts
+        https://bugs.webkit.org/show_bug.cgi?id=89844
+        
+        Reviewed by Dan Bernstein.
+
+        We need to check for the flipped writing mode and take the slow path if it is used.
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
+
+2012-06-24  Luke Macpherson  <macpherson@chromium.org>
+
+        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
+        https://bugs.webkit.org/show_bug.cgi?id=89542
+
+        Reviewed by Dimitri Glazkov.
+
+        Added fast/css/variables/build-supports-variables.html to test runtime flag in test environment.
+        Updated all other css variables tests to enable the runtime flag from JS.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParserContext::CSSParserContext):
+        (WebCore::operator==):
+        (WebCore::CSSParser::cssVariablesEnabled):
+        (WebCore):
+        (WebCore::CSSParser::detectDashToken):
+        (WebCore::CSSParser::lex):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSParserMode.h:
+        (CSSParserContext):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::setCSSVariablesEnabled):
+        (WebCore::Settings::cssVariablesEnabled):
+
+2012-06-22  Kent Tamura  <tkent@chromium.org>
+
+        Selected option is not restored correctly
+        https://bugs.webkit.org/show_bug.cgi?id=89623
+
+        Reviewed by Hajime Morita.
+
+        Details of the bug:
+        We saved a state of a <select> element as a string of which length was
+        the size of <select>'s children. e.g. If a <select> had five children
+        and the second and the fifth items were selected, the state string was:
+                ".X..X"
+
+        This didn't work well if the structure of the children was updated after
+        parsing. For example,
+        1. A page has the following <select> initially:
+          <select multiple>
+            <option>Banana
+            <option>Lemon
+            <option>Orange
+            <option>Strawberry
+          <select>
+
+        2. For some reasons, <option>Apple</option> is prepended to the children.
+        3. Some items are selected.
+        4. The page is unloaded. Selection state is saved.
+        5. A user go back to the page again. A browser parses the page again.
+        6. Try to restore the <select> state with the saved data at 4.
+          But "Apple" is missing. The <select> has wrong selections.
+
+        Solution:
+        We save the state as a set of selected values. If "Banana" and
+        "Strawberry" are selected in the above <select>, we save two strings;
+        "Banana" and "Strawberry", not ".X..X".
+
+        Test: fast/forms/select/select-state-restore.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        Store selected value strings to a FormControlState object.
+        (WebCore::HTMLSelectElement::searchOptionsForValue):
+        A helper function to find an <option> with the specified value.
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        Clear all of selections, then select options with saved values.
+        In order to avoid O(M x N) loop, we start searching at position we found
+        the previous value.
+        * html/HTMLSelectElement.h: Declare searchOptionsForValue.
+        * html/FormController.cpp:
+        (formStateSignature): Bump up the version because this is a incompatible
+        change.
+
+2012-06-24  David Barr  <davidbarr@chromium.org>
+
+        Add snap to css3-images image-resolution
+        https://bugs.webkit.org/show_bug.cgi?id=89745
+
+        Reviewed by Tony Chang.
+
+        Due to floating point imprecision, it is difficult to be precise in dpcm.
+        So use PrimitiveValue::roundForImpreciseConversion rather than just floor.
+
+        No new tests; extended fast/css/image-resolution/image-resolution.html
+
+        * css/CSSParser.cpp: Accept snap identifier in image-resolution property.
+        (WebCore::CSSParser::parseImageResolution): Map CSSValueSnap to identifier value from cssValuePool.
+        * css/CSSValueKeywords.in: Add snap.
+        * css/StyleBuilder.cpp: Extend ApplyPropertyImageResolution to apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyInheritValue): Apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyInitialValue): Apply RenderStyle::imageResolutionSnap.
+        (WebCore::ApplyPropertyImageResolution::applyValue): Map CSSValueSnap to ImageResolutionSnapPixels.
+        * rendering/RenderImage.cpp: Extend conditions for recalculation of intrinsic size.
+        (WebCore::RenderImage::styleDidChange): Update intrinsic size if RenderStyle::imageResolutionSnap() has changed.
+        (WebCore::RenderImage::imageDimensionsChanged): Floor scale factor to int, round up if less than 0.01 away from ceiling.
+        * rendering/style/RenderStyle.cpp: Include StyleRareInheritedData::m_imageResolutionSnap in style diff.
+        (WebCore::RenderStyle::diff): Map change in StyleRareInheritedData::m_imageResolutionSnap to StyleDifferenceLayout.
+        * rendering/style/RenderStyle.h: Add RenderStyle::imageResolutionSnap, RenderStyle::setImageResolutionSnap, RenderStyle::initialImageResolutionSnap.
+        * rendering/style/RenderStyleConstants.h: Add enum ImageResolutionSnap.
+        * rendering/style/StyleRareInheritedData.cpp: Add StyleRareInheritedData::m_imageResolutionSnap.
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData): Add m_imageResolutionSnap to default and copy constructor.
+        (WebCore::StyleRareInheritedData::operator==): Include m_imageResolutionSnap in comparison.
+        * rendering/style/StyleRareInheritedData.h: Add StyleRareInheritedData::m_imageResolutionSnap.
+        (StyleRareInheritedData): Add 1-bit field StyleRareInheritedData::m_imageResolutionSnap.
+
+2012-06-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121106.
+        http://trac.webkit.org/changeset/121106
+        https://bugs.webkit.org/show_bug.cgi?id=89841
+
+        Caused 85% performance regressions on Dromaeo/jslib-modify-
+        jquery.html (Requested by rniwa on #webkit).
+
+        * dom/Document.cpp:
+        (WebCore::Document::clearNodeListCaches):
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
+        * dom/Node.cpp:
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore):
+        (WebCore::NodeRareData::createNodeLists):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::adoptTreeScope):
+        (WebCore::NodeRareData::ensureNodeLists):
+        (NodeRareData):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        * dom/TreeScope.h:
+        (WebCore::TreeScope::addNodeListCache):
+        (WebCore::TreeScope::removeNodeListCache):
+        (WebCore::TreeScope::hasNodeListCaches):
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList):
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList):
+        (WebCore::RadioNodeList::~RadioNodeList):
+
+2012-06-24  Adam Barth  <abarth@webkit.org>
+
+        Change the type of the second argument of FrameSelection::revealSelection to use RevealExtentOption
+        https://bugs.webkit.org/show_bug.cgi?id=89833
+
+        Reviewed by Ryosuke Niwa.
+
+        As requested by Ryosuke Niwa.  Rare boolean parameters are hard to read.
+
+        * WebCore.exp.in:
+        * editing/Editor.cpp:
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        * editing/Editor.h:
+        (Editor):
+        * editing/FrameSelection.cpp:
+        (WebCore::FrameSelection::setSelection):
+        (WebCore::FrameSelection::revealSelection):
+        * editing/FrameSelection.h:
+
+2012-06-24  Antti Koivisto  <antti@apple.com>
+
+        Optimize RenderGeometryMap mappings gathering
+        https://bugs.webkit.org/show_bug.cgi?id=89828
+
+        Reviewed by Simon Fraser.
+
+        RenderGeometryMap currently gathers mappings by climbing the rendering tree. This is slow and can produce 
+        large number of mapping steps. In the common case we already have the child layer coordinates available in
+        the layer tree and we can just use that.
+        
+        The combination of faster mappings gathering and fewer number of applying steps reduces time spent under 
+        RenderLayerCompositor::computeCompositingRequirements to less than half when scrolling the mobile version
+        of twitter.com.
+        
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore):
+        (WebCore::RenderGeometryMap::pushMappingsToAncestor):
+        
+            Use pre-computed mapping from the layer tree when possible.
+
+        (WebCore::RenderGeometryMap::popMappingsToAncestor):
+        * rendering/RenderGeometryMap.h:
+        
+            Add some inline capacity.
+
+        (WebCore):
+        (RenderGeometryMap):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::canUseConvertToLayerCoords):
+        (RenderLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2012-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Rename isPositioned to isOutOfFlowPositioned for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=89836
+
+        Reviewed by Antti Koivisto.
+        
+        RenderObject and RenderStyle had an isPositioned() method that was
+        confusing, because it excluded relative positioning. Rename to 
+        isOutOfFlowPositioned(), which makes it clearer that it only applies
+        to absolute and fixed positioning.
+
+        Simple rename; no behavior change.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * dom/Text.cpp:
+        (WebCore::Text::rendererIsNeeded):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitNewlinesBeforeAndAfterNode):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::shouldScaleColumns):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::flipLinesInBlockDirection):
+        (WebCore::InlineFlowBox::computeOverflow):
+        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
+        (WebCore::InlineFlowBox::computeUnderAnnotationAdjustment):
+        * rendering/InlineIterator.h:
+        (WebCore::isIteratorTarget):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::addChildToContinuation):
+        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks):
+        (WebCore::RenderBlock::containingColumnsBlock):
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        (WebCore::getInlineRun):
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        (WebCore::RenderBlock::handlePositionedChild):
+        (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::blockSelectionGaps):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::markSiblingsWithFloatsForLayout):
+        (WebCore::isChildHitTestCandidate):
+        (WebCore::InlineMinMaxIterator::next):
+        (WebCore::RenderBlock::computeBlockPreferredLogicalWidths):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        (WebCore::RenderBlock::updateFirstLetter):
+        (WebCore::shouldCheckLines):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::inNormalFlow):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        (WebCore::RenderBlock::adjustBlockChildForPagination):
+        (WebCore::RenderBlock::renderName):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::shouldSkipCreatingRunsForObject):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::setMarginsForRubyRun):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::computeBlockDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::LineBreaker::skipTrailingWhitespace):
+        (WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace):
+        (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::positionLineBox):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::renderBoxRegionInfo):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::availableLogicalHeightUsing):
+        (WebCore::percentageLogicalHeightIsResolvable):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::stretchesToViewport):
+        (WebCore::RenderBox::isDeprecatedFlexItem):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        (WebCore::RenderBoxModelObject::mapAbsoluteToLocalPoint):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::childDoesNotAffectWidthOrFlexing):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):
+        (WebCore::RenderDeprecatedFlexibleBox::renderName):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        (WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis):
+        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::computeNextFlexLine):
+        (WebCore::RenderFlexibleBox::resolveFlexibleLengths):
+        (WebCore::RenderFlexibleBox::prepareChildForPositionedLayout):
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+        (WebCore::RenderFlexibleBox::layoutColumnReverse):
+        (WebCore::RenderFlexibleBox::adjustAlignmentForChild):
+        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
+        * rendering/RenderGrid.cpp:
+        (WebCore::RenderGrid::renderName):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeIntrinsicRatioInformation):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::generateCulledLineBoxRects):
+        (WebCore):
+        (WebCore::RenderInline::culledInlineFirstLineBox):
+        (WebCore::RenderInline::culledInlineLastLineBox):
+        (WebCore::RenderInline::culledInlineVisualOverflowBoundingBox):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::dirtyLineBoxes):
+        * rendering/RenderLayer.cpp:
+        (WebCore::checkContainingBlockChainForPagination):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForPosition):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderMultiColumnBlock.cpp:
+        (WebCore::RenderMultiColumnBlock::renderName):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        (WebCore::RenderObject::setPreferredLogicalWidthsDirty):
+        (WebCore::RenderObject::invalidateContainerPreferredLogicalWidths):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isOutOfFlowPositioned):
+        (WebCore::RenderObject::isInFlowPositioned):
+        (WebCore::RenderObject::hasClip):
+        (WebCore::RenderObject::isFloatingOrOutOfFlowPositioned):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::hasAutoHeightOrContainingBlockWithAutoHeight):
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::rubyText):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::computeLogicalWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.h:
+
+2012-06-24  Oli Lan  <olilan@chromium.org>
+
+        After Editor::setComposition is called, input should scroll to the end of the composition.
+        https://bugs.webkit.org/show_bug.cgi?id=88999
+
+        Reviewed by Ryosuke Niwa.
+
+        This fixes an issue where after a call to setComposition, the start of the composition is revealed
+        (scrolled to) instead of the end (where the caret/editing point should be).
+
+        The change is to allow revealSelectionAfterEditingOperation to take a revealExtent parameter,
+        and to pass that parameter as true when calling from setIgnoreCompositionSelectionChange, which is
+        called at the end of setComposition.
+
+        Test: fast/forms/input-set-composition-scroll.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        (WebCore::Editor::setIgnoreCompositionSelectionChange):
+        * editing/Editor.h:
+        (Editor):
+
+2012-06-24  Joshua Bell  <jsbell@chromium.org>
+
+        Web Inspector: Simplify InspectorIndexedDBAgent to use IDB metadata API
+        https://bugs.webkit.org/show_bug.cgi?id=89495
+
+        Reviewed by Vsevolod Vlasov.
+
+        No new tests - no functional changes.
+
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: speed up Timeline and Elements panel rendering
+        https://bugs.webkit.org/show_bug.cgi?id=89771
+
+        Reviewed by Yury Semikhatsky.
+
+        I used timeline panel to find unnecessary style operations.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._updateFrames):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype.onResize):
+        (WebInspector.TimelinePanel.prototype._onScroll):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype._adjustScrollPosition):
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Inserting nodes is slow due to Node::notifyNodeListsAttributeChanged (20%+)
+        https://bugs.webkit.org/show_bug.cgi?id=73853
+
+        Reviewed by Anders Carlsson and Ojan Vafai.
+
+        Invalidate all node lists at document level to avoid having to walk up the DOM tree in the invalidation.
+        In particular, this makes appending node O(1) with respect to the depth of the tree in common cases when
+        we have node lists somewhere in the tree scope.
+
+        We now invalidate more node lists than we used to but it shouldn't matter much in practice because
+        most websites don't add or remove nodes or modify relevant attributes while iterating through node lists.
+        The change would also register each node list to document thereby consuming one extra pointer, however,
+        this should not have a significant memory impact given we used to do it unintentionally until I fixed it in
+        r110797 three months ago.
+
+        Also, RadioNodeList and LabelsNodeList had always been invalidated at document level so this refactoring
+        also allows us to move calls to registerDynamicSubtreeNodeList and unregisterDynamicSubtreeNodeList in
+        those node lists to DynamicSubtreeNodeList, and even delete NodeListsNodeData::invalidateCaches().
+
+        In addition, removed m_numNodeListCaches from TreeScope since it was only used to avoid walking up
+        the ancestors in invalidateNodeListsCacheAfterAttributeChanged and invalidateNodeListsCacheAfterChildrenChanged
+        but we don't walk up the ancestors any more. Also note that m_listsInvalidatedAtDocument tells us exactly
+        how many node lists are present for each document.
+
+        * dom/Document.cpp:
+        (WebCore::Document::clearNodeListCaches): Optionally takes a qualified attribute name so that we don't
+        have to invalidate tag node lists when only attributes are modified.
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::~DynamicSubtreeNodeList): Calls unregisterDynamicSubtreeNodeList.
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList): Calls registerDynamicSubtreeNodeList.
+        * dom/Node.cpp:
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged): No longer walks up the tree to invalidate
+        node list caches. All invalidations are done in Document::clearNodeListCaches.
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged): Ditto.
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore):
+        (WebCore::NodeRareData::createNodeLists):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::adoptTreeScope): Invalidate node list caches while registering and
+        unregistering node lists from old and new documents respectively now that invalidateCaches() has been
+        (WebCore::NodeRareData::ensureNodeLists):
+        (NodeRareData):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList):
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList):
+        (WebCore::RadioNodeList::~RadioNodeList):
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Clang and cl.exe build fix after r121103. Don't inherit from WTF::PairHash<unsigned char, StringType>.
 
-        * platform/PlatformExportMacros.h:
+        * dom/NodeRareData.h:
+
+2012-06-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r120979): getElementsByTagName is 12% slower
+        https://bugs.webkit.org/show_bug.cgi?id=89783
+
+        Reviewed by Darin Adler.
+
+        The problem is that hashing std::pair<unsigned short, AtomicString> is very slow compared to just hashing AtomicString,
+        which internally holds a hash already. Fixed the regression by replacing the default hash function by the one that
+        computes AtomicString's hash + list type. This is okay because we only have 7 node list types at the moment.
+
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::hash):
+        (NodeListCacheMapEntryHash):
+        (WebCore::NodeListsNodeData::NodeListCacheMapEntryHash::equal):
+        (WebCore::NodeListsNodeData::namedNodeListKey):
+
+2012-06-23  Dan Bernstein  <mitz@apple.com>
+
+        RenderText’s minimum preferred width is incorrect automatic hyphenation is used
+        https://bugs.webkit.org/show_bug.cgi?id=89814
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/text/hyphen-min-preferred-width.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::maxWordFragmentWidth): Added this helper function. It returns the width of the
+        widest hyphenated fragment of the word (except for the suffix after the last hyphen) and
+        the offset of the last hyphenation opportunity.
+        (WebCore::RenderText::computePreferredLogicalWidths): Changed this function to consider the
+        widths of hyphenated word fragments rather than entire words when computing the minimum
+        width. Because hyphenating and measuring all fragments is expensive, hyphenation is only
+        attempted if the unhyphenated word is wider than the current minimum width.
+
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
+        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
+        (-[WebScriptObject dealloc]):
+        (-[WebScriptObject finalize]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-23  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Store hit-test rect in HitTestPoint as Rect.
+        https://bugs.webkit.org/show_bug.cgi?id=89454
+
+        Reviewed by Darin Adler.
+
+        Calculate the rectangle early and store that instead of padding
+        to avoid recalculating the rectangle for every single element
+        hit tested.
+
+        No change in functionality. No new tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::bestClickableNodeForTouchPoint):
+        (WebCore::EventHandler::bestZoomableAreaForTouchPoint):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestPoint::HitTestPoint):
+        (WebCore::HitTestPoint::operator=):
+        (WebCore::HitTestPoint::setPoint):
+        (WebCore::hitTestPointIntersects):
+        (WebCore::HitTestPoint::intersects):
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        * rendering/HitTestResult.h:
+        (HitTestPoint):
+        (WebCore::HitTestPoint::boundingBox):
+        (WebCore::HitTestPoint::topPadding):
+        (WebCore::HitTestPoint::rightPadding):
+        (WebCore::HitTestPoint::bottomPadding):
+        (WebCore::HitTestPoint::leftPadding):
+        (HitTestResult):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hitTestColumns):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+
+2012-06-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        Text with text-overflow:ellipsis and text-align:right is left aligned
+        https://bugs.webkit.org/show_bug.cgi?id=88705
+
+        Reviewed by Dan Bernstein.
+
+        When building the line of a text with overflow, we do not know if we can place
+        an ellipsis and where it should be. Because of that, text is laid out as if it does
+        not have text-overflow: ellipsis.
+
+        This causes problems with text-alignement right in LTR and left in RTL. The shortened text
+        did not follow the allignment.
+
+        This patch changes the position of lines with ellipsis after layout to follow the allignment.
+        In RenderBlock::checkLinesForTextOverflow(), the call to RootInlineBox::placeEllipsis() now
+        also gives the width of the truncated text. We use this width to re-compute the alignement and
+        shift the box if necessary.
+
+        In RenderBlock::deleteEllipsisLineBoxes() we revert the text to the position computed with the
+        total width. This way all layout computation is done as usual.
+
+        Tests: fast/css/text-overflow-ellipsis-text-align-left.html
+               fast/css/text-overflow-ellipsis-text-align-right.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::canAccommodateEllipsis): Make the method const for readability, truncating is
+        done later in placeEllipsisBox().
+        (WebCore::InlineBox::placeEllipsisBox): Add an output argument, truncatedWidth, giving the width
+        of the text + ellipsis after truncation (if any truncation can be done).
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineBox::adjustLogicalPosition): adjustPosition() logical coordinates.
+        (WebCore::InlineFlowBox::canAccommodateEllipsis):
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineFlowBox.h:
+        (InlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::deleteEllipsisLineBoxes): In addition to removing the truncation, we
+        need to revert the shift introduced by checkLinesForTextOverflow(). This restore the lines
+        to its original, untruncated position in order to layout the block correctly in RenderBlock::layoutInlineChildren().
+        (WebCore::RenderBlock::checkLinesForTextOverflow): After we truncate the text, we now recompute the shift we need
+        for alignment, and move the line accordingly.
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis): Return the width of the truncated text + the width of the ellipsis.
+        (WebCore::RootInlineBox::placeEllipsisBox):
+        (WebCore::RootInlineBox::adjustPosition):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+
+2012-06-22  Eugene Klyuchnikov  <eustas.big@gmail.com>
+
+        Web Inspector: Fix negative time interval on zoom-in
+        https://bugs.webkit.org/show_bug.cgi?id=89798
+
+        Reviewed by Pavel Feldman.
+
+        Steps to reproduce:
+        1) Record timeline
+        2) Select small range with left tick close to zero
+        3) Move pointer to the right end of the ruler
+        4) Zoom-in with mouse-wheel
+
+        Result: right tick goes below the zero.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewWindow.prototype._zoom):
+
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
+
+        Reviewed by Dean Jackson.
+
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        No new tests, just re-enabled existing tests.
+
+        * css/CSSValueKeywords.in: Added empty line to force a rebuild of the file on the EWS.
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-22  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Avoid infinite loop if we try to encode -1 for leveldb
+        https://bugs.webkit.org/show_bug.cgi?id=89625
+
+        It gets worse, memory is allocated inside the loop so the process is
+        eventually killed by the OS.
+
+        Reviewed by Tony Chang.
+
+        Added tests to Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeInt):
+        (WebCore::IDBLevelDBCoding::encodeVarInt):
+
+2012-06-22  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow] ShadowRoot.activeElement should use the result of re-targeting algorithm.
+        https://bugs.webkit.org/show_bug.cgi?id=89763
+
+        Reviewed by Dimitri Glazkov.
+
+        Use the result of the re-targeting algorithm in calculating
+        shadow root's activeElement so that ShadowRoot.activeElement returns
+        a focused distributed node correctly as the algorithm says.
+
+        The spec is:
+        https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#active-element
+
+        Tests: fast/dom/shadow/shadow-root-activeElement.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore):
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::focusedNode):
+        * html/shadow/InsertionPoint.h:
+        (WebCore::InsertionPoint::contains):
+
+2012-06-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Invariants:
+
+        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
+        compositeAndReadback, regardless of threaded vs non-threaded mode
+        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
+        make a frame and is always set to a non-zero value
+        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
+        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
+        scheduling logic.
+        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
+        whenever it likes without needing the main thread to be responsive.
+
+        Details:
+
+        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
+        scheduling for the !visible case.
+
+        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
+        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
+        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
+        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
+        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
+        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
+        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
+        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
+        it gets a beginFrameAborted and COMMIT_STATE_IDLE.
+
+        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
+        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
+        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
+        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
+        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
+        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
+        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
+        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
+        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
+        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
+        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
+        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....
+
+        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
+        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
+        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
+        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
+        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
+        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
+        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
+        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
+        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
+        manager decided to evict and issue the deleteTexture() calls on them.
+
+        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
+        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
+        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
+        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
+        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
+        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
+        based on that.  Let's worry about that later.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
+        (WebCore):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
+        (WebCore):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        (WebCore):
+        (WebCore::TrackingTextureAllocator::deleteAllTextures):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
+        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::beginFrameAborted):
+        (WebCore):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCThreadProxy::setVisibleOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r116446): Crash in RenderBoxModelObject::adjustedPositionRelativeToOffsetParent
+        https://bugs.webkit.org/show_bug.cgi?id=89785
+
+        Reviewed by Abhishek Arya.
+
+        Test: fullscreen/full-screen-crash-offsetLeft.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::adjustedPositionRelativeToOffsetParent):
+        Added a NULL-check for parent() as it can be NULL in fullscreen mode. Also updated a stale
+        comment while touching the code.
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121064.
+        http://trac.webkit.org/changeset/121064
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Broke Chromium Mac build.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::updateAnimations):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (WebCore::CCLayerTreeHost::frameNumber):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::frameNumber):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (WebCore):
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderingStats.h: Removed.
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-22  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Support keyboard event
+        https://bugs.webkit.org/show_bug.cgi?id=89268
+
+        Reviewed by Chang Shu.
+
+        Extract keyDownCommandsMap and keyPressCommandsMap to share WebKit1/Efl and WebKit2/Efl.
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore):
+        (WebCore::keyDownCommandsMap):
+        (WebCore::keyPressCommandsMap):
+        (KeyDownEntry):
+        (KeyPressEntry):
+        (WebCore::createKeyDownCommandMap):
+        (WebCore::createKeyPressCommandMap):
+        (WebCore::getKeyDownCommandName):
+        (WebCore::getKeyPressCommandName):
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+
+2012-06-22  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: refactor index-writing to be more self-contained
+        https://bugs.webkit.org/show_bug.cgi?id=89607
+
+        Reviewed by Tony Chang.
+
+        Refactor index-writing into the IndexWriter class. Does not change
+        existing behavior but begins migrating index-writing logic into a
+        self-contained class that can eventually be used in the
+        frontend (renderer) side of IndexedDB.
+
+        No new tests, behavior is unchanged.
+
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::populateIndex):
+
+2012-06-22  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Expose rendering statistics to WebWidget.
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Reviewed by James Robinson.
+
+        The WebKit side of a basic framework for exposing rendering statistics
+        to Chromium's --enable-benchmarking extension.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHost::implFrameNumber):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::implFrameNumber):
+        (WebCore):
+        (WebCore::CCThreadProxy::implFrameNumberOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-06-22  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Do not accumulate occlusion from 3d layers on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=89704
+
+        Reviewed by James Robinson.
+
+        Layer iterators on the main thread may not iterate over 3d layers
+        in correct front-to-back or back-to-front order, because layer
+        sorting is not performed on the main thread. As a result,
+        occlusion tracking can accidentally think something is occluded if
+        a 3d layer is processed out of order. This patch choses to solve
+        this by avoiding accumulating occlusion for 3d layers. It may be
+        appropriate later to consider adding layer sorting on the main
+        thread, but for now that seemed like an unnecessary heavy-handed
+        approach.
+
+        In addition to a new unit test that covers this, other unit tests
+        were changed to work on the impl thread, so that the 3d layers
+        still accumulate occlusion as required.
+
+        Unit test added to CCOcclusionTrackerTest:
+          CCOcclusionTrackerTestUnsorted3dLayers
+
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::layerIsInUnsorted3dRenderingContext):
+        (WebCore):
+        (WebCore::::markOccludedBehindLayer):
+
+2012-06-22  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Snapshot metadata in front end to avoid IPC round-trips
+        https://bugs.webkit.org/show_bug.cgi?id=88467
+
+        Reviewed by Tony Chang.
+
+        Define a new type (IDBDatabaseMetadata) that captures the "schema" of an
+        IDB database (name, version, properties of stores, properties of indexes).
+        Add a method for the front end to request this from the back end once up
+        front to avoid later calls (which may be slow IPC calls in ports). Implement
+        IDB spec logic that the metadata should be frozen for a particular IDBDatabase
+        connection, and only change within a version change transaction, and the spec's
+        funky requirement for aborted version change transactions.
+
+        Test: storage/indexeddb/metadata.html
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase): Fetch metadata from back end when connection is created.
+        (WebCore::IDBDatabase::transactionCreated):
+        (WebCore::IDBDatabase::transactionFinished): Update metadata at the end of a transaction in 
+        case it was rolled back.
+        (WebCore::IDBDatabase::objectStoreNames): Move implementation to front-end.
+        (WebCore):
+        (WebCore::IDBDatabase::createObjectStore): Update local copy of metadata.
+        (WebCore::IDBDatabase::deleteObjectStore): Update local copy of metadata.
+        * Modules/indexeddb/IDBDatabase.h:
+        (WebCore::IDBDatabase::name): Move implementation to front-end.
+        (WebCore::IDBDatabase::version): Move implementation to front-end.
+        (IDBDatabase):
+        (WebCore::IDBDatabase::metadata):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h:
+        (WebCore):
+        (IDBDatabaseBackendInterface):
+        * Modules/indexeddb/IDBIndex.cpp: Store a copy of the metadata, which will never
+        change during the lifetime of the index.
+        (WebCore::IDBIndex::IDBIndex):
+        * Modules/indexeddb/IDBIndex.h:
+        (WebCore::IDBIndex::create):
+        (WebCore::IDBIndex::name): Move implementation to front-end.
+        (WebCore::IDBIndex::objectStore): Return RefPtr (unrelated tidying).
+        (WebCore::IDBIndex::keyPath): Move implementation to front-end.
+        (WebCore::IDBIndex::unique): Move implementation to front-end.
+        (WebCore::IDBIndex::multiEntry): Move implementation to front-end.
+        (IDBIndex):
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBIndexBackendImpl.h:
+        (IDBIndexBackendImpl):
+        * Modules/indexeddb/IDBMetadata.h: Added new structs.
+        (WebCore):
+        (WebCore::IDBDatabaseMetadata::IDBDatabaseMetadata):
+        (IDBDatabaseMetadata):
+        (WebCore::IDBObjectStoreMetadata::IDBObjectStoreMetadata):
+        (IDBObjectStoreMetadata):
+        (WebCore::IDBIndexMetadata::IDBIndexMetadata):
+        (IDBIndexMetadata):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::IDBObjectStore): Store a "live" copy of the metadata, and
+        and copy in case of an aborted version change transaction.
+        (WebCore::IDBObjectStore::indexNames): Move implementation to front-end.
+        (WebCore::IDBObjectStore::createIndex): Update metadata to include new index.
+        (WebCore::IDBObjectStore::index): Pass along metadata to instance constructor.
+        (WebCore::IDBObjectStore::deleteIndex): Delete index from metadata.
+        * Modules/indexeddb/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::create):
+        (WebCore::IDBObjectStore::name): Move implementation to front-end.
+        (WebCore::IDBObjectStore::keyPath): Move implementation to front-end.
+        (WebCore::IDBObjectStore::transaction): Return RefPtr (unrelated tidying).
+        (WebCore::IDBObjectStore::autoIncrement): Move implementation to front-end.
+        (WebCore::IDBObjectStore::metadata): Allow copying the metadata, in case of abort.
+        (WebCore::IDBObjectStore::resetMetadata): Allow setting the metadata, in case of abort.
+        (IDBObjectStore):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::metadata): Construct a metadata snapshot.
+        (WebCore):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h:
+        (WebCore):
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::objectStore): Pass along metadata to instance constructor.
+        (WebCore::IDBTransaction::objectStoreCreated): Track stores changed during transaction.
+        (WebCore::IDBTransaction::objectStoreDeleted):Track stores changed during transaction.
+        (WebCore::IDBTransaction::onAbort): Revert stores metadata potentially changed during transaction.
+        * Modules/indexeddb/IDBTransaction.h:
+        (IDBTransaction):
+        * WebCore.gypi:
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        No new tests. Current regression tests are sufficient.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
+        (-[WebScriptObject _setOriginRootObject:andRootObject:]):
+        (-[WebScriptObject dealloc]):
+        (-[WebScriptObject finalize]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-22  Jeff Timanus  <twiz@chromium.org>
+
+        [Chromium] Change implementing a fast-path for copying GPU-accelerated Canvas2D instances to WebGL textures.
+        https://bugs.webkit.org/show_bug.cgi?id=86275
+
+        This change adds the necessary plumbing to the various rendering contexts to copy the backing store texture of
+        a Canvas2D instance to be copied to a WebGL texture.  The GL_CHROMIUM_copy_texture extension is necessary
+        because the backing-store for a GPU-accelerated skia Canvas2D is normally in BGRA format, which is not supported
+        by glCopyTexImage.
+
+        Reviewed by Kenneth Russell.
+
+        Test: fast/canvas/webgl/*
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/Extensions3D.h:
+        (Extensions3D):
+        * platform/graphics/ImageBuffer.cpp:
+        (WebCore):
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore):
+        (ImageBuffer):
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        (WebCore::Canvas2DLayerBridge::backBufferTexture):
+        (WebCore):
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        (Canvas2DLayerBridge):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (Extensions3DChromium):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/opengl/Extensions3DOpenGL.h:
+        (Extensions3DOpenGL):
+        * platform/graphics/qt/Extensions3DQt.cpp:
+        (WebCore::Extensions3DQt::copyTextureCHROMIUM):
+        (WebCore):
+        * platform/graphics/qt/Extensions3DQt.h:
+        (Extensions3DQt):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::copyToPlatformTexture):
+        (WebCore):
+
+2012-06-22  Danilo Cesar Lemes de Paula  <danilo.cesar@collabora.co.uk>
+
+        Add url to supportsType
+        https://bugs.webkit.org/show_bug.cgi?id=89514
+
+        Reviewed by Eric Carlson.
+
+        No new tests since there's no change on code behavior.
+
+        When a blob is created as the address for a Media Stream, the MediaEngine
+        will ask it's players if they support that media. However, a player built
+        for MediaStream needs to know to URL to decide if it's supported or not.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+        * html/HTMLMediaElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (MediaPlayerFactory):
+        (WebCore::MediaPlayerFactory::MediaPlayerFactory):
+        (WebCore):
+        (WebCore::textPlain):
+        (WebCore::bestMediaEngineForTypeAndCodecs):
+        (WebCore::MediaPlayer::load):
+        (WebCore::MediaPlayer::loadWithNextMediaEngine):
+        (WebCore::MediaPlayer::paint):
+        (WebCore::MediaPlayer::supportsType):
+        * platform/graphics/MediaPlayer.h:
+        (WebCore):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundationCF::supportsType):
+        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
+        (MediaPlayerPrivateAVFoundationCF):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
+        (MediaPlayerPrivateAVFoundationObjC):
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::supportsType):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        (MediaPlayerPrivateQTKit):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::supportsType):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (MediaPlayerPrivateQt):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::supportsType):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
+        (MediaPlayerPrivateQuickTimeVisualContext):
+        * platform/graphics/wince/MediaPlayerPrivateWinCE.h:
+        (MediaPlayerPrivate):
+
+2012-06-22  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Sanitize GLSL code using ANGLE.
+
+        BlackBerry port does not sanitize GLSL code with ANGLE
+        https://bugs.webkit.org/show_bug.cgi?id=89583
+
+        Reviewed by Rob Buis.
+
+        No new tests are required.
+
+        * CMakeLists.txt: Added ANGLE requirment for CMake builds with WEBGL
+        * platform/graphics/ANGLEWebKitBridge.h: Added include for ANGLE/ShaderLang.h in BlackBerry platform.
+        * platform/graphics/GraphicsContext3D.h: Added include for ANGLEWebKitBridge.h in BlackBerry platform.
+
+2012-06-22  Dan Bernstein  <mitz@apple.com>
+
+        RenderText’s minimum preferred width is incorrect when soft hyphens are used
+        https://bugs.webkit.org/show_bug.cgi?id=89775
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/text/soft-hyphen-min-preferred-width.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::hyphenWidth): Added this helper function.
+        (WebCore::RenderText::computePreferredLogicalWidths): In places where this function tests
+        for the soft hyphen character, added a check that the 'hyphens' style property is not set
+        to 'none', because in that case soft hyphens are not break opportunities. Also added an
+        explicit check to suppress break opportunities from isBreakable() if the occur after a
+        soft hyphen and 'hyphens' is set to 'none'. Finally, when measuring text up to a potential
+        line break, added the width of the hyphen string when needed.
+
+2012-06-22  Dean Jackson  <dino@apple.com>
+
+        BitmapImage duplicates code to calculate size
+        https://bugs.webkit.org/show_bug.cgi?id=89728
+        <rdar://problem/11724321>
+
+        Reviewed by Darin Adler.
+
+        Add a new updateSize method to BitmapImage that
+        avoids duplication in the size and
+        sizeRespectingOrientation methods.
+
+        No new tests needed.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::updateSize): new method that will set
+        m_size and m_sizeRespectingOrientation if necessary.
+        (WebCore):
+        (WebCore::BitmapImage::size):
+        (WebCore::BitmapImage::sizeRespectingOrientation): these each
+        now call updateSize rather than duplicate the update code.
+        * platform/graphics/BitmapImage.h:
+        (BitmapImage):
+
+2012-06-22  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Clean up visitDOMWrapper code
+        https://bugs.webkit.org/show_bug.cgi?id=89774
+
+        Reviewed by Tony Chang.
+
+        This moves the check if domWrapperVisitorFunction is null into a function of the WrapperTypeInfo struct.
+        This is so that users of WrapperTypeInfo does not need to know about the inner details of the struct.
+        It also makes things more consistent since the other fields in the struct have these kind of functions.
+
+        This is a follow up change to http://trac.webkit.org/changeset/120854.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper): Call WrapperTypeInfo::visitDOMWrapper instead.
+        * bindings/v8/WrapperTypeInfo.h:
+        (WrapperTypeInfo):
+        (WebCore::WrapperTypeInfo::visitDOMWrapper): If domWrapperVisitorFunction is non null call it.
+
+2012-06-22  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: ExtensionPanel.onSearch listener doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=89517
+
+        Reviewed by Yury Semikhatsky.
+
+        Added a test to see if listener fires on search:
+        LayoutTests/inspector/extensions/extensions-panel.html
+
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionPanel.prototype.searchCanceled):
+        (WebInspector.ExtensionPanel.prototype.performSearch):
+        (WebInspector.ExtensionPanel.prototype.jumpToNextSearchResult):
+        (WebInspector.ExtensionPanel.prototype.jumpToPreviousSearchResult):
+
+2012-06-22  Brian Salomon  <bsalomon@google.com>
+
+        Increase the GrContext texture cache count cap to 2K
+        https://bugs.webkit.org/show_bug.cgi?id=89761
+
+        Reviewed by Stephen White.
+
+        Tests: The change is for performance. The code is exercised by all the canvas 2d layout tests.
+
+        * platform/chromium/support/GraphicsContext3DPrivate.cpp:
+
+2012-06-22  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        [Chromium] Adjust the displayed elements of the new Chrome media controls.
+        https://bugs.webkit.org/show_bug.cgi?id=89416
+
+        Reviewed by Eric Carlson.
+
+        No new tests - existing media tests cover these cases.
+
+        Remove the volume slider for videos without audio or media resource.
+        Display the transport bar for videos without a media resource.
+        Don't show the fullscreen button for
+
+        * html/shadow/MediaControlRootElementChromium.cpp:
+        (WebCore::MediaControlRootElementChromium::reset):
+        Don't display volume slider if media controller has no audio.
+        Don't display fullscreen button if media controller supportsFullscreen().
+        (WebCore::MediaControlRootElementChromium::reportedError):
+        Don't hide the timeline for failed videos, e.g. where the resource doesn't load.
+
+2012-06-22  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Elements] Right-clicking on whitespace should show the same context menu as right-clicking on the tag text
+        https://bugs.webkit.org/show_bug.cgi?id=89766
+
+        Reviewed by Vsevolod Vlasov.
+
+        Explicitly check for the TreeElement.representedObject's nodeType()
+        rather than for the event target's enclosing element class.
+        Drive-by: do not consider the "collapsed node has children" ellipsis as a text node.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+
+2012-06-22  Florin Malita  <fmalita@chromium.org>
+
+        REGRESSION (Safari 5.1.5 - ToT): Crash in RenderSVGRoot::computeReplacedLogicalWidth
+        https://bugs.webkit.org/show_bug.cgi?id=85797
+
+        Reviewed by Darin Adler.
+
+        Test: svg/custom/svg-width-intrinsic-crash.html
+
+        RenderSVGRoot::computeReplacedLogicalWidth assumes that if
+        SVGSVGElement::widthAttributeEstablishesViewport returns false, the
+        SVG must be embedded via <object>. This is not always the case, though:
+        widthAttributeEstablishesViewport can also return false for inline
+        SVG if it doesn't have a replaced logical width.
+
+        Updated computeReplacedLogical{Width,Height} to handle the
+        !widthAttributeEstablishesViewport && !isEmbeddedThroughFrameContainingSVGDocument
+        case gracefully.
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+
+2012-06-22  Hayato Ito  <hayato@chromium.org>
+
+        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=89073
+
+        Reviewed by Dimitri Glazkov.
+
+        Re-landing r120945 since bug 89172 was resolved.
+
+        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
+        The corresponding bug in the shadow DOM spec is:
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090
+
+        This change is introduced to handle the following use case:
+        1. There is an insertion point, with zero or more nodes distributed into it.
+        2. User clicks on one of the items.
+        3. The event handler in shadow DOM subtree wants to know which item was clicked on.
+
+        The new re-targeting algorithm sets an event's target to a
+        distributed node where an event was originally fired, instead of
+        an insertion point to where the node is distributed.
+
+        The similar re-targeting algorithm also applies to an event's
+        relatedTarget.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed follow-up to r121030, fix display of "Duration" in timeline event details popup.
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121025.
+        http://trac.webkit.org/changeset/121025
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        Caused crash in
+        EventHandler.shouldTurnVerticalTicksIntoHorizontal webkit unit
+        test on 10.7
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+
+2012-06-21  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: only increase length for timeline bars below minimal width
+        https://bugs.webkit.org/show_bug.cgi?id=89727
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineCalculator.prototype.setDisplayWindow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+
+2012-06-22  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: FormController.cpp fails to build on 32-bit architectures
+
+        This fixes the following build failure introduced in r121004 for
+        Bug 89628:
+
+            FormController.cpp:62:36: error: implicit conversion loses integer precision: 'uint64_t' (aka 'unsigned long long') to 'size_t' (aka 'unsigned long') [-Werror,-Wshorten-64-to-32]
+                state.m_values.reserveCapacity(valueSize);
+                ~~~~~                          ^~~~~~~~~
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::deserialize): Change type of
+        valueSize from uint64_t to size_t.
+
+2012-06-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in DragController::concludeEditDrag.
+        https://bugs.webkit.org/show_bug.cgi?id=89762
+
+        Reviewed by Ryosuke Niwa.
+
+        RefPtr the innerFrame since it can get destroyed due to mutation
+        event fired in DragController::dispatchTextInputEventFor().
+
+        Test: editing/pasteboard/drop-text-events-sideeffect-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+
+2012-06-22  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline event details popup misses CPU time
+        https://bugs.webkit.org/show_bug.cgi?id=89765
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-22  Takashi Sakamoto  <tasak@google.com>
+
+        [Shadow] parentTreeScope() of nested shadow DOM subtree returns document().
+        https://bugs.webkit.org/show_bug.cgi?id=89172
+
+        Reviewed by Hajime Morita.
+
+        Added setParentTreeScope to set parent treescope of shadow root to be
+        host's treescope in ElementShadow::addShadowRoot.
+
+        Test: fast/dom/shadow/parent-tree-scope-in-shadow.html
+
+        * dom/ElementShadow.cpp:
+        (WebCore::ElementShadow::addShadowRoot):
+        Added setParentTreeScope.
+        * testing/Internals.cpp:
+        (WebCore::Internals::parentTreeScope):
+        Newly added. This method returns a parent tree scope's root node of
+        a given node, because a tree scope's root node is either document node
+        or shadow root node and both nodes derive from TreeScope. So root nodes
+        are treated as TreeScope.
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+        Added parentTreeScope.
+
+2012-06-22  Tony Chang  <tony@chromium.org>
+
+        -webkit-flex-flow shouldn't be an enumerable property of the computed style
+        https://bugs.webkit.org/show_bug.cgi?id=89698
+
+        Reviewed by Ojan Vafai.
+
+        flex-flow is a shorthand for flex-direction and flex-wrap:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-flow-property
+        Shorthand properties should not be enumerable in the computed style, although you can still
+        get the value from the computed style.
+
+        Tests: css3/flexbox/css-properties.html: New test case added.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+
+2012-06-22  Robert Kroeger  <rjkroege@chromium.org>
+
+        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        WebKit GTK and Chromium Linux force vertical wheel events to
+        scroll horizontally when over horizontal scroll bars.  This is
+        undesirable for touchpad scrolling with
+        hasPreciseScrollingDeltas() == true. Modified shouldTurnVerticalTicksIntoHorizontal
+        to not perform this conversion for PlatformWheelEvents with preciseScrollingDeltas.
+
+        Reviewed by Adam Barth.
+
+        Unit tests in EventHandlerTest.cpp
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal): 
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+
+2012-06-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: partially instrument DOM Tree native memory.
+        https://bugs.webkit.org/show_bug.cgi?id=89568
+
+        This patch adds MemoryInstrumentation class that counts all visited
+        objects and calls reportMemoryUsage for the instrumented classes.
+
+        Reviewed by Yury Semikhatsky.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        * bindings/v8/ScriptWrappable.h:
+        (WebCore::ScriptWrappable::reportMemoryUsage):
+        (ScriptWrappable):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        (StylePropertySet):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::reportMemoryUsage):
+        (ContainerNode):
+        * dom/Element.h:
+        (WebCore::Element::reportMemoryUsage):
+        (Element):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::reportMemoryUsage):
+        (ElementAttributeData):
+        * dom/MemoryInstrumentation.h: Added.
+        (WebCore):
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::~MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::reportObject):
+        (WebCore::MemoryInstrumentation::reportPointer):
+        (MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportInstrumentedPointer):
+        (WebCore::MemoryObjectInfo::reportPointer):
+        (WebCore::MemoryObjectInfo::reportInstrumentedObject):
+        (WebCore::MemoryObjectInfo::reportObject):
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryObjectInfo::objectType):
+        (WebCore::MemoryObjectInfo::objectSize):
+        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
+        (WebCore::MemoryInstrumentation::reportInstrumentedObject):
+        * dom/Node.cpp:
+        (WebCore::Node::reportMemoryUsage):
+        (WebCore):
+        * dom/Node.h:
+        (Node):
+        * dom/QualifiedName.h:
+        (WebCore::QualifiedName::QualifiedNameImpl::reportMemoryUsage):
+        (WebCore::QualifiedName::reportMemoryUsage):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::addMemoryBlockFor):
+        (WebCore::domTreeInfo):
+        (WebCore::memoryCacheInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::reportMemoryUsage):
+        (TreeShared):
+
+2012-06-22  Peter Rybin  <peter.rybin@gmail.com>
+
+        Web Inspector: Support 'Restart frame' in inspector frontend
+        https://bugs.webkit.org/show_bug.cgi?id=89678
+
+        Reviewed by Pavel Feldman.
+
+        Action is added to call frame placard's context menu. Context menu is now built
+        on a call frame level rather than on callback sidebar level.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.Placard):
+        (WebInspector.CallStackSidebarPane.Placard.prototype._update):
+        (WebInspector.CallStackSidebarPane.Placard.prototype._placardContextMenu):
+        (_restartFrame):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.rawLocationToUILocation):
+        (WebInspector.DebuggerModel.prototype.callStackModified):
+        (WebInspector.DebuggerModel.CallFrame.prototype.restart):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.editSource):
+
+2012-06-22  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] Fix the remote inspector loading problems on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89747
+
+        Reviewed by Simon Hausmann.
+
+        Make sure that the state of a SocketStreamHandle is set properly
+        when created from an existing QTcpSocket.
+
+        This fixes the inspectorserver Qt api auto test on Mac.
+
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandle::SocketStreamHandle):
+
+2012-06-22  Yoshifumi Inoue  <yosin@chromium.org>
+
+        REGRESSION(r117738):[Forms] validationMessage IDL attribute should not have range overflow message if value isn't range overflow
+        https://bugs.webkit.org/show_bug.cgi?id=89736
+
+        Reviewed by Kent Tamura.
+
+        Tests: fast/forms/date/input-date-validation-message.html
+               fast/forms/number/input-number-validation-message.html
+               fast/forms/range/input-range-validation-message.html
+
+        This patch changes comparison operator for range overflow message in
+        InputType::validationMessage().
+
+        * html/InputType.cpp:
+        (WebCore::InputType::validationMessage):
+
+2012-06-22  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add frontend-side Entry object to FileSystemModel
+        https://bugs.webkit.org/show_bug.cgi?id=89739
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemModel.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemModel.prototype._directoryContentReceived):
+        (WebInspector.FileSystemModel.FileSystem):
+        (WebInspector.FileSystemModel.Entry):
+        (WebInspector.FileSystemModel.Entry.prototype.get fileSystemModel):
+        (WebInspector.FileSystemModel.Entry.prototype.get fileSystem):
+        (WebInspector.FileSystemModel.Entry.prototype.get url):
+        (WebInspector.FileSystemModel.Entry.prototype.get name):
+        (WebInspector.FileSystemModel.Entry.prototype.get isDirectory):
+        (WebInspector.FileSystemModel.Directory):
+        (WebInspector.FileSystemModel.Directory.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemModel.File):
+        (WebInspector.FileSystemModel.File.prototype.get mimeType):
+        (WebInspector.FileSystemModel.File.prototype.get resourceType):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        No new tests because this is simply a name change.
+
+        Renamed DeviceOrientation to DeviceOrientationData in order to be consistent with DeviceMotionData.
+        Updated all files that use DeviceOrientation.
+  
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDeviceOrientationEventCustom.cpp:
+        (WebCore::JSDeviceOrientationEvent::initDeviceOrientationEvent):
+        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
+        (WebCore::V8DeviceOrientationEvent::initDeviceOrientationEventCallback):
+        * dom/DOMAllInOne.cpp:
+        * dom/DeviceOrientationClient.h:
+        (WebCore):
+        (DeviceOrientationClient):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::DeviceOrientationController::timerFired):
+        (WebCore::DeviceOrientationController::didChangeDeviceOrientation):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (DeviceOrientationController):
+        * dom/DeviceOrientationData.cpp: Renamed from Source/WebCore/dom/DeviceOrientation.cpp.
+        (WebCore):
+        (WebCore::DeviceOrientationData::create):
+        (WebCore::DeviceOrientationData::DeviceOrientationData):
+        (WebCore::DeviceOrientationData::alpha):
+        (WebCore::DeviceOrientationData::beta):
+        (WebCore::DeviceOrientationData::gamma):
+        (WebCore::DeviceOrientationData::absolute):
+        (WebCore::DeviceOrientationData::canProvideAlpha):
+        (WebCore::DeviceOrientationData::canProvideBeta):
+        (WebCore::DeviceOrientationData::canProvideGamma):
+        (WebCore::DeviceOrientationData::canProvideAbsolute):
+        * dom/DeviceOrientationData.h: Renamed from Source/WebCore/dom/DeviceOrientation.h.
+        (WebCore):
+        (DeviceOrientationData):
+        * dom/DeviceOrientationEvent.cpp:
+        (WebCore::DeviceOrientationEvent::DeviceOrientationEvent):
+        (WebCore::DeviceOrientationEvent::initDeviceOrientationEvent):
+        * dom/DeviceOrientationEvent.h:
+        (WebCore):
+        (WebCore::DeviceOrientationEvent::create):
+        (DeviceOrientationEvent):
+        (WebCore::DeviceOrientationEvent::orientation):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyDeviceOrientationClient::lastOrientation):
+        * platform/mock/DeviceOrientationClientMock.cpp:
+        (WebCore::DeviceOrientationClientMock::setOrientation):
+        * platform/mock/DeviceOrientationClientMock.h:
+        (WebCore::DeviceOrientationClientMock::lastOrientation):
+        (DeviceOrientationClientMock):
+        * platform/qt/DeviceOrientationClientQt.cpp:
+        (DeviceOrientationClientQt):
+        * platform/qt/DeviceOrientationClientQt.h:
+        (DeviceOrientationClientQt):
+        * platform/qt/DeviceOrientationProviderQt.h:
+        (DeviceOrientationProviderQt):
+ 
+2012-06-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Support separate script compilation and execution.
+        https://bugs.webkit.org/show_bug.cgi?id=89646
+
+        Reviewed by Pavel Feldman.
+
+        Separate script compilation and run commands added to protocol and DebuggerAgent.
+        Separate script compilation and run implemented in v8 ScriptDebugServer, stubs added for js implementation.
+
+        Test: inspector/debugger/debugger-compile-and-run.html
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::ScriptDebugServer::clearCompiledScripts):
+        (WebCore::ScriptDebugServer::runScript):
+        * bindings/js/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
+        (ScriptDebugServer):
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::PageScriptDebugServer::clearCompiledScripts):
+        (WebCore::PageScriptDebugServer::runScript):
+        * bindings/v8/PageScriptDebugServer.h:
+        (PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::compileScript):
+        (WebCore):
+        (WebCore::ScriptDebugServer::clearCompiledScripts):
+        (WebCore::ScriptDebugServer::runScript):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore):
+        (WebCore::ScriptDebugServer::supportsSeparateScriptCompilationAndExecution):
+        (ScriptDebugServer):
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::supportsSeparateScriptCompilationAndExecution):
+        (WebCore):
+        (WebCore::InspectorDebuggerAgent::compileScript):
+        (WebCore::InspectorDebuggerAgent::runScript):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::injectedScriptManager):
+        * inspector/PageDebuggerAgent.cpp:
+        (WebCore::PageDebuggerAgent::injectedScriptForEval):
+        (WebCore):
+        * inspector/PageDebuggerAgent.h:
+        (PageDebuggerAgent):
+        * inspector/WorkerDebuggerAgent.cpp:
+        (WebCore::WorkerDebuggerAgent::injectedScriptForEval):
+        (WebCore):
+        * inspector/WorkerDebuggerAgent.h:
+        (WorkerDebuggerAgent):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2012-06-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorState::updateCookie should not do JSON serialization if unsupported
+        https://bugs.webkit.org/show_bug.cgi?id=89743
+
+        Since all InspectorClient's are InspectorStateClient's provide a
+        virtual accessor that determines whether or not InspectorClient updates
+        are supported or not.
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::updateCookie):
+        Don't serialize and message the client if the client doesn't do anything with it.
+
+        * inspector/InspectorStateClient.h:
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::InspectorStateClient::supportsInspectorStateUpdates):
+        Let the client say whether or not supports updates or not.
+
+2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120982.
+        http://trac.webkit.org/changeset/120982
+        https://bugs.webkit.org/show_bug.cgi?id=89740
+
+        [chromium] ASSERTION FAILED:
+        m_allocatedTextureIds.contains(textureId) (Requested by ukai
+        on #webkit).
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::setContentsMemoryAllocationLimitBytes):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::setContentsMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::sourceFrameCanBeDrawn):
+        (WebCore::CCLayerTreeHostImpl::setSourceFrameCanBeDrawn):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setNeedsForcedCommit):
+        (WebCore):
+        (WebCore::CCThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::setContentsMemoryAllocationLimitBytes):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-21  Kent Tamura  <tkent@chromium.org>
+
+        Make FormControlState capable to store multiple values
+        https://bugs.webkit.org/show_bug.cgi?id=89628
+
+        Reviewed by Hajime Morita.
+
+        Make FormControlState capable to store multiple values in order to
+        clean FileInputType.cpp up and prepare to fix Bug 89623.
+
+        No new tests. This doesn't change web-exposed behavior, and
+        fast/forms/file/recover-file-input-in-unposted-form.html covers
+        major part of this change.
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serializeTo): Support for two or more values.
+        (WebCore::FormControlState::deserialize): ditto.
+        (WebCore::formStateSignature):
+        Bump up the version because the state format for <input type=file> is changed.
+        * html/FormController.h:
+         - String m_value -> Vector<String> m_values
+         - Add some functions.
+         - Remove hasValue() and value().
+        (WebCore::FormControlState::FormControlState): m_value -> m_values.
+        (WebCore::FormControlState::valueSize): Added.
+        (WebCore::FormControlState::operator[]): Added.
+        (FormControlState): Add append() declaration, etc.
+        (WebCore::FormControlState::operator=): m_value -> m_values
+        (WebCore::FormControlState::append): Added.
+
+        * html/HTMLFormControlElementWithState.cpp:
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        Use valueSize() instead of hasValue().
+        * html/HTMLFormControlElementWithState.h:
+        (HTMLFormControlElementWithState): Update the comment.
+
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::saveFormControlState):
+        Use multiple value capability of FormControlState
+        (WebCore::FileInputType::restoreFormControlState): ditto.
+
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::restoreFormControlState): Use [0] instead of value().
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::restoreFormControlState): ditto.
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::restoreFormControlState): ditto.
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::restoreFormControlState): ditto.
+        * html/InputType.cpp:
+        (WebCore::InputType::restoreFormControlState): ditto.
+
+2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        LabelsNodeList isn't updated properly after its owner node is adopted into a new document
+        https://bugs.webkit.org/show_bug.cgi?id=89730
+
+        Reviewed by Darin Adler.
+
+        When a node is adopted, node lists that are invalidated at document level need to be unregistered
+        from old document and registered to new document so that DOM mutations in new document will invalidate
+        caches in the node lists. Done that in NodeListsNodeData::adoptTreeScope, which was extracted from
+        TreeScopeAdopter::moveTreeToNewScope.
+
+        Also renamed DynamicNodeList::node() and m_node to rootNode() and m_ownerNode to better express
+        their semantics and added ownerNode() to make m_ownerNode private to DynamicNodeList.
+
+        Test: fast/forms/label/labels-owner-node-adopted.html
+
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::~ChildNodeList):
+        (WebCore::ChildNodeList::length):
+        (WebCore::ChildNodeList::item):
+        (WebCore::ChildNodeList::nodeMatches):
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::ClassNodeList):
+        (WebCore::ClassNodeList::~ClassNodeList):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::length):
+        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::item):
+        (WebCore::DynamicNodeList::itemWithName):
+        * dom/DynamicNodeList.h:
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::ownerNode):
+        (WebCore::DynamicNodeList::rootedAtDocument):
+        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange):
+        (WebCore::DynamicNodeList::rootNode):
+        (WebCore::DynamicNodeList::document):
+        (DynamicNodeList):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::~NameNodeList):
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::adoptTreeScope):
+        (NodeListsNodeData):
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::~TagNodeList):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        (WebCore::LabelsNodeList::nodeMatches):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::~RadioNodeList):
+        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
+
+2012-06-21  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Properly display native memory sizes bigger than 2GB
+        https://bugs.webkit.org/show_bug.cgi?id=89661
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::jsHeapInfo):
+        (WebCore::inspectorData):
+        (WebCore::renderTreeInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+
+2012-06-21  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderBlock::layoutPositionedObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=89599
+
+        Reviewed by Julien Chaffraix.
+
+        Test: fast/table/table-split-positioned-object-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks): no longer need to explicitly call
+        removePositionedObjects, since it is part of moveChildrenTo.
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::hasPositionedObjects): helper to tell if we have
+        positioned objects in our list.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::splitAnonymousBoxesAroundChild): Like r102263, this
+        condition was wrong and while moving children across completely different 
+        trees, we need fullRemoveInsert as true.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::moveChildTo): see code comment.
+        (WebCore::RenderBoxModelObject::moveChildrenTo): see code comment. 
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Make HTMLDocumentParser::create(DocumentFragment*,Element*, FragmentScriptingPermission) private.
+        https://bugs.webkit.org/show_bug.cgi?id=89724
+
+        Reviewed by Darin Adler.
+
+        It is used only by HTMLDocumentParser::parseDocumentFragment. No behavioral changes.
+
+        * html/parser/HTMLDocumentParser.h:
+        (WebCore::HTMLDocumentParser::create):
+        (HTMLDocumentParser):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Use the empty plugin support on non-X11 and non-Windows platforms
+        https://bugs.webkit.org/show_bug.cgi?id=89501
+
+        Reviewed by Martin Robinson.
+
+        The GTK+ port doesn't currently support NPAPI plugins on platforms other
+        than X11 or Windows. Using PluginPackageNone and PluginViewNone makes it
+        easier to build it on other platforms and also allows us to drop some
+        ifdefs from PluginPackageGtk and PluginViewGtk.
+
+        * GNUmakefile.list.am:
+
+2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow][Editing] Assertion in VisibleSelection::adjuseSelectionToAvoidCrossingBoundaries() is triggered.
+        https://bugs.webkit.org/show_bug.cgi?id=89081
+
+        Reviewed by Ryosuke Niwa.
+
+        firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot did not
+        consider a case that an argument hiehestRoot can be in Shadow DOM. So when adjusting selection to
+        avoid crossing editing boundaries, VisiblePosition can break shadow boundaries, and it causes
+        an assertion trigger.
+
+        By this patch, firstEditablePositionAfterPositionInRoot and lastEditablePositionBeforePositionInRoot will
+        adjust position to the tree scope of highestRoot instead of its parent tree scope.
+
+        Test: editing/shadow/adjusting-editing-boundary-with-table-in-shadow.html
+
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+
+2012-06-21  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: exception in TimelinePresentationModel when recording timeline
+        https://bugs.webkit.org/show_bug.cgi?id=89716
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.processRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype.isVisible):
+
+2012-06-21  Oli Lan  <olilan@chromium.org>
+
+        Add methods to select between offsets in an editable field.
+        https://bugs.webkit.org/show_bug.cgi?id=89098
+
+        Reviewed by Ryosuke Niwa.
+
+        Reviewed by Ryosuke Niwa.
+
+        Adds a new method setSelectionOffsets to Editor. This selects between
+        the two integer offsets provided in the node currently being edited,
+        assuming the offsets are given relative to the rootEditableElement.
+        If no node or field is currently being edited, the method returns false.
+        
+        Test: a new test has been added to the chromium port's WebViewTest that
+        calls this via WebViewImpl::setSelectionEditableOffsets.
+        
+        * editing/Editor.cpp:
+        (WebCore::Editor::setSelectionOffsets):
+        (WebCore):
+        * editing/Editor.h:
+        (Editor):
+
+2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Add support for the grid and inline-grid display types.
+        https://bugs.webkit.org/show_bug.cgi?id=60732
+
+        Reviewed by Tony Chang.
+
+        Tests: fast/css-grid-layout/containing-block-grids-expected.html
+               fast/css-grid-layout/containing-block-grids.html
+               fast/css-grid-layout/floating-empty-grids-expected.html
+               fast/css-grid-layout/floating-empty-grids.html
+
+        Based on an earlier patch by David Hyatt <hyatt@apple.com>.
+
+        Added the first renderer for grid elements.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added RenderGrid files to the build systems.
+
+        * rendering/RenderGrid.cpp: Added.
+        (WebCore::RenderGrid::RenderGrid):
+        (WebCore::RenderGrid::~RenderGrid):
+        (WebCore::RenderGrid::layoutBlock):
+        (WebCore::RenderGrid::renderName):
+        * rendering/RenderGrid.h: Added.
+        (RenderGrid):
+        Skeleton renderer for now.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        Return our new RenderGrid for our 2 new |display| values.
+
+        * rendering/style/RenderStyle.h:
+        Added INLINE_GRID to the inline and replaced types.
+
+2012-06-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Clang build fix.
+
+        * dom/NodeRareData.h:
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Invariants:
+
+        1.) We never commit (paint, animate, any of it) when not visible on the main thread -except- for
+        compositeAndReadback, regardless of threaded vs non-threaded mode
+        2.) CCLayerTreeHost::m_contentsTextureManager's memory budget is only set by updateLayers() when we are going to
+        make a frame and is always set to a non-zero value
+        3.) Zero-sized allocations from the GPU process are always serviced immediately on the impl thread.  Non-zero
+        allocations are met in the next frame, whenever we would produce that frame according to our usual frame
+        scheduling logic.
+        4.) The impl thread always knows the set of currently-allocated managed texture IDs and can delete them all
+        whenever it likes without needing the main thread to be responsive.
+
+        Details:
+
+        There are two main changes - tweaking how the contents texture manager's budget is handled and tweaking frame
+        scheduling for the !visible case.
+
+        The scheduling change is a bit more subtle but it unifies the single and multi threaded paths and is really
+        important.  Except for compositeAndReadback (which I'll talk about below), we simply won't produce frames when
+        not visible.  This already happens in the single threaded path thanks to render_widget so the only change is to
+        the threaded path.  The difficulty here is we might post a beginFrame task from the impl thread and then get a
+        setVisible(false) call on the main thread before the beginFrame task runs.  Since I'm making the setVisible()
+        call a blocking call from main thread -> impl thread, when the beginFrame task eventually does run on the main
+        thread we can know that the impl thread's notion of visibility is in sync with the main threads.  Thus I'm
+        planning to simply abort the frame before doing any processing on the main thread.  The scheduler will know if
+        it gets a beginFrameAborted and COMMIT_STATE_IDLE.
+
+        compositeAndReadback is special - this call currently does come in when we aren't visible (in single and
+        threaded mode) and we need to service it.  In particular, we need to send a beginFrame over and have it
+        not be ignored on the main thread.  For this I'm thinking of having the proxy keep track of whether it's
+        servicing a compositeAndReadback() and use that bit on the main thread to know to process the beginFrame
+        normally.  On the impl side, we need a few changes.  First, we have to allocate a default framebuffer
+        (ensureFramebufferCHROMIUM) even if we've dropped it previously and remember to discard it after the
+        readPixels().  Second, we have to provide a non-zero contents texture allocation on the beginFrame message, and
+        again remember to delete the textures after the readPixels().  Third, we have to know that the beginFrame is a
+        forced frame so when we get the beginFrameComplete we go ahead with the rest of the frame.  For this, I think
+        I'll have to add ACTION_BEGIN_FORCED_FRAME and a corresponding COMMIT_STATE_FORCED_FRAME_IN_PROGRESS so the
+        scheduler can keep track of the magicness of this frame, and then add some logic after the readpixels call to
+        drop resources after the readback.  It's probably a good time to stop swapping on readbacks too....
+
+        The contents texture manager's budget is only relevant when we want to make a frame, so it's now passed in on
+        the updateLayers().  Since we only make frames when we are visible and we never have a zero allocation when
+        visible (thanks to the frame scheduling changes above), this value is always non-zero.  The other thing the
+        texture manager needs to know about is if we've killed all of the underlying textures from the impl thread -
+        this bit is passed in by the proxy before the updateLayers() call.  This means if we're running while visible
+        and the manager wants to decrease our budget to something other than zero, we'll get a new (non-zero) allocation
+        on the impl thread, schedule a frame, then when it's time to make the frame pass the new lower limit in to
+        updateLayers(), then have the contents texture manager evict down to our new limit and make a frame with the new
+        budget.  When the commit completes we'll get notified on the impl thread of which textures the contents texture
+        manager decided to evict and issue the deleteTexture() calls on them.
+
+        The texture budget we pass in will be based on the most recent non-zero memory allocation we received from the
+        GPU memory manager, or some default value I'll pull out my ass if we haven't heard anything yet.  On compositor
+        initialization, we can't afford to wait for a round-trip through the GPU process to get a budget for the first
+        frame.  I don't think handling a decrease to a non-zero budget on a visible tab needs to be terribly urgent - we
+        can get to it when we get to making the next frame.  If we wanted to satisfy reduced texture budgets directly
+        from the impl thread, we could keep a priority-list ordered set of textures once we have priorities and delete
+        based on that.  Let's worry about that later.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererGpuMemoryAllocationChangedCallbackAdapter::onGpuMemoryAllocationChangedOnImpl):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::setVisible):
+        (WebCore::LayerRendererChromium::setGpuMemoryAllocation):
+        (WebCore):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictAndRemoveAllDeletedTextures):
+        (WebCore):
+        * platform/graphics/chromium/TextureManager.h:
+        (TextureAllocator):
+        (TextureManager):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::createTexture):
+        (WebCore::TrackingTextureAllocator::deleteTexture):
+        (WebCore):
+        (WebCore::TrackingTextureAllocator::deleteAllTextures):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::context):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::setMemoryAllocationLimitBytes):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (WebCore::CCLayerTreeHostImpl::contentsTexturesWerePurgedSinceLastCommit):
+        (WebCore::CCLayerTreeHostImpl::memoryAllocationLimitBytes):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRendererClient):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::beginFrameComplete):
+        (WebCore::CCScheduler::beginFrameAborted):
+        (WebCore):
+        (WebCore::CCScheduler::didSwapBuffersComplete):
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::vsyncTick):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::beginFrameAborted):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::stop):
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::setVisible):
+        (WebCore):
+        (WebCore::CCThreadProxy::setVisibleOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionBeginFrame):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameAbortedOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+        (BeginFrameAndCommitState):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::willDraw):
+        (WebCore::CCVideoLayerImpl::willDrawInternal):
+        (WebCore::CCVideoLayerImpl::FramePlane::allocateData):
+        (WebCore::CCVideoLayerImpl::FramePlane::freeData):
+        (WebCore::CCVideoLayerImpl::allocatePlaneData):
+        (WebCore::CCVideoLayerImpl::freePlaneData):
+        (WebCore::CCVideoLayerImpl::freeUnusedPlaneData):
+        (WebCore::CCVideoLayerImpl::didLoseContext):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (FramePlane):
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Shrink NodeListsNodeData
+        https://bugs.webkit.org/show_bug.cgi?id=89036
+
+        Reviewed by Andreas Kling.
+
+        Replaced 6 hash maps of AtomicString, String, and RefPtr<QualifiedName::QualifiedNameImpl> and a raw pointer
+        by 3 hash maps of std::pair<unsigned short, AtomicString>, std::pair<unsigned short, String>, and QualifiedName,
+        to halve the NodeListsNodeData's size (Reduced from 7 pointers to 3 pointers). Made those hash maps private and
+        added addCacheWith* and removeCacheWith* member functions to reduce the code duplication.
+
+        Also got rid of removeCached*NodeList member functions from Node and Document now that DynamicSubtreeNodeList can
+        simply call nodeLists()->removeCacheWith* on m_node.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::ChildNodeList):
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::~ClassNodeList):
+        * dom/Document.cpp:
+        (WebCore::Document::getItems): Use addCacheWithName.
+        * dom/Document.h: Got rid of removeCachedMicroDataItemList.
+        (Document):
+        * dom/DynamicNodeList.cpp:
+        (WebCore): Moved the constructor to the header file.
+        * dom/DynamicNodeList.h: Added NodeListType and InvalidationType to be used in NodeListsNodeData.
+        (WebCore::DynamicNodeList::DynamicNodeList): Takes the invalidation type.
+        (WebCore::DynamicNodeList::document): Added.
+        (WebCore::DynamicNodeList::shouldInvalidateOnAttributeChange): Added.
+        (WebCore::DynamicNodeList::Caches::Caches): Added shouldInvalidateOnAttributeChange to retain the invalidation type.
+        (Caches):
+        (WebCore::DynamicSubtreeNodeList::DynamicSubtreeNodeList):
+        * dom/MicroDataItemList.cpp:
+        (WebCore::MicroDataItemList::~MicroDataItemList):
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::NameNodeList):
+        (WebCore::NameNodeList::~NameNodeList):
+        (WebCore::NameNodeList::nodeMatches):
+        * dom/NameNodeList.h:
+        (WebCore):
+        (NameNodeList):
+        (WebCore::NameNodeList::create):
+        * dom/Node.cpp:
+        (WebCore::Node::nodeLists): Added so that node lists can directly call removeCacheWith*.
+        (WebCore::Node::getElementsByTagName):
+        (WebCore::Node::getElementsByTagNameNS):
+        (WebCore::Node::getElementsByName):
+        (WebCore::Node::getElementsByClassName):
+        (WebCore::Node::radioNodeList):
+        (WebCore::NodeListsNodeData::invalidateCaches): Merged invalidateCachesThatDependOnAttributes. The function takes
+        the attribute name to avoid invalidating tag node lists when only attributes are modified. Also, now we have exactly
+        three hash maps to invalidate: m_atomicNameCaches, m_nameCaches, and m_tagNodeListCacheNS.
+        (WebCore): NodeListsNodeData::isEmpty is moved to NodeRareData.h.
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        (WebCore::NodeListsNodeData::addCacheWithAtomicName):
+        (WebCore::NodeListsNodeData::addCacheWithName):
+        (WebCore::NodeListsNodeData::addCacheWithQualifiedName):
+        (WebCore::NodeListsNodeData::removeCacheWithAtomicName):
+        (WebCore::NodeListsNodeData::removeCacheWithName):
+        (WebCore::NodeListsNodeData::removeCacheWithQualifiedName):
+        (WebCore::NodeListsNodeData::isEmpty): Moved from Node.cpp now that this function is much shorter.
+        (WebCore::NodeListsNodeData::NodeListsNodeData):
+        (WebCore::NodeListsNodeData::namedNodeListKey): Helper member functions to obtain the key for AtomicString and
+        String hash maps.
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::TagNodeList):
+        (WebCore::TagNodeList::~TagNodeList):
+        (WebCore::HTMLTagNodeList::HTMLTagNodeList): Hard code namespaceURI = starAtom since other values are never used.
+        (WebCore::HTMLTagNodeList::nodeMatches): Given that, assert m_namespace == starAtom.
+        * dom/TagNodeList.h:
+        (WebCore::TagNodeList::create): Add a new version of create that doesn't take namespace (assume starAtom) so that
+        addCacheWithAtomicName works with this class.
+        (WebCore::HTMLTagNodeList::create): Removed namespaceURI from the argument list since it's always starAtom.
+        (HTMLTagNodeList):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+        * html/LabelsNodeList.cpp:
+        (WebCore::LabelsNodeList::LabelsNodeList): Removed redundant m_forNode (identical to m_node in DynamicNodeList).
+        (WebCore::LabelsNodeList::~LabelsNodeList):
+        (WebCore::LabelsNodeList::nodeMatches):
+        * html/LabelsNodeList.h:
+        (WebCore::LabelsNodeList::create):
+        (LabelsNodeList):
+        * html/RadioNodeList.cpp:
+        (WebCore::RadioNodeList::RadioNodeList): Removed redundant m_baseElement (identical to m_node in DynamicNodeList).
+        Also changed the first argument's type from Element* to Node* so that it works better with new template member
+        functions of NodeListsNodeData.
+        (WebCore::RadioNodeList::~RadioNodeList):
+        (WebCore::RadioNodeList::checkElementMatchesRadioNodeListFilter):
+        * html/RadioNodeList.h:
+        (WebCore::RadioNodeList::create):
+        (RadioNodeList):
+
+2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120945.
+        http://trac.webkit.org/changeset/120945
+        https://bugs.webkit.org/show_bug.cgi?id=89703
+
+        editing/shadow/breaking-editing-boundaries.html started to
+        crash (Requested by hayato on #webkit).
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-21  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] Use setGstElementClassMetadata.
+
+        Rubber/stamped by Martin Robinson.
+
+        This function was introduced in r120790 but I forgot to actually
+        use it in that patch.
+
+        * platform/graphics/gstreamer/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_class_init):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+
+2012-06-21  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
+        https://bugs.webkit.org/show_bug.cgi?id=80880
+
+        Reviewed by Adam Barth.
+
+        We used to add a hidden property in the getter to the returned wrapper.
+        With this patch we instead handle the liveness of the wrapper in the GC phase by
+        calling v8::V8::AddHiddenReference.
+
+        To reduce the amount of custom code we need, the V8 code generator now supports
+        GenerateIsReachable (as well as CustomIsReachable) which, even though different
+        from the JSC attribute, is used in the same cases and takes the same values (even though
+        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
+        also have a dependent life time (just like if V8DependentLifetime was present).
+
+        No new tests. Covered by existing tests.
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
+        (GetCustomIsReachable): Ditto.
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsToVisitDOMWrapper):
+        (GetGenerateIsReachable):
+        (GetCustomIsReachable):
+        (GenerateVisitDOMWrapper):
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-21  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Implement spec behavior for multiEntry indexes with invalid/duplicate subkeys
+        https://bugs.webkit.org/show_bug.cgi?id=86123
+
+        Reviewed by Darin Fisher.
+
+        Distinguish between an actual invalid IDBKey, and an array of
+        possibly-invalid subkeys by making IDBKey::isValid() check subkeys
+        if the type is an array.
+
+        Introduce a new way to transform an IDBKey into a
+        multiEntry-specific IDBKey, (IDBKey::createMultiEntryArray)
+        throwing out duplicates and invalid keys. Use it when storing
+        index entries for multiEntry indexes.
+
+        No new tests: existing tests have been altered to include new behavior.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::continueFunction):
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::cmp):
+        * Modules/indexeddb/IDBIndex.cpp:
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * Modules/indexeddb/IDBKey.cpp:
+        (WebCore::IDBKey::isValid):
+        (WebCore):
+        * Modules/indexeddb/IDBKey.h:
+        (WebCore::IDBKey::createMultiEntryArray):
+        (IDBKey):
+        * Modules/indexeddb/IDBKeyRange.cpp:
+        (WebCore::IDBKeyRange::only):
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::putObjectStoreRecord):
+        (WebCore::IDBLevelDBBackingStore::putIndexDataForRecord):
+        * Modules/indexeddb/IDBLevelDBCoding.cpp:
+        (WebCore::IDBLevelDBCoding::encodeIDBKey):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromValue):
+
+2012-06-21  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Overlays when using the web inspector are blurry with device scale factor > 1
+        https://bugs.webkit.org/show_bug.cgi?id=89676
+
+        Reviewed by James Robinson.
+
+        Whenever we construct a GraphicsLayerChromium, make initialize the
+        device and page scale factors, if possible.
+
+        Unit test: GraphicsLayerChromiumTest.shouldStartWithCorrectContentsScale
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+
+2012-06-21  Philippe Normand  <pnormand@igalia.com>
+
+        [Qt] REGRESSION(r120790): broke video rendering
+        https://bugs.webkit.org/show_bug.cgi?id=89619
+
+        Reviewed by Alexis Menard.
+
+        Invert the pixel components of the Image on little endian architectures.
+
+        * platform/graphics/gstreamer/ImageGStreamerQt.cpp:
+        (ImageGStreamer::ImageGStreamer):
+
+2012-06-21  James Simonsen  <simonjam@chromium.org>
+
+        [Resource Timing] Implement Resource Timing interface
+        https://bugs.webkit.org/show_bug.cgi?id=61152
+
+        This patch implements the Resource Timing interface. It doesn't do anything
+        useful, because nothing populates the timeline yet. There are also some gaps
+        in the implementation, which have been filed as bugs.
+
+        http://dvcs.w3.org/hg/webperf/raw-file/tip/specs/ResourceTiming/Overview.html
+
+        Reviewed by Tony Gentilcore.
+
+        No new tests. Feature is disabled on all platforms.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/custom/V8PerformanceEntryCustom.cpp:
+        (WebCore):
+        (WebCore::toV8): Support PerformanceEntry polymorphism.
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventTargetFactory.in:
+        * page/Performance.cpp:
+        (WebCore::Performance::~Performance):
+        (WebCore):
+        (WebCore::Performance::interfaceName): Reqired for EventTarget.
+        (WebCore::Performance::scriptExecutionContext): Ditto.
+        (WebCore::Performance::webkitGetEntries): Return "resource" entries.
+        (WebCore::Performance::webkitGetEntriesByType): Ditto.
+        (WebCore::Performance::webkitGetEntriesByName): Ditto.
+        (WebCore::Performance::webkitClearResourceTimings): New.
+        (WebCore::Performance::webkitSetResourceTimingBufferSize): New. Unimplemented.
+        (WebCore::Performance::addResourceTiming): This is how resources in WebCore will report to the timeline.
+        (WebCore::Performance::eventTargetData): Required for EventTarget.
+        (WebCore::Performance::ensureEventTargetData): Ditto.
+        * page/Performance.h:
+        (Performance):
+        (WebCore::Performance::refEventTarget):
+        (WebCore::Performance::derefEventTarget):
+        * page/Performance.idl:
+        * page/PerformanceEntry.cpp:
+        (WebCore::PerformanceEntry::~PerformanceEntry):
+        (WebCore):
+        * page/PerformanceEntry.h:
+        (PerformanceEntry):
+        (WebCore::PerformanceEntry::isResource):
+        * page/PerformanceEntry.idl:
+        * page/PerformanceResourceTiming.cpp: Added.
+        (WebCore):
+        (WebCore::PerformanceResourceTiming::PerformanceResourceTiming):
+        (WebCore::PerformanceResourceTiming::initiatorType):
+        (WebCore::PerformanceResourceTiming::redirectStart):
+        (WebCore::PerformanceResourceTiming::redirectEnd):
+        (WebCore::PerformanceResourceTiming::fetchStart):
+        (WebCore::PerformanceResourceTiming::domainLookupStart):
+        (WebCore::PerformanceResourceTiming::domainLookupEnd):
+        (WebCore::PerformanceResourceTiming::connectStart):
+        (WebCore::PerformanceResourceTiming::connectEnd):
+        (WebCore::PerformanceResourceTiming::secureConnectionStart):
+        (WebCore::PerformanceResourceTiming::requestStart):
+        (WebCore::PerformanceResourceTiming::responseStart):
+        (WebCore::PerformanceResourceTiming::responseEnd):
+        (WebCore::PerformanceResourceTiming::monotonicTimeToDocumentMilliseconds):
+        (WebCore::PerformanceResourceTiming::resourceTimeToMilliseconds):
+        * page/PerformanceResourceTiming.h: Added.
+        (WebCore):
+        (PerformanceResourceTiming):
+        (WebCore::PerformanceResourceTiming::create):
+        (WebCore::PerformanceResourceTiming::isResource):
+        * page/PerformanceResourceTiming.idl: Added.
+
+2012-06-21  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Remove FIXMEs about whether events bubble and are cancelable
+        https://bugs.webkit.org/show_bug.cgi?id=89657
+
+        Reviewed by Adam Barth.
+
+        The spec has been updated to clarify that the events do not bubble and
+        are not cancelable.
+
+        No new tests, just removing comments.
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::didStartAudio):
+        * Modules/speech/SpeechRecognitionError.cpp:
+        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
+
+2012-06-21  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Rename InjectedWebGLScriptSource.js -> InjectedScriptWebGLModuleSource.js
+        https://bugs.webkit.org/show_bug.cgi?id=89675
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptWebGLModule.cpp:
+        (WebCore::InjectedScriptWebGLModule::source):
+        * inspector/InjectedScriptWebGLModuleSource.js: Renamed from Source/WebCore/inspector/InjectedWebGLScriptSource.js.
+        (.):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix NPAPI plugins on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=54531
+
+        Reviewed by Martin Robinson.
+
+        Switch to using PluginPackageWin.cpp and PluginViewWin.cpp on Windows
+        platform, and leave plugins/gtk/ only for XP_UNIX platforms. With this
+        we can share a lot of code with other ports and don't have to
+        reimplement all the Windows-specific code in plugins/gtk/.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/graphics/GraphicsContext.h:
+        (GraphicsContext):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (GraphicsContextPlatformPrivate):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore):
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore):
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::unloadModule):
+        * plugins/PluginView.h:
+        (PluginView):
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::registerPluginView):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::snapshot):
+
+2012-06-21  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/11718988> and https://bugs.webkit.org/show_bug.cgi?id=89673
+        showModalDialog fix creates risk of never returning from RunLoop::performWork, potentially blocking other event sources
+
+        In case handling a function on the queue places additional functions on the queue, we should
+        limit the number of functions each invocation of performWork() performs so it can return and
+        other event sources have a chance to spin.
+
+        The showModalDialog fix in question is http://trac.webkit.org/changeset/120879
+
+        Reviewed by Darin Adler and Anders Carlson.
+
+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::performWork): If there are only N functions in the queue when performWork is called,
+          only handle up to N functions before returning. Any additional functions will be handled the next time
+          the runloop spins.
+
+2012-06-21  Tim Horton  <timothy_horton@apple.com>
+
+        SVGImageCache isn't invalidated for <img> on dynamic page scale changes
+        https://bugs.webkit.org/show_bug.cgi?id=89621
+        <rdar://problem/11714677>
+
+        Reviewed by Simon Fraser.
+
+        Previously, device and page scale factors were being cached as a part of the SVGImageCache's
+        size request. However, an <img> never has a reason to update its size request when the page
+        scale is changed via gesture zooming, as no layout occurs.
+
+        Instead, look up the relevant scales when the image is requested (which will occur during every
+        repaint), allowing page scale changes to take effect without requiring an updated size request.
+
+        Test: svg/as-image/image-respects-pageScaleFactor-change.html
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::lookupOrCreateImageForRenderer):
+        (WebCore::CachedImage::setContainerSizeForRenderer):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::lookupOrCreateBitmapImageForRenderer):
+        * svg/graphics/SVGImageCache.h:
+        (WebCore::SVGImageCache::SizeAndScales::SizeAndScales):
+        (SizeAndScales):
+
+2012-06-21  Philip Rogers  <pdr@google.com>
+
+        Add pending resource even if others are pending
+        https://bugs.webkit.org/show_bug.cgi?id=89633
+
+        Reviewed by Dirk Schulze.
+
+        An element can have multiple simultaneous pending resources but some of
+        this code was legacy, before the hasPendingResource()->hasPendingResources()
+        change (r105573). This patch continues adding a pending resource even if
+        there are other pending resources. In some cases, this can lead to marking
+        a resource as pending twice but the performance impact of that is negligible.
+
+        Other than SVGUseElement, SVGTrefElement and SVGFEImageElement are also
+        changed. These elements are unaffected because they can only have
+        a single resource at the moment (href), with other Style url() references
+        being handled by their parent containers.
+
+        Tests: svg/custom/use-multiple-pending-resources-expected.svg
+               svg/custom/use-multiple-pending-resources.svg
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::buildPendingResource):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::detachTarget):
+        (WebCore::SVGTRefElement::buildPendingResource):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+
+2012-06-21  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Replace the use of "struct stat" with GStatBuf
+        https://bugs.webkit.org/show_bug.cgi?id=89488
+
+        Reviewed by Martin Robinson.
+
+        Make sure we pass GStatBuf to g_stat(); depending on the platform, it
+        isn't always the same as "struct stat", e.g. on Windows.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+
+2012-06-21  Min Qin  <qinmin@chromium.org>
+
+        remove ENABLE_FULLSCREEN_MEDIA_CONTROL flag
+        https://bugs.webkit.org/show_bug.cgi?id=89614
+
+        Reviewed by Eric Carlson.
+
+        Desktop chromium also starts to use fullscreen button after https://bugs.webkit.org/show_bug.cgi?id=88818
+        we don't need this flag any more
+        No test needed as this change just removes a flag.
+
+        * html/shadow/MediaControlRootElementChromium.cpp:
+        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
+        (WebCore::MediaControlRootElementChromium::create):
+        (WebCore::MediaControlRootElementChromium::setMediaController):
+        (WebCore::MediaControlRootElementChromium::reset):
+        (WebCore::MediaControlRootElementChromium::reportedError):
+        * html/shadow/MediaControlRootElementChromium.h:
+        (MediaControlRootElementChromium):
+
+2012-06-21  Hayato Ito  <hayato@chromium.org>
+
+        Modify event re-targeting algorithm so that we can tell which distributed node is clicked.
+        https://bugs.webkit.org/show_bug.cgi?id=89073
+
+        Reviewed by Dimitri Glazkov.
+
+        Adopt a new event re-targeting algorithm in the latest Shadow DOM spec.
+        The corresponding bug in the shadow DOM spec is:
+        https://www.w3.org/Bugs/Public/show_bug.cgi?id=17090
+
+        This change is introduced to handle the following use case:
+        1. There is an insertion point, with zero or more nodes distributed into it.
+        2. User clicks on one of the items.
+        3. The event handler in shadow DOM subtree wants to know which item was clicked on.
+
+        The new re-targeting algorithm sets an event's target to a
+        distributed node where an event was originally fired, instead of
+        an insertion point to where the node is distributed.
+
+        The similar re-targeting algorithm also applies to an event's
+        relatedTarget.
+
+        Test: fast/dom/shadow/shadow-dom-event-dispatching.html
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventRelatedTargetAdjuster::adjust):
+        (WebCore::EventDispatcher::ensureEventAncestors):
+
+2012-06-21  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Change WEBKIT_REGION_RULE value to 16
+        https://bugs.webkit.org/show_bug.cgi?id=89421
+
+        Reviewed by Tony Chang.
+
+        Modified WEBKIT_REGION_RULE where applicable to match CSS Regions spec.
+        The new value for WEBKIT_REGION_RULE is 16 (was 10).
+
+        * css/CSSRule.cpp:
+        (WebCore):
+        Added COMPILE_ASSERT to ensure StyleRule::Region and CSSRule::WEBKIT_REGION_RULE will
+        * css/CSSRule.h:
+        (CSSRule):
+        Modified m_type bitfield length to 5
+        * css/CSSRule.idl:
+        * css/StyleRule.cpp:
+        (SameSizeAsStyleRuleBase):
+        (WebCore):
+        Added COMPILE_ASSERT to ensure that StyleRuleBase will always have exactly 32bits.
+        * css/StyleRule.h:
+        (StyleRuleBase):
+        Modified m_type bitfield to 5 to accommodate the new value, and modified
+        m_sourceLine bitfield to 27 bits in order to keep StyleRule 32
+        bits long. Consequently, any css rule longer than 67,108,863 lines will
+        cause overflow - however, the value is large enough not to cause
+        problems.
+
+2012-06-21  Silvia Pfeiffer  <silviapf@chromium.org>
+
+        Paint played and buffered ranges differently in Chrome video controls.
+        https://bugs.webkit.org/show_bug.cgi?id=89284
+
+        Reviewed by Eric Carlson.
+
+        No new tests; existing video control tests cover this case.
+
+        The Chrome video controls are receiving a visual update. This patch changes
+        the format in which the playback position slider displays the buffered range.
+        It is painted in a lighter color left of the position thumb and darker right
+        of the position thumb
+
+        * css/mediaControlsChromium.css:
+        (input[type="range"]::-webkit-media-slider-container):
+        Adjust the border color of the playback position slider.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintRoundedSliderBackground):
+        Adjust the background color of the position slider.
+        (WebCore::paintSliderRangeHighlight):
+        Make the color of the range region a function parameter,
+        provide start and end position as pixel width instead of percentage,
+        and make sure the rounded corners at beginning and end don't turn into rectangles.
+        (WebCore):
+        Move the mediaSliderThumbWidth variable up to be used in paintMediaSlider().
+        (WebCore::paintMediaSlider):
+        Calculate start, current and end position instead of fractions,
+        adjust the current position by half the thumb's width for improved rendering,
+        and draw two highlight areas: one bright one before current position and
+        one grey one after current position.
+        (WebCore::paintMediaVolumeSlider):
+        Adjust the paintSliderRangeHighlight function call and add the colors.
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused static variable uninitializedLineNumberValue.
+        https://bugs.webkit.org/show_bug.cgi?id=89643
+
+        Reviewed by Alexey Proskuryakov.
+
+        No behavioral changes.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore):
+
+2012-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unused static function skipComment.
+        https://bugs.webkit.org/show_bug.cgi?id=89641
+
+        Reviewed by Alexey Proskuryakov.
+
+        No behavioral changes.
+
+        * loader/TextResourceDecoder.cpp:
+
+2012-06-21  Nico Weber  <thakis@chromium.org>
+
+        Remove two more member variables found by clang's Wunused-private-field
+        https://bugs.webkit.org/show_bug.cgi?id=89672
+
+        Reviewed by Anders Carlsson.
+
+        * html/shadow/MediaControlRootElementChromium.h:
+        (MediaControlRootElementChromium):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::FECustomFilter):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+
+2012-06-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Non-fixed length margins don't work with align=center
+        https://bugs.webkit.org/show_bug.cgi?id=89626
+
+        Reviewed by Levi Weintraub.
+
+        Tests: fast/block/negative-start-margin-align-center-percent.html
+               fast/block/positive-margin-block-child-align-center-calc.html
+
+        Calling Length::value() is a bad idea as it returns the *raw* value of
+        the length. For percent and calculated length this is a bad idea as they
+        bear not relation to the actual computed length.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        Fixed the code to use minimumValueForLength as this nicely takes care of the 'auto' case.
+
+2012-06-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] style improvement for setDeviceScaleFactor code
+        https://bugs.webkit.org/show_bug.cgi?id=89665
+
+        Correct a coding style error committed in https://bugs.webkit.org/show_bug.cgi?id=88916
+
+        Reviewed by Adrienne Walker.
+
+        Purely code hygiene: existing tests suffice.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setDeviceScaleFactor):
+
+2012-06-21  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Crash][Editing] Pressing enter on LI element triggers assertion in Shadow DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=89171
+
+        Reviewed by Ryosuke Niwa.
+
+        Since modidying Shadow DOM removes renderer of elements in Shadow DOM and shadow host,
+        assertion to check the existence of renderer was triggered.
+
+        We should update layout here to create renderer again.
+
+        Test: editing/shadow/pressing-enter-on-list.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::appendBlockPlaceholder):
+
+2012-06-21  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Add injected WebGL module class
+        https://bugs.webkit.org/show_bug.cgi?id=89592
+
+        Reviewed by Pavel Feldman.
+
+        Adding a new InjectedScriptWebGLModule class and moving WebGL-related
+        stuff out of InjectedScriptManager class.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/InjectedScriptManager.h:
+        (InjectedScriptManager):
+        * inspector/InjectedScriptModule.cpp:
+        (WebCore::InjectedScriptModule::ensureInjected):
+        * inspector/InjectedScriptModule.h:
+        (InjectedScriptModule):
+        * inspector/InjectedScriptWebGLModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptModule.cpp.
+        (WebCore):
+        (WebCore::InjectedScriptWebGLModule::InjectedScriptWebGLModule):
+        (WebCore::InjectedScriptWebGLModule::moduleForState):
+        (WebCore::InjectedScriptWebGLModule::source):
+        (WebCore::InjectedScriptWebGLModule::wrapWebGLContext):
+        (WebCore::InjectedScriptWebGLModule::captureFrame):
+        * inspector/InjectedScriptWebGLModule.h: Copied from Source/WebCore/inspector/InjectedScriptModule.h.
+        (WebCore):
+        (InjectedScriptWebGLModule):
+        * inspector/InspectorWebGLAgent.cpp:
+        (WebCore::InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation):
+
+2012-06-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: do not add separator to the end of the context menu.
+        https://bugs.webkit.org/show_bug.cgi?id=89634
+
+        Reviewed by Vsevolod Vlasov.
+
+        Attaching separators only before menu items now.
+
+        * inspector/front-end/ContextMenu.js:
+        (WebInspector.ContextSubMenuItem.prototype.appendItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendSubMenuItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendCheckboxItem):
+        (WebInspector.ContextSubMenuItem.prototype.appendSeparator):
+        (WebInspector.ContextSubMenuItem.prototype._pushItem):
+
+2012-06-21  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Unify FileSystem callbacks
+        https://bugs.webkit.org/show_bug.cgi?id=89420
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+
+2012-06-20  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognition should hook up with ActiveDOMObject more
+        https://bugs.webkit.org/show_bug.cgi?id=89217
+
+        Reviewed by Adam Barth.
+
+        Previously, the SpeechRecognition was kept alive while waiting for
+        pending events by making the embedder hold a reference to the object.
+        We should do this by using ActiveDOMObject's setPendingActivity() instead.
+
+        Also, override ActiveDOMObject::stop() to get notified when the user
+        leaves the page.
+
+        Test: fast/speech/scripted/navigate-away.html
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::start):
+        (WebCore::SpeechRecognition::didEnd):
+        (WebCore::SpeechRecognition::stop):
+        (WebCore):
+        * Modules/speech/SpeechRecognition.h:
+        (SpeechRecognition):
+
+2012-06-21  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Move requestId allocation from FileSystem frontend to backend
+        https://bugs.webkit.org/show_bug.cgi?id=89555
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/get-filesystem-root.html:
+              http/tests/inspector/filesystem/read-directory.html:
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot):
+        (WebCore::InspectorFileSystemAgent::requestDirectoryContent):
+        (WebCore::InspectorFileSystemAgent::InspectorFileSystemAgent):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype._originAdded):
+        (WebInspector.FileSystemModel.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot):
+        (WebInspector.FileSystemRequestManager.prototype._fileSystemRootReceived):
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent):
+        (WebInspector.FileSystemRequestManager.prototype._directoryContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.fileSystemRootReceived):
+        (WebInspector.FileSystemDispatcher.prototype.directoryContentReceived):
+
+2012-06-20  Arnaud Renevier  <arno@renevier.net>
+
+        [cairo] improve putByteArray speed by avoiding max/min checks at Color construction.
+        https://bugs.webkit.org/show_bug.cgi?id=89138
+
+        Reviewed by Adam Barth.
+
+        Color constructor accepts integer arguments and checks if they are
+        between 0 and 255. In some cases, we already known those numbers to be
+        within those boundaries. For example when using unsigned chars. So
+        this patch introduces Color::createUnChecked which return a Color
+        object without checking for boundaries.
+
+        No new tests: no behaviour change
+
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFromPremultipliedARGB):
+        * platform/graphics/Color.h:
+        (WebCore::Color::createUnCheked):
+        (Color):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::putByteArray):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        When not using partial swap, the CCDamageTracker was not used, and
+        its m_currentDamageRect was always empty. As a result,
+        CCLayerTreeHostImpl was thinking no content was changed and was
+        removing more textures than needed. Fixed this by turning on
+        CCDamageTracker usage even if not using partial swap, but
+        overwriting the rootScissorRect with viewport rect if required.
+
+        Added unit tests to exercise this scenario.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make step action of SpinButtonElement replaceable
+        https://bugs.webkit.org/show_bug.cgi?id=89439
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces SpinButtonElement::Callback to specify step
+        action by control clients for using SpinButtonElement by
+        TextFieldInputType and future version of TimeInputField.
+
+        In addition to this improving flexibility of SpinButtonElement, we
+        free HTMLInputElement from SpinButtonElement dependency on
+        stepUpFromRenderer.
+
+        No new tests. This patch doesn't change behavior.
+
+        * html/HTMLInputElement.cpp: Removed stepUpFromRenderer().
+        * html/HTMLInputElement.h: Removed stepUpFromRenderer().
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::~TextFieldInputType): Added to call SpinButtonElement::removeStepActionHandler.
+        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton): Changed to call spinButtonStep{Down,Up}
+        (WebCore::TextFieldInputType::handleWheelEventForSpinButton): Changed to call spinButtonStep{Down,Up}
+        (WebCore::TextFieldInputType::createShadowSubtree): Added SpinButtonElement::StepActionHandler parameter.
+        (WebCore::TextFieldInputType::destroyShadowSubtree): Added to call SpinButtonElement::removeStepActionHandler.
+        (WebCore::TextFieldInputType::spinButtonStepDown): Added for implementation of SpinButtonElement::StepActionHandler.
+        (WebCore::TextFieldInputType::spinButtonStepUp): Added for implementation of SpinButtonElement::StepActionHandler.
+        * html/TextFieldInputType.h:
+        (TextFieldInputType):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SpinButtonElement::SpinButtonElement): Added StepActionHandler parameter.
+        (WebCore::SpinButtonElement::defaultEventHandler): Changed to call doStepAction.
+        (WebCore::SpinButtonElement::doStepAction): Added to call StepActionHandler if possible.
+        (WebCore::SpinButtonElement::step): Changed to call doStepAction.
+        * html/shadow/TextControlInnerElements.h:
+        (StepActionHandler): Added.
+
+2012-06-20  Adrienne Walker  <enne@google.com>
+
+        [chromium] Modify CCDamageTracker hash to allow for layer id 0
+        https://bugs.webkit.org/show_bug.cgi?id=89631
+
+        Reviewed by James Robinson.
+
+        HashMap has the bizarre property that 0 is the empty value for integer
+        keys. Modify the damage tracking HashMap to use negative values for
+        both the empty and the deleted key traits. Additionally, make sure we
+        never generate negative layer IDs in practice.
+
+        Test: passes webkit_unit_tests with the patch in bug 89589 applied.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/cc/CCDamageTracker.h:
+        (RectMapKeyTraits):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::emptyValue):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::constructDeletedValue):
+        (WebCore::CCDamageTracker::RectMapKeyTraits::isDeletedValue):
+        (CCDamageTracker):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+
+2012-06-20  Adam Klein  <adamk@chromium.org>
+
+        Use Dictionary in MutationObserver.observe to kill custom code
+        https://bugs.webkit.org/show_bug.cgi?id=89629
+
+        Reviewed by Ryosuke Niwa.
+
+        Move code for dictionary parsing in MutationObserver.observe
+        that used to be duplicated (with different implementations)
+        in JSC and V8 bindings into WebKitMutationObserver.cpp, using
+        the new Dictionary interface.
+
+        No new tests, no change in behavior.
+
+        * bindings/js/JSWebKitMutationObserverCustom.cpp:
+        * bindings/v8/custom/V8WebKitMutationObserverCustom.cpp:
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::observe):
+        * dom/WebKitMutationObserver.h:
+        (WebCore):
+        * dom/WebKitMutationObserver.idl:
+
+2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120889.
+        http://trac.webkit.org/changeset/120889
+        https://bugs.webkit.org/show_bug.cgi?id=89630
+
+        [Chromium] webkit_unit_tests didDrawNotCalledOnHiddenLayer
+        start failing (Requested by ukai on #webkit).
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Hayato Ito  <hayato@chromium.org>
+
+        [Shadow][Editing] Deleting character in distributed element caused a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=88484
+
+        Reviewed by Ryosuke Niwa.
+
+        If we mutate nodes which are children of a shadow host, it causes
+        ElementShadow::invalidateDistribution().  As a result, shadow host
+        is detached (and lazyAttached()) and its renderer is gone.  That
+        causes assertion error since isEditablePosition() assumes
+        anchorNode's style was correctly calculated.
+
+        This patch makes isEditablePosition() call
+        document->updateLayoutIgnorePendingStylesheets() so that it does
+        not return a bogus result.
+
+        There is an exceptional caller of isEditablePosition,
+        RenderBlock::paintCaret(), from where we can not call
+        updateLayout() in isEditablePosition because it hits assertion,
+        ASSERT(!isPainting). So I've added the third parameter to
+        isEditablePosition to control updating the style.
+
+        Test: edition/shadow/delete-characters-in-distributed-node.html
+
+        * editing/FrameSelection.h:
+        (WebCore::FrameSelection::rendererIsEditable):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::rendererIsEditable):
+        (WebCore):
+        * editing/VisibleSelection.h:
+        (VisibleSelection):
+        * editing/htmlediting.cpp:
+        (WebCore::isEditablePosition):
+        * editing/htmlediting.h:
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+
+2012-06-20  Kent Tamura  <tkent@chromium.org>
+
+        Unmodified form control value are overwritten by another form
+        control value with the same name after navigating and going back
+        https://bugs.webkit.org/show_bug.cgi?id=89409
+
+        Reviewed by Hajime Morita.
+
+        Detail of the bug:
+        If a page had multiple form controls of which names and types were
+        identical like the following:
+          <input type=text name=name1 id=input1>
+          <input type=text name=name1 id=input2>
+        and a user updated the value of the second control, then went to
+        another page and went back to the page again, we restored the updated
+        value to the first element, and didn't update the second element.
+
+        We didn't save unmodified control state, and the form state data
+        had no ways to represent "this control should be skipped".
+
+        How to resovle the bug:
+        We need to represent "this control should be skipped" in the
+        seriazlied form state vector.
+
+        - A serialized control state had three items:
+                name, type, value.
+          Now we change it to:
+                name, type, flag, optional value
+
+        - It is definitely incompatible with serizlized state produced by
+        older WebCore. So, we need to add the signature string to
+        represent the version of serialized state format.
+
+        - Because the state for a form control is variable-length and we
+        can't deserialize it in reverse-order, we change the on-memory
+        representation from Vector<> to Deque<>.
+
+        Test: fast/forms/state-restore-to-non-edited-controls.html
+
+        * html/FormController.cpp:
+        (WebCore::FormControlState::serializeTo):
+        Added. Serialize a state for a form control to a string vector.
+        (WebCore::FormControlState::deserialize):
+        Added. Produce a FormControlState object from the specified string vector.
+        It can produce a FromControlState of the failure type.
+        (WebCore::formStateSignature): The signature string of the serialized state.
+        (WebCore::FormController::formElementsState):
+         - Capacity:
+          The size of seirlized data for one form control is typically 4.
+          +1 for the signature.
+         - We need to store a FormControlState with no values.
+        (WebCore::FormController::setStateForNewFormElements):
+         - We can't iterate over the stateVector in reverse order any more
+           because serialized control state is variable-length.
+         - We put FormControlState objects to HashMap instead of String objects.
+        (WebCore::FormController::takeStateForFormElement):
+         Updated for Deque<>.
+        * html/FormController.h:
+        (FormControlState): Declare deserialize() and serializeTo().
+        (WebCore::FormControlState::isFailure): Added.
+        (WebCore::FormControlState::FormControlState):
+        Added to create a FormControlState with failure type.
+        (FormController):
+        Change the value type of m_stateForNewFormElements from Vector<String>
+        to Deque<FormControlState>.
+
+2012-06-20  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Rename CustomFilterShader class name to CustomFilterCompiledProgram
+        https://bugs.webkit.org/show_bug.cgi?id=89578
+
+        Reviewed by Dean Jackson.
+
+        I've renamed CustomFilterShader to CustomFilterCompiledProgram to make it obvious that it is the result of 
+        calling CustomFilterProgram::compileProgramWithContext.
+
+        No new tests, just renamed an existing class.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp.
+        (WebCore):
+        (WebCore::CustomFilterCompiledProgram::defaultVertexShaderString):
+        (WebCore::CustomFilterCompiledProgram::defaultFragmentShaderString):
+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
+        (WebCore::CustomFilterCompiledProgram::compileShader):
+        (WebCore::CustomFilterCompiledProgram::linkProgram):
+        (WebCore::CustomFilterCompiledProgram::initializeParameterLocations):
+        (WebCore::CustomFilterCompiledProgram::uniformLocationByName):
+        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram):
+        * platform/graphics/filters/CustomFilterCompiledProgram.h: Renamed from Source/WebCore/platform/graphics/filters/CustomFilterShader.h.
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore::CustomFilterProgram::compileProgramWithContext): Renamed method from createShaderWithContext to compileProgramWithContext.
+        * platform/graphics/filters/CustomFilterProgram.h:
+        (WebCore):
+        * platform/graphics/filters/FECustomFilter.cpp: Renamed m_shader to m_compiledProgram.
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore::FECustomFilter::initializeContext):
+        (WebCore::FECustomFilter::bindProgramParameters):
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/filters/FECustomFilter.h:
+        (WebCore):
+        (FECustomFilter):
+
+2012-06-19  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: reduce timeline refresh rate
+        https://bugs.webkit.org/show_bug.cgi?id=89548
+
+        Reviewed by Pavel Feldman.
+
+        Minimize resource contention with the inspected page during refresh:
+
+        - reduce refresh for both overview and main panes to 300ms
+        - automatically limit window size to approximately one pageful of events in the lower pane
+        - do not refresh lower pane for events that are outside of the window
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype._update):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineOverviewPane.prototype.setWindowTimes): Set overview window by times.
+        (WebInspector.TimelineOverviewPane.prototype._updateWindow):
+        (WebInspector.TimelineOverviewPane.prototype._scheduleRefresh): Refresh once in 300ms (insted of once in 100ms).
+        (WebInspector.TimelineOverviewWindow.prototype._setWindow):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded): Do not refresh if the new record is outside of window.
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._scheduleRefresh): Refresh rate: 100ms -> 300ms.
+        (WebInspector.TimelinePanel.prototype._refreshRecords): Automatically set overview window.
+        * inspector/front-end/TimelinePresentationModel.js: Expose filterRecords
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype.filterRecords):
+        (WebInspector.TimelinePresentationModel.prototype._innerFilterRecords):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        When not using partial swap, the CCDamageTracker was not used, and
+        its m_currentDamageRect was always empty. As a result,
+        CCLayerTreeHostImpl was thinking no content was changed and was
+        removing more textures than needed. Fixed this by turning on
+        CCDamageTracker usage even if not using partial swap, but
+        overwriting the rootScissorRect with viewport rect if required.
+
+        Added unit tests to exercise this scenario.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove redundant IDBObjectStore.delete() overloads
+        https://bugs.webkit.org/show_bug.cgi?id=89587
+
+        Reviewed by Darin Fisher.
+
+        The IDBObjectStore.delete(IDBKey) overload can delegate to the delete(IDBKeyRange)
+        overload. Also cleaned up redundant checks in related overloads.
+
+        Test: storage/indexeddb/deleted-objects.html
+
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::deleteFunction): Call keyRange variant instead.
+        * Modules/indexeddb/IDBIndex.cpp:
+        (WebCore::IDBIndex::get): Remove redundant deleted/invalid IDBKey checks.
+        (WebCore::IDBIndex::getKey): Remove redundant deleted/invalid IDBKey checks.
+        * Modules/indexeddb/IDBKeyRange.cpp: Null IDBKeys are not acceptable; currently
+        not passed in by any callers.
+        (WebCore::IDBKeyRange::only):
+        (WebCore::IDBKeyRange::lowerBound):
+        (WebCore::IDBKeyRange::upperBound):
+        (WebCore::IDBKeyRange::bound):
+        * Modules/indexeddb/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get): Was missing deleted check in IDBKeyRange overload.
+        Removed redundant checks in IDBKey overload.
+        (WebCore::IDBObjectStore::deleteFunction): Delegate to IDBKeyRange overload.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Remove IDBKey overload.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Remove IDBKey overload.
+        (IDBObjectStoreBackendImpl):
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Remove IDBKey overload.
+
+2012-06-20  Shinya Kawanaka  <shinyak@chromium.org>
+
+        [Shadow][Editing] Selection will break editing boundaries in Shadow DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=89075
+
+        Reviewed by Antti Koivisto.
+
+        At the shadow boundary, some styles (e.g. user-modify, text-decoration) cannot be inherited
+        from the shadow host. However, when style property cache is used, such styles are wrongly
+        inherited from the cache.
+
+        So this patch makes not to use cache for inehrited styles at the shadow boundary.
+
+        Tests: editing/shadow/breaking-editing-boundary-with-table.html
+               editing/shadow/contenteditable-propagation-at-shadow-boundary.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-20  Garret Kelly  <gdk@chromium.org>
+
+        Moving cookieEnabled/setCookieEnabled from Page to Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=89545
+
+        Reviewed by Adam Barth.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::cookieEnabled):
+        * page/Page.h:
+        (Page):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setCookieEnabled):
+        (WebCore::Settings::cookieEnabled):
+        (Settings):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::setUpCookiesForQuickTime):
+
+2012-06-20  Adam Barth  <abarth@webkit.org>
+
+        internals.settings.setDeviceScaleFactor doesn't work for WebKit2 and must be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89274
+
+        Reviewed by James Robinson.
+
+        Using this window.internals API causes the apple-mac port to ASSERT in
+        WebKit2 because WebKit2 keeps a copy of this state in the UI process.
+        When a test uses this internals API, the WebCore state gets out of sync
+        with the state in the UI process.
+
+        Tests should use setBackingScaleFactor instead.
+
+        * testing/InternalSettings.cpp:
+        (WebCore):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-06-20  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: persist timeline panel overview mode
+        https://bugs.webkit.org/show_bug.cgi?id=88711
+
+        Reviewed by Pavel Feldman.
+
+        - replace all internal methods of switching to a new mode of TimelineOverviewPane with setMode();
+        - make current mode a persistent setting;
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.setMode):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+
+2012-06-20  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/11653784> and https://bugs.webkit.org/show_bug.cgi?id=89590
+        showModalDialog message handling is flaky in WebKit2
+
+        Because RunLoop::performWork() swaps the function queue to a temporary Vector before calling
+        the functions an inner run-loop - such as we see with running a modal dialog - does not have
+        a change to handle any of the functions that were queued after the WebPageProxy::RunModal message.
+
+        By servicing the functions in the queue one at a time we can give the RunLoop a chance to pick up
+        where it left off if RunLoop::performWork is re-entered.
+
+        To guarantee RunLoop::performWork is re-entered to handle those functions we also need to signal
+        its source before entering the modal run loop so our RunLoop is woken up.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.exp.in:
+        * platform/RunLoop.cpp:
+        (WebCore::RunLoop::performWork): Take the first function off the queue one at a time so subsequent
+          functions remain in the queue and can be handled by an inner modal run loop.
+        * platform/RunLoop.h:
+        (RunLoop): Change the function queue to be a Deque to efficiently support "takeFirst" 
+
+2012-06-20  Varun Jain  <varunjain@chromium.org>
+
+        Account for device scale factor when creating image for dragging.
+        https://bugs.webkit.org/show_bug.cgi?id=89489
+
+        Reviewed by Adam Barth.
+
+        Manual Test: ManualTests/chromium/drag-image-accounts-for-device-scale.html
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::dragImageForSelection):
+
+2012-06-20  Jacky Jiang  <zhajiang@rim.com>
+
+        Add a != operator to ViewportArguments
+        https://bugs.webkit.org/show_bug.cgi?id=87505
+
+        Reviewed by Antonio Gomes.
+        Patch by Jacky Jiang  <zhajiang@rim.com>
+
+        Add a != operator to ViewportArguments for convenience.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+        (WebCore::ViewportArguments::operator!=):
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Move m_listsInvalidatedAtDocument from NodeListsNodeData to Document
+        https://bugs.webkit.org/show_bug.cgi?id=89603
+
+        Reviewed by Andreas Kling.
+
+        Moved the variable. m_listsInvalidatedAtDocument is never used in non-Document nodes
+        so it was just wasting memory space.
+
+        * dom/Document.cpp:
+        (WebCore::Document::registerDynamicSubtreeNodeList):
+        (WebCore::Document::unregisterDynamicSubtreeNodeList):
+        (WebCore):
+        (WebCore::Document::clearNodeListCaches):
+        * dom/Document.h:
+        (Document):
+        * dom/DynamicNodeList.h:
+        (DynamicSubtreeNodeList):
+        * dom/Node.cpp:
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::Node::invalidateNodeListsCacheAfterChildrenChanged):
+        (WebCore):
+        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes): RadioNodeList
+        is invalidated at document level. No need to invalidate it again here.
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+
+2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120854.
+        http://trac.webkit.org/changeset/120854
+        https://bugs.webkit.org/show_bug.cgi?id=89604
+
+        Broke Chromium WebKit Linux (dbg) (Requested by arv on
+        #webkit).
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+        (WebCore):
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Copied from Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp.
+        (WebCore):
+        (WebCore::toV8):
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-20  Abhishek Arya  <inferno@chromium.org>
+
+        Crash on accessing a removed renderer from percent height descendant map.
+        https://bugs.webkit.org/show_bug.cgi?id=88017
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/block/percent-height-descendant-not-removed-crash2.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hasPercentHeightContainerMap): helper to tell
+        if we have a height container map.
+        (WebCore):
+        (WebCore::RenderBlock::hasPercentHeightDescendant): change from a debug
+        only function to a regular function for use. no need to null check
+        for a percent height container map in this function.
+        (WebCore::RenderBlock::clearPercentHeightDescendantsFrom): helper to
+        clear all percent height descendants under us.
+        (WebCore::RenderBlock::removePercentHeightDescendantIfNeeded): helper to
+        clear the box if it exists in the percent height descendant map.
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed): remove the assert and change the
+        percent height detection check to use removePercentHeightDescendantIfNeeded.
+        We shouldn't rely on logicalHeight().isPercent() as it can change when our
+        writing mode changes. Instead, just query the map directly to see if we exist.
+        (WebCore::RenderBox::styleDidChange): when our writing mode changes from
+        horizontal to vertical or vice versa, we clear all our descendants from
+        the percent height descendant map. Cache the value of isHorizontalWritingMode()
+        before it changes in styleDidChange and compare it with the new value
+        (can't use oldStyle->isHorizontalWritingMode() since it can be inherited
+        and already updated).
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r113885): Margin not properly applied to elements with align=center
+        https://bugs.webkit.org/show_bug.cgi?id=89515
+
+        Reviewed by Levi Weintraub.
+
+        Reviewed by Levi Weintraub.
+
+        Tests: fast/block/negative-margin-start-positive-margin-end.html
+               fast/block/negative-start-margin-align-center.html
+               fast/block/positive-margin-block-child-align-center-rtl.html
+               fast/block/positive-margin-block-child-align-center.html
+               fast/block/positive-margin-start-align-center.html
+               fast/block/positive-margin-start-negative-margin-end-align-center.html
+               fast/table/table-cell-negative-start-margin-align-center.html
+
+        r113885 changed the code-path for elements with auto width to call computeInlineDirectionMargins.
+        However this uncovered an existing bug in the function when dealing with align="center" (text-align: -webkit-center)
+        where we would ignore the margin. This goes against what other browsers are doing and our previous behavior.
+
+        Note that align="left" and "right" are likely impacted too and will be investigated / fixed in follow-up changes.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        To match other browsers' behavior, changed the function to include margin in our computations.
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Separate LayerRenderer initialization from updateLayers
+        https://bugs.webkit.org/show_bug.cgi?id=89525
+
+        Reviewed by Adrienne Walker.
+
+        This adds an explicit call to initialize the layer renderer of a given CCLayerTreeHost instead of having it be
+        implicit in updateLayers(). This way the proxies can control the initialization sequence more closely and do
+        useful work between the two calls.
+
+        Refactor, no change in behavior. Covered by existing tests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::compositeAndReadback):
+        (WebCore::CCLayerTreeHost::initializeLayerRendererIfNeeded):
+        (WebCore):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::commitAndComposite):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::beginFrame):
+
+2012-06-20  Yong Li  <yoli@rim.com>
+
+        SecurityOrigin::canDisplay() should return true when m_universalAccess is true
+        https://bugs.webkit.org/show_bug.cgi?id=84865
+
+        Reviewed by Adam Barth.
+
+        Add an early return (true) in canDisplay() for if (m_universalAccess),
+        as we did for canAccess() and canRequest().
+
+        No new tests. We should be good as long as this change doesn't break existing
+        tests, which means the contents supposed to be blocked are still blocked when
+        m_universalAccess is false.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canDisplay):
+
+2012-06-20  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use v8::V8::AddImplicitReferences instead of SetHiddenValue
+        https://bugs.webkit.org/show_bug.cgi?id=80880
+
+        Reviewed by Adam Barth.
+
+        We used to add a hidden property in the getter to the returned wrapper.
+        With this patch we instead handle the liveness of the wrapper in the GC phase by
+        calling v8::V8::AddHiddenReference.
+
+        To reduce the amount of custom code we need, the V8 code generator now supports
+        GenerateIsReachable (as well as CustomIsReachable) which, even though different
+        from the JSC attribute, is used in the same cases and takes the same values (even though
+        at the moment not all JSC values are supported by V8). Interfaces that have *IsReachable
+        also have a dependent life time (just like if V8DependentLifetime was present).
+
+        Retry. Last time we got ASAN issues on some Cromium Linux bots. 
+
+        No new tests. Covered by existing tests.
+
+        * Target.pri:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GetGenerateIsReachable): Abstracted GenerateIsReachable and JSGenerateIsReachable.
+        (GetCustomIsReachable): Ditto.
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (NeedsToVisitDOMWrapper):
+        (GetGenerateIsReachable):
+        (GetCustomIsReachable):
+        (GenerateVisitDOMWrapper):
+        (GenerateHeader):
+        (GenerateNamedConstructorCallback):
+        (GenerateImplementation):
+        * bindings/scripts/IDLAttributes.txt:
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8Float64Array.h:
+        (V8Float64Array):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.h:
+        (V8TestActiveDOMObject):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.h:
+        (V8TestCustomNamedGetter):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventConstructor.h:
+        (V8TestEventConstructor):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestEventTarget.h:
+        (V8TestEventTarget):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestException.h:
+        (V8TestException):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestInterface.h:
+        (V8TestInterface):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.h:
+        (V8TestMediaQueryListListener):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.h:
+        (V8TestNamedConstructor):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestNode.h:
+        (V8TestNode):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h:
+        (V8TestSerializedScriptValueInterface):
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::npObjectTypeInfo):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore):
+        (WrapperTypeInfo):
+        * bindings/v8/custom/V8CSSStyleSheetCustom.cpp: Removed.
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8TextTrackListCustom.cpp: Removed.
+        * css/CSSStyleSheet.idl:
+        * css/StyleSheet.idl:
+        * dom/DOMStringMap.idl:
+        * dom/NamedNodeMap.idl:
+        * html/DOMTokenList.idl:
+        * html/track/TextTrackList.idl:
+
+2012-06-20  Tony Chang  <tony@chromium.org>
+
+        Regression(r116408): Ctrl-A (select all) on large text file hangs the tab with high CPU usage
+        https://bugs.webkit.org/show_bug.cgi?id=89562
+
+        Reviewed by Ryosuke Niwa.
+
+        Rather than replace the newlines in-place (in O(n^2)), build a new string using StringBuilder, which takes O(n).
+
+        No new tests, this is a perf improvement.
+
+        * platform/chromium/ClipboardUtilitiesChromium.cpp:
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+
+2012-06-20  Elliott Sprehn  <esprehn@gmail.com>
+
+        Add support for fit-content etc
+        https://bugs.webkit.org/show_bug.cgi?id=38919
+
+        Reviewed by Tony Chang.
+
+        Implement the CSS3 intrinsic dimension keywords for width properties and
+        add most of the plumbing for height properties but don't expose them
+        yet since this patch doesn't enforce them (matching current Gecko).
+        http://dev.w3.org/csswg/css3-writing-modes/#intrinsic-sizing
+
+        This patch implements -webkit-min-content, -webkit-max-content,
+        -webkit-fill-available and -webkit-fit-content for all width
+        properties.
+
+        Tests: fast/css-intrinsic-dimensions/height-dynamic-property-value.html
+               fast/css-intrinsic-dimensions/height-property-value.html
+               fast/css-intrinsic-dimensions/max-width-constrained.html
+               fast/css-intrinsic-dimensions/max-width-unconstrained.html
+               fast/css-intrinsic-dimensions/min-width.html
+               fast/css-intrinsic-dimensions/width-avoid-floats.html
+               fast/css-intrinsic-dimensions/width-dynamic-property-value.html
+               fast/css-intrinsic-dimensions/width-property-value.html
+               fast/css-intrinsic-dimensions/width.html
+
+        * css/CSSParser.cpp: Add parser support for the new keywords.
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore):
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSValueKeywords.in:
+        * css/LengthFunctions.cpp: Implement conversion functions.
+        (WebCore::minimumValueForLength):
+        (WebCore::valueForLength):
+        (WebCore::floatValueForLength):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::StyleBuilder::StyleBuilder): Clean up the template for old
+           intrinsic values and add new values. Rename old intrinsic to
+           LegacyIntrinsic and add support for the new dimension keywords as
+           Intrinsic.
+        * platform/Length.h:
+        (WebCore::Length::isIntrinsicOrAuto):
+        (WebCore::Length::isLegacyIntrinsic): New method to check for old
+            min-intrinsic and intrinsic keywords.
+        (WebCore::Length::isIntrinsic): New method to check for CSS3 intrinsic
+            dimension keywords like min-content.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing): Expose the max
+           and min logical preferred widths as the new keywords.
+        (WebCore::RenderBox::sizesLogicalWidthToFitContent): Renamed method to
+           be more consistent with the new MinContent naming in the spec.
+        * rendering/RenderBox.h:
+        (RenderBox):
+
+2012-06-20  Christopher Cameron  <ccameron@chromium.org>
+
+        [chromium] webkit-backface-visibility doesn't work with video
+        https://bugs.webkit.org/show_bug.cgi?id=88908
+
+        When determining a contents layer's backface culling, use the parent
+        layer's transform and backface-visibility properties. Track which
+        layers need this special treatment with useParentBackfaceVisibility
+        and setUseParentBackfaceVisibility functions in WebCore::LayerChromium,
+        WebKit::WebLayer, and WebCore::CCLayerImpl.
+
+        Reviewed by Adrienne Walker.
+
+        Tests: compositing/backface-visibility/backface-visibility-image.html
+               compositing/backface-visibility/backface-visibility-webgl.html
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+            When a contents layer is added, tag it as inheriting its backface
+            culling from its parent.
+        * platform/graphics/chromium/LayerChromium.cpp:
+            (WebCore::LayerChromium::LayerChromium):
+                Initialize new m_useParentBackfaceVisibility member variable.
+            (WebCore::LayerChromium::pushPropertiesTo):
+                Propagate m_useParentBackfaceVisibility to CCLayerImpl.
+        * platform/graphics/chromium/LayerChromium.h:
+            (WebCore::LayerChromium::setUseParentBackfaceVisibility):
+            (WebCore::LayerChromium::useParentBackfaceVisibility):
+            (LayerChromium):
+                Add m_useParentBackfaceVisibility member variable and modify
+                and query accessors.
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+            (WebCore::CCLayerImpl::CCLayerImpl):
+                Initialize new m_useParentBackfaceVisibility member variable.
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+            (WebCore::CCLayerImpl::setUseParentBackfaceVisibility):
+            (WebCore::CCLayerImpl::useParentBackfaceVisibility):
+            (CCLayerImpl):
+                Add m_useParentBackfaceVisibility member variable and modify
+                and query accessors.
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+            (WebCore::layerShouldBeSkipped):
+                When examining a layer, if the layer has 
+                useParentBackfaceVisibility set then use the layer's parent
+                layer to determine backface culling.
+
+2012-06-20  Nate Chapin  <japhet@chromium.org>
+
+        Don't re-enter CachedResource::removeClient() if an XHR
+        is canceled and restarted multiple times.
+        https://bugs.webkit.org/show_bug.cgi?id=89378
+
+        Reviewed by Eric Seidel.
+
+        Test: http/tests/xmlhttprequest/reentrant-cancel.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::cancel):
+        (WebCore::DocumentThreadableLoader::clearResource): Save off a copy of m_resource
+           then clear it, so we don't call clearResource() multiple times for the same resource.
+
+2012-06-20  Robert Hogan  <robert@webkit.org>
+
+        Negative margin block doesn't properly clear a float enclosed by a previous sibling
+        https://bugs.webkit.org/show_bug.cgi?id=10900
+
+        Reviewed by Eric Seidel.
+
+        Tests: fast/block/float/previous-sibling-abspos-001.html
+               fast/block/float/previous-sibling-abspos-002.html
+               fast/block/float/previous-sibling-float-001.html
+               fast/block/float/previous-sibling-float-002.html
+               fast/css/clear-float-sibling.html
+
+        Parent blocks keep a list of child floats that extend out of the parent block and
+        by implication overhang into the parent's siblings. But this doesn't work if the
+        sibling has collapsing margins - it will not find the float in the previous block's
+        list so will ignore the float and fail to clear it.
+
+        RenderBlock:collapseMargins() needs to check if a child's collapsing margin has 
+        reduced the height of the parent up past the bottom of its previous sibling's lowest float
+        and add the now overhanging float to the parent's float list if appropriate. No need to do
+        this if the previous sibling is a float or is positioned - the child will clear/avoid it anyway
+        and attempting to avoid floated children of floats causes incorrect layout.
+        
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+
+2012-06-20  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: Allow module injections into the InjectedScript
+        https://bugs.webkit.org/show_bug.cgi?id=89530
+
+        Add a new InjectedScriptModule abstract class that inherits InjectedScriptBase
+        to reuse implementation, and which javascript code is injected via
+        InjectedScript.
+
+        Reviewed by Pavel Feldman.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore):
+        * bindings/js/ScriptObject.h:
+        (ScriptObject):
+        (WebCore::ScriptObject::ScriptObject):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore):
+        * bindings/v8/ScriptObject.h:
+        (ScriptObject):
+        (WebCore::ScriptObject::~ScriptObject):
+        * inspector/InjectedScript.cpp:
+        * inspector/InjectedScript.h:
+        (WebCore):
+        (WebCore::InjectedScript::name):
+        (InjectedScript):
+        * inspector/InjectedScriptBase.cpp:
+        (WebCore::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * inspector/InjectedScriptBase.h:
+        (WebCore):
+        (InjectedScriptBase):
+        * inspector/InjectedScriptManager.h:
+        (InjectedScriptManager):
+        (WebCore::InjectedScriptManager::inspectedStateAccessCheck):
+        * inspector/InjectedScriptModule.cpp: Copied from Source/WebCore/inspector/InjectedScriptBase.h.
+        (WebCore):
+        (WebCore::InjectedScriptModule::InjectedScriptModule):
+        (WebCore::InjectedScriptModule::ensureInjected):
+        * inspector/InjectedScriptModule.h: Copied from Source/WebCore/bindings/js/ScriptObject.h.
+        (WebCore):
+        (InjectedScriptModule):
+        * inspector/InjectedScriptSource.js:
+        (.):
+
+2012-06-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: Timeline label bar jiggles when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=89579
+
+        Reviewed by Vsevolod Vlasov.
+
+        Adding timeline header into the timeline panel and settings its position
+        to absolute. Drive-by fix that updates rulers on sidebar resize.
+
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid):
+        (WebInspector.TimelineGrid.prototype.get gridHeaderElement):
+        (WebInspector.TimelineGrid.prototype.addEventDividers):
+        (WebInspector.TimelineGrid.prototype.setScrollAndDividerTop):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype.onResize):
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-grid-header):
+
+2012-06-20  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Make sure that render surfaces are not pixel doubled with a device scale factor of 2
+        https://bugs.webkit.org/show_bug.cgi?id=86882
+
+        Reviewed by Adrienne Walker.
+
+        To ensure that render surfaces are not pixel doubled when device scale factor is
+        two, the render surface's owning layer's draw transform is scaled by the
+        contents scale (in the same way that the parent matrix is scaled by the device
+        scale factor). The transformedLayerRect's dimensions also need to be in pixel
+        space. The surface origin transform should not scale, but needs to offset the
+        correct number of pixels, and the replica transforms need to be modified to
+        account for the scaling.
+
+        To accomplish this, CCLayerImpl's needed to be made aware of contentsScale.
+
+        Thanks to Adrienne Walker for the computation of the replica draw transform.
+
+        Unit test: CCLayerTreeHostCommonTest.verifyRenderSurfaceTranformsInHighDPI
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setContentsScale):
+        (WebCore::CCLayerImpl::contentsScale):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateDrawTransformsInternal):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+
+2012-06-20  Alexis Menard  <alexis.menard@openbossa.org>
+
+        [CSS3 Backgrounds and Borders] Implement box-decoration-break rendering.
+        https://bugs.webkit.org/show_bug.cgi?id=88228
+
+        Reviewed by Eric Seidel.
+
+        Implement the new CSS property box-decoration-break. It modifies
+        where we decide whether the borders needs to be sliced or not by
+        checking if the box-decoration-break is set to clone. If it's the case
+        then we need to explicitely redraw all edges.
+
+        Test: fast/box-decoration-break/box-decoration-break-rendering.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paintFillLayer):
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use IntSize in RenderLayer to represent scroll offsets
+        https://bugs.webkit.org/show_bug.cgi?id=89154
+
+        Reviewed by Eric Seidel.
+
+        Refactoring, covered by existing tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::scrollTo):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::forwardEvent):
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollInDirection):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        Updated those call-sites to use the IntSize variant of the scrolling function.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+        Updated the signature to use IntPoint to avoid an extra round-trip to LayoutPoint
+        (furthermore touch points should be in device pixels).
+
+        (WebCore::RenderLayer::clampScrollOffset):
+        Added this function that clamps a scroll offset to the box's size. This enables more
+        code sharing between the different functions. Also removed a NULL-check that shouldn't
+        be needed: scrolling is a RenderBox concept so any callers should ensure that we have
+        a RenderBox or it makes no sense to try to scroll.
+
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        Updated to do IntSize arithmetic. Reuse clampScrollOffset when applicable.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrollToXOffset):
+        (WebCore::RenderLayer::scrollToYOffset):
+        Updated the functions to take IntSize as much as possible.
+
+2012-06-20  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: mark used/allocated JS heap on the native memory bar chart.
+        https://bugs.webkit.org/show_bug.cgi?id=89476
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart):
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-bar):
+        (.memory-bar-chart-unused):
+        (.memory-bar-chart-percent):
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Don't close database if pending connections are in flight
+        https://bugs.webkit.org/show_bug.cgi?id=89512
+
+        Add a counter tracking connections between the two phases, which is used along with
+        the completed connection count to determine the total number of connections.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='IDBDatabaseBackendTest.ConnectionLifecycle'
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::connectionCount):
+        (WebCore):
+        (WebCore::IDBDatabaseBackendImpl::processPendingCalls):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        (WebCore::IDBDatabaseBackendImpl::registerFrontendCallbacks):
+        (WebCore::IDBDatabaseBackendImpl::openConnection):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::openInternal):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-20  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: duplicating selected text when Enter key is pressed 
+        https://bugs.webkit.org/show_bug.cgi?id=89559
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype.handleEnterKey):
+        The returned result of method normalize() should be used.
+
+2012-06-20  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [Cairo] Fix memory leak in GraphicsContext3DCairo.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=89561
+
+        Reviewed by Martin Robinson.
+
+        Fix a memory leak in GraphicsContext3D::getImageData().
+
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore::GraphicsContext3D::getImageData): asNewNativeImage() returns a
+        caller-owned pointer to the native image data. So, using OwnPtr to manage
+        memory automatically.
+
+2012-06-20  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Use HitTestPoint instead of LayoutPoint for nodeAtPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=89448
+
+        Reviewed by Eric Seidel.
+
+        This patch updates the API of nodeAtPoint without changing any 
+        functionality. This is largest change necessary to support
+        transforms in area-based hit-testing, but is only boilerplate.
+
+        No change in functionality. No new tests. 
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (EllipsisBox):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestPoint::intersects):
+        (HitTestPoint):
+        (HitTestResult):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nodeAtPoint):
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineFlowBox.h:
+        (InlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        * rendering/InlineTextBox.h:
+        (InlineTextBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::hitTestColumns):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::nodeAtPoint):
+        * rendering/RenderEmbeddedObject.h:
+        (RenderEmbeddedObject):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::hitTestRegion):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderFrameSet.h:
+        (RenderFrameSet):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint):
+        * rendering/RenderImage.h:
+        (RenderImage):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::nodeAtPoint):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::ClipRect::intersects):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::createLocalTransformState):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestContents):
+        (WebCore::RenderLayer::hitTestList):
+        (WebCore::RenderLayer::hitTestPaginatedChildLayer):
+        (WebCore::RenderLayer::hitTestChildLayerColumns):
+        * rendering/RenderLayer.h:
+        (ClipRect):
+        (RenderLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+        (RenderLineBoxList):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::hitTest):
+        (WebCore::RenderObject::nodeAtPoint):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::nodeAtPoint):
+        * rendering/RenderRegion.h:
+        (RenderRegion):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTable.h:
+        (RenderTable):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        * rendering/RenderTableRow.h:
+        (RenderTableRow):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
+        * rendering/RenderText.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlMultiLine.h:
+        (RenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RenderWidget.h:
+        (RenderWidget):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::nodeAtPoint):
+        * rendering/RootInlineBox.h:
+        (RootInlineBox):
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::nodeAtFloatPoint):
+        (WebCore::RenderSVGForeignObject::nodeAtPoint):
+        * rendering/svg/RenderSVGForeignObject.h:
+        (RenderSVGForeignObject):
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::nodeAtPoint):
+        * rendering/svg/RenderSVGModelObject.h:
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/svg/RenderSVGRoot.h:
+        (RenderSVGRoot):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+        (WebCore::RenderSVGText::nodeAtPoint):
+        * rendering/svg/RenderSVGText.h:
+        (RenderSVGText):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::nodeAtPoint):
+        * rendering/svg/SVGInlineTextBox.h:
+        (SVGInlineTextBox):
+
+2012-06-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: don't report context ids before DidCommitLoad
+        https://bugs.webkit.org/show_bug.cgi?id=89567
+
+        Reviewed by Pavel Feldman.
+
+        When inspector state is restored only report existing context ids
+        if "did commit load" even has already been dispatched.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        * inspector/PageRuntimeAgent.cpp:
+        (WebCore::PageRuntimeAgent::PageRuntimeAgent):
+        (WebCore::PageRuntimeAgent::restore):
+        * inspector/PageRuntimeAgent.h:
+        (WebCore):
+        (WebCore::PageRuntimeAgent::create):
+        (PageRuntimeAgent):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Remove redundant #includes in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=89503
+
+        Reviewed by Adrienne Walker.
+
+        Removed some redundant #includes to clarify dependency
+        picture. Some 90 #includes removed, some 50 less disruptive
+        #includes added. This brings the number of class dependencies to
+        902 from 1383.
+
+        No new tests are required, as this is only affects compile-time behavior.
+
+        * platform/graphics/chromium/AnimationTranslationUtil.h:
+        (WebCore):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        * platform/graphics/chromium/ManagedTexture.cpp:
+        * platform/graphics/chromium/ProgramBinding.h:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        * platform/graphics/chromium/TextureCopier.cpp:
+        * platform/graphics/chromium/TextureLayerChromium.cpp:
+        * platform/graphics/chromium/TextureManager.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCActiveAnimation.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp:
+        * platform/graphics/chromium/cc/CCDrawQuad.cpp:
+        * platform/graphics/chromium/cc/CCFontAtlas.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        * platform/graphics/chromium/cc/CCFrameRateController.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerAnimationController.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        * platform/graphics/chromium/cc/CCScopedThreadProxy.h:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTextureLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCTimer.cpp:
+        * platform/graphics/chromium/cc/CCTimer.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+
+2012-06-20  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Implement native memory bar diagram
+        https://bugs.webkit.org/show_bug.cgi?id=89106
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart):
+        (WebInspector.NativeMemoryBarChart.prototype._updateStats):
+        (WebInspector.NativeMemoryBarChart.prototype.willHide):
+        (WebInspector.NativeMemoryBarChart.prototype.wasShown):
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/ProfileLauncherView.js:
+        (WebInspector.ProfileLauncherView):
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/nativeMemoryProfiler.css:
+        (.memory-bar-chart-name):
+        (.memory-bar-chart-bar):
+        (.memory-bar-chart-size):
+        (.memory-bar-chart-total):
+
+2012-06-20  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechRecognition.maxAlternatives attribute
+        https://bugs.webkit.org/show_bug.cgi?id=89459
+
+        Reviewed by Eric Seidel.
+
+        Add the SpeechRecognition.maxAlternatives attribute.
+
+        Test: fast/speech/scripted/basics.html:
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::start):
+        (WebCore::SpeechRecognition::SpeechRecognition):
+        * Modules/speech/SpeechRecognition.h:
+        (WebCore::SpeechRecognition::maxAlternatives):
+        (WebCore::SpeechRecognition::setMaxAlternatives):
+        (SpeechRecognition):
+        * Modules/speech/SpeechRecognition.idl:
+        * Modules/speech/SpeechRecognitionClient.h:
+        (SpeechRecognitionClient):
+        * Modules/speech/SpeechRecognitionController.h:
+        (WebCore::SpeechRecognitionController::start):
+        (SpeechRecognitionController):
+
+2012-06-20  Takashi Sakamoto  <tasak@google.com>
+
+        applyAuthorStyles makes rules declared in all enclosing shadow dom subtrees applicable.
+        https://bugs.webkit.org/show_bug.cgi?id=89061
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing apply-author-styles bug. If there exists some shadow subtree A
+        and A has apply-author-styles flag set, whether some rules declared in
+        a tree B is applicable in A or not depends on:
+        - the tree B encloses the tree A, and
+        - all trees which enclose A and are enclosed by B has
+          apply-author-styles set.
+        c.f.
+        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#styles
+        However the second rule was not implemented.
+
+        Test: fast/css/style-scoped/style-scoped-apply-author-styles.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::setupScopeStack):
+        Modified to add a new member variable, authorStyleBoundsIndex to
+        ScopeStackFrame used by m_scopeStack. The index means: if shadow dom
+        subtree A and B has the same value and A encloses B, all shadow dom
+        subtrees which enclose B and are enclosed by B have
+        apply-author-styles set. And B also has apply-author-styles set.
+        This means, if some element X has authorStyleBoundsIndex N, all
+        rulesets whose scopes have authorStyleBoundsIndex N are applicable in
+        B's tree scope. If all shadow dom subtrees have apply-author-styles
+        unset, the index looks almost the same as treeScope(). In this case,
+        Rules in different tree scopes have different author style bounds
+        index.
+        (WebCore::StyleResolver::pushScope):
+        (WebCore::StyleResolver::popScope):
+        Added the code for updating m_scopeStackParentBoundsIndex. The member
+        variable keeps m_scopeStackParent's author style bounds index.
+        (WebCore::StyleResolver::matchScopedAuthorRules):
+        Modified to consider author style's bounds index. Firstly applying
+        scoped styles declared in document if apply-author-styles is set.
+        Next, applying scoped styles declared in shadow dom subtree with
+        considering author style bounds index, i.e. considering
+        apply-author-styles flag.
+        * css/StyleResolver.h:
+        (WebCore::StyleResolver::ScopeStackFrame::ScopeStackFrame):
+        (ScopeStackFrame):
+        Added m_authorStyleBoundsIndex to keep apply-author-styles flag
+        information. m_authorStyleBoundsIndex increments by 1 if shadow root is
+        given and it has apply-author-styles unset.
+        Now rules in the same authorStyleBoundsIndex should be applied.
+        (StyleResolver):
+        Added m_scopeStackParentBoundsIndex.
+        As m_scopeStackParentAuthorStyleBoundsIndex is a little long,
+        used m_scopeStackParentBoundsIndex.
 
 2012-06-20  Amy Ousterhout  <aousterh@chromium.org>
 
@@ -24968,7 +30582,7 @@
 
         The ImageGStreamerCG abstraction is being removed until I manage to
         port my gst-mac WebKit branch over to the WebKit2 mac port. No
-        need to update the XCode project because this file is not
+        need to update the Xcode project because this file is not
         referenced there anyway.
 
         Reviewed by Martin Robinson.
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 0ca351439..b1b84966d 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -41,6 +41,7 @@ ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_VARIABLES = ;
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 3589c0b9d..03f4004fa 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -991,10 +991,10 @@ all : InjectedScriptSource.h
 InjectedScriptSource.h : InjectedScriptSource.js
 	perl $(WebCore)/inspector/xxd.pl InjectedScriptSource_js $(WebCore)/inspector/InjectedScriptSource.js InjectedScriptSource.h
 
-all : InjectedWebGLScriptSource.h
+all : InjectedScriptWebGLModuleSource.h
 
-InjectedWebGLScriptSource.h : InjectedWebGLScriptSource.js
-	perl $(WebCore)/inspector/xxd.pl InjectedWebGLScriptSource_js $(WebCore)/inspector/InjectedWebGLScriptSource.js InjectedWebGLScriptSource.h
+InjectedScriptWebGLModuleSource.h : InjectedScriptWebGLModuleSource.js
+	perl $(WebCore)/inspector/xxd.pl InjectedScriptWebGLModuleSource_js $(WebCore)/inspector/InjectedScriptWebGLModuleSource.js InjectedScriptWebGLModuleSource.h
 
 -include $(JS_DOM_HEADERS:.h=.dep)
 
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 9b54c7e43..48ed8016d 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -61,7 +61,7 @@ INSPECTOR_BACKEND_COMMANDS_QRC = $$PWD/inspector/front-end/InspectorBackendComma
 
 INJECTED_SCRIPT_SOURCE = $$PWD/inspector/InjectedScriptSource.js
 
-INJECTED_WEBGL_SCRIPT_SOURCE = $$PWD/inspector/InjectedWebGLScriptSource.js
+INJECTED_SCRIPT_WEBGL_MODULE_SOURCE = $$PWD/inspector/InjectedScriptWebGLModuleSource.js
 
 DEBUGGER_SCRIPT_SOURCE = $$PWD/bindings/v8/DebuggerScript.js
 
@@ -425,6 +425,7 @@ IDL_BINDINGS += \
     $$PWD/page/PerformanceEntry.idl \
     $$PWD/page/PerformanceEntryList.idl \
     $$PWD/page/PerformanceNavigation.idl \
+    $$PWD/page/PerformanceResourceTiming.idl \
     $$PWD/page/PerformanceTiming.idl \
     $$PWD/page/Screen.idl \
     $$PWD/page/SpeechInputEvent.idl \
@@ -778,11 +779,11 @@ injectedScriptSource.add_output_to_sources = false
 GENERATORS += injectedScriptSource
 
 # GENERATOR 2-b: inspector webgl injected script source compiler
-InjectedWebGLScriptSource.output = InjectedWebGLScriptSource.h
-InjectedWebGLScriptSource.input = INJECTED_WEBGL_SCRIPT_SOURCE
-InjectedWebGLScriptSource.commands = perl $$PWD/inspector/xxd.pl InjectedWebGLScriptSource_js ${QMAKE_FILE_IN} ${QMAKE_FILE_OUT}
-InjectedWebGLScriptSource.add_output_to_sources = false
-GENERATORS += InjectedWebGLScriptSource
+InjectedScriptWebGLModuleSource.output = InjectedScriptWebGLModuleSource.h
+InjectedScriptWebGLModuleSource.input = INJECTED_SCRIPT_WEBGL_MODULE_SOURCE
+InjectedScriptWebGLModuleSource.commands = perl $$PWD/inspector/xxd.pl InjectedScriptWebGLModuleSource_js ${QMAKE_FILE_IN} ${QMAKE_FILE_OUT}
+InjectedScriptWebGLModuleSource.add_output_to_sources = false
+GENERATORS += InjectedScriptWebGLModuleSource
 
 # GENERATOR 2-c: inspector debugger script source compiler
 debuggerScriptSource.output = DebuggerScriptSource.h
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index f4d2e3ac9..fafa4ef9b 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
@@ -543,6 +543,7 @@ localizedStrings["property"] = "property";
 localizedStrings["Object types:"] = "Object types:";
 localizedStrings["%s() at %s"] = "%s() at %s";
 localizedStrings["Copy Stack Trace"] = "Copy Stack Trace";
+localizedStrings["Restart Frame"] = "Restart Frame";
 localizedStrings["Collect Garbage"] = "Collect Garbage";
 localizedStrings["JSON"] = "JSON";
 localizedStrings["Catch"] = "Catch";
@@ -701,3 +702,4 @@ localizedStrings["Local modifications..."] = "Local modifications...";
 localizedStrings["apply original content"] = "apply original content";
 localizedStrings["apply revision content"] = "apply revision content";
 localizedStrings["revert"] = "revert";
+localizedStrings["CPU Time"] = "CPU Time";
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 131918067..f3280772c 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -155,6 +155,14 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/graphics/pango
 endif # END USE_PANGO
 
+# ---
+# Windows plugin support
+# ---
+if TARGET_WIN32
+webcoregtk_cppflags += \
+	-I$(srcdir)/Source/WebCore/platform/graphics/win
+endif # END TARGET_WIN32
+
 # ----
 # HTML Details Element
 # ----
@@ -838,8 +846,8 @@ DerivedSources/WebCore/InspectorBackendCommands.js: DerivedSources/WebCore/Inspe
 DerivedSources/WebCore/InspectorBackendDispatcher.h: DerivedSources/WebCore/InspectorBackendDispatcher.cpp
 DerivedSources/WebCore/InjectedScriptSource.h: $(WebCore)/inspector/InjectedScriptSource.js
 	$(AM_V_GEN)$(PERL) $(WebCore)/inspector/xxd.pl InjectedScriptSource_js $(WebCore)/inspector/InjectedScriptSource.js $(GENSOURCES_WEBCORE)/InjectedScriptSource.h
-DerivedSources/WebCore/InjectedWebGLScriptSource.h: $(WebCore)/inspector/InjectedWebGLScriptSource.js
-	$(AM_V_GEN)$(PERL) $(WebCore)/inspector/xxd.pl InjectedWebGLScriptSource_js $(WebCore)/inspector/InjectedWebGLScriptSource.js $(GENSOURCES_WEBCORE)/InjectedWebGLScriptSource.h
+DerivedSources/WebCore/InjectedScriptWebGLModuleSource.h: $(WebCore)/inspector/InjectedScriptWebGLModuleSource.js
+	$(AM_V_GEN)$(PERL) $(WebCore)/inspector/xxd.pl InjectedScriptWebGLModuleSource_js $(WebCore)/inspector/InjectedScriptWebGLModuleSource.js $(GENSOURCES_WEBCORE)/InjectedScriptWebGLModuleSource.h
 
 if ENABLE_WEB_AUDIO
 # Installing HRTF database wav files
@@ -965,6 +973,11 @@ libWebCore_la_CPPFLAGS = \
 	$(XRENDER_CFLAGS) \
 	$(XT_CFLAGS)
 
+if TARGET_WIN32
+# PluginPackageWin.cpp needs the symbols from version dll
+libWebCore_la_LIBADD = -lversion
+endif
+
 libWebCoreModules_la_SOURCES = \
 	$(webcore_modules_sources)
 
@@ -1091,7 +1104,7 @@ EXTRA_DIST += \
 	Source/WebCore/icu/LICENSE \
 	Source/WebCore/inspector/CodeGeneratorInspector.py \
 	Source/WebCore/inspector/InjectedScriptSource.js \
-	Source/WebCore/inspector/InjectedWebGLScriptSource.js \
+	Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js \
 	Source/WebCore/inspector/Inspector.json \
 	Source/WebCore/inspector/Inspector-1.0.json \
 	Source/WebCore/inspector/generate-inspector-protocol-version \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index 202f5ea37..9872e002e 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -20,7 +20,7 @@ webcore_built_sources += \
 	DerivedSources/WebCore/HTMLNames.cpp \
 	DerivedSources/WebCore/HTMLNames.h \
 	DerivedSources/WebCore/InjectedScriptSource.h \
-	DerivedSources/WebCore/InjectedWebGLScriptSource.h \
+	DerivedSources/WebCore/InjectedScriptWebGLModuleSource.h \
 	DerivedSources/WebCore/InspectorBackendDispatcher.cpp \
 	DerivedSources/WebCore/InspectorBackendDispatcher.h \
 	DerivedSources/WebCore/InspectorFrontend.cpp \
@@ -957,6 +957,7 @@ dom_binding_idls += \
 	$(WebCore)/page/PerformanceEntry.idl \
 	$(WebCore)/page/PerformanceEntryList.idl \
 	$(WebCore)/page/PerformanceNavigation.idl \
+	$(WebCore)/page/PerformanceResourceTiming.idl \
 	$(WebCore)/page/PerformanceTiming.idl \
 	$(WebCore)/page/Screen.idl \
 	$(WebCore)/page/SpeechInputEvent.idl \
@@ -1823,10 +1824,10 @@ webcore_sources += \
 	Source/WebCore/dom/DeviceOrientationClient.h \
 	Source/WebCore/dom/DeviceOrientationController.cpp \
 	Source/WebCore/dom/DeviceOrientationController.h \
-	Source/WebCore/dom/DeviceOrientation.cpp \
+	Source/WebCore/dom/DeviceOrientationData.cpp \
+	Source/WebCore/dom/DeviceOrientationData.h \
 	Source/WebCore/dom/DeviceOrientationEvent.cpp \
 	Source/WebCore/dom/DeviceOrientationEvent.h \
-	Source/WebCore/dom/DeviceOrientation.h \
 	Source/WebCore/dom/Document.cpp \
 	Source/WebCore/dom/DocumentFragment.cpp \
 	Source/WebCore/dom/DocumentFragment.h \
@@ -1906,6 +1907,7 @@ webcore_sources += \
 	Source/WebCore/dom/HashChangeEvent.h \
 	Source/WebCore/dom/KeyboardEvent.cpp \
 	Source/WebCore/dom/KeyboardEvent.h \
+	Source/WebCore/dom/MemoryInstrumentation.h \
 	Source/WebCore/dom/MessageChannel.cpp \
 	Source/WebCore/dom/MessageChannel.h \
 	Source/WebCore/dom/MessageEvent.cpp \
@@ -2640,6 +2642,7 @@ webcore_sources += \
 	Source/WebCore/icu/unicode/utf_old.h \
 	Source/WebCore/icu/unicode/utypes.h \
 	Source/WebCore/icu/unicode/uversion.h \
+	Source/WebCore/inspector/BindingVisitors.h \
 	Source/WebCore/inspector/ConsoleMessage.cpp \
 	Source/WebCore/inspector/ConsoleMessage.h \
 	Source/WebCore/inspector/ContentSearchUtils.cpp \
@@ -2650,7 +2653,6 @@ webcore_sources += \
 	Source/WebCore/inspector/DOMNodeHighlighter.h \
 	Source/WebCore/inspector/DOMPatchSupport.cpp \
 	Source/WebCore/inspector/DOMPatchSupport.h \
-	Source/WebCore/inspector/DOMWrapperVisitor.h \
 	Source/WebCore/inspector/IdentifiersFactory.cpp \
 	Source/WebCore/inspector/IdentifiersFactory.h \
 	Source/WebCore/inspector/InjectedScript.cpp \
@@ -2661,6 +2663,10 @@ webcore_sources += \
 	Source/WebCore/inspector/InjectedScriptHost.h \
 	Source/WebCore/inspector/InjectedScriptManager.cpp \
 	Source/WebCore/inspector/InjectedScriptManager.h \
+	Source/WebCore/inspector/InjectedScriptModule.cpp \
+	Source/WebCore/inspector/InjectedScriptModule.h \
+	Source/WebCore/inspector/InjectedScriptWebGLModule.cpp \
+	Source/WebCore/inspector/InjectedScriptWebGLModule.h \
 	Source/WebCore/inspector/InspectorAgent.cpp \
 	Source/WebCore/inspector/InspectorAgent.h \
 	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
@@ -3038,6 +3044,8 @@ webcore_sources += \
 	Source/WebCore/page/PerformanceEntryList.h \
 	Source/WebCore/page/PerformanceNavigation.cpp \
 	Source/WebCore/page/PerformanceNavigation.h \
+	Source/WebCore/page/PerformanceResourceTiming.cpp \
+	Source/WebCore/page/PerformanceResourceTiming.h \
 	Source/WebCore/page/PerformanceTiming.cpp \
 	Source/WebCore/page/PerformanceTiming.h \
 	Source/WebCore/page/PointerLock.h \
@@ -3195,8 +3203,8 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/CustomFilterParameter.h \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp \
 	Source/WebCore/platform/graphics/filters/CustomFilterProgram.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterShader.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h \
 	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
 	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
@@ -3835,6 +3843,8 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderFrameSet.h \
 	Source/WebCore/rendering/RenderFullScreen.cpp \
 	Source/WebCore/rendering/RenderFullScreen.h \
+	Source/WebCore/rendering/RenderGrid.cpp \
+	Source/WebCore/rendering/RenderGrid.h \
 	Source/WebCore/rendering/RenderGeometryMap.cpp \
 	Source/WebCore/rendering/RenderGeometryMap.h \
 	Source/WebCore/rendering/RenderHTMLCanvas.cpp \
@@ -4814,9 +4824,7 @@ webcoregtk_sources += \
 	Source/WebCore/platform/gtk/SoundGtk.cpp \
 	Source/WebCore/platform/gtk/WidgetGtk.cpp \
 	Source/WebCore/platform/gtk/WidgetRenderingContext.cpp \
-	Source/WebCore/platform/gtk/WidgetRenderingContext.h \
-	Source/WebCore/plugins/gtk/PluginPackageGtk.cpp \
-	Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+	Source/WebCore/platform/gtk/WidgetRenderingContext.h
 
 if TARGET_X11
 webcoregtk_sources += \
@@ -4827,19 +4835,36 @@ webcoregtk_sources += \
 	Source/WebCore/platform/gtk/GtkWidgetBackingStoreX11.cpp \
 	Source/WebCore/plugins/gtk/gtk2xtbin.c \
 	Source/WebCore/plugins/gtk/gtk2xtbin.h \
+	Source/WebCore/plugins/gtk/PluginPackageGtk.cpp \
+	Source/WebCore/plugins/gtk/PluginViewGtk.cpp \
 	Source/WebCore/plugins/gtk/xembed.h
-endif
-
+else
 if TARGET_WIN32
 webcore_sources += \
+	Source/WebCore/platform/graphics/win/DIBPixelData.cpp \
+	Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp \
+	Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp \
+	Source/WebCore/platform/graphics/win/LocalWindowsContext.h \
+	Source/WebCore/platform/graphics/win/TransformationMatrixWin.cpp \
+	Source/WebCore/platform/win/BitmapInfo.cpp \
+	Source/WebCore/platform/win/BitmapInfo.h \
 	Source/WebCore/platform/win/SystemInfo.cpp \
 	Source/WebCore/platform/win/SystemInfo.h \
+	Source/WebCore/platform/win/WebCoreInstanceHandle.cpp \
+	Source/WebCore/platform/win/WebCoreInstanceHandle.h \
 	Source/WebCore/plugins/win/PluginDatabaseWin.cpp \
 	Source/WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
-	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h
+	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h \
+	Source/WebCore/plugins/win/PluginPackageWin.cpp
 webcoregtk_sources += \
-	Source/WebCore/platform/cairo/WidgetBackingStoreCairo.cpp
-endif
+	Source/WebCore/platform/cairo/WidgetBackingStoreCairo.cpp \
+	Source/WebCore/plugins/win/PluginViewWin.cpp
+else
+webcore_sources += \
+	Source/WebCore/plugins/PluginPackageNone.cpp \
+	Source/WebCore/plugins/PluginViewNone.cpp
+endif # END TARGET_WIN32
+endif # END TARGET_X11
 
 # ----
 # icu unicode backend
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index 8d218ee85..2759514ef 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -183,7 +183,7 @@ void IDBCursor::advance(unsigned long count, ExceptionCode& ec)
 void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBCursor::continue");
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    if (key && !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return;
     }
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
index f548c6aa0..b6246e919 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
@@ -171,7 +171,10 @@ void IDBCursorBackendImpl::deleteFunction(PassRefPtr<IDBCallbacks> prpCallbacks,
         return;
     }
 
-    m_objectStore->deleteFunction(m_cursor->primaryKey(), prpCallbacks, m_transaction.get(), ec);
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(m_cursor->primaryKey(), ec);
+    ASSERT(!ec);
+
+    m_objectStore->deleteFunction(keyRange.release(), prpCallbacks, m_transaction.get(), ec);
 }
 
 void IDBCursorBackendImpl::prefetchContinue(int numberToFetch, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
index 2008ed8b4..0a49400bb 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
@@ -64,6 +64,7 @@ IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabase
     // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
     m_databaseCallbacks = IDBDatabaseCallbacksImpl::create(this);
+    m_metadata = m_backend->metadata();
 }
 
 IDBDatabase::~IDBDatabase()
@@ -81,6 +82,7 @@ void IDBDatabase::transactionCreated(IDBTransaction* transaction)
     if (transaction->isVersionChange()) {
         ASSERT(!m_versionChangeTransaction);
         m_versionChangeTransaction = transaction;
+        m_metadata = m_backend->metadata();
     }
 }
 
@@ -93,12 +95,22 @@ void IDBDatabase::transactionFinished(IDBTransaction* transaction)
     if (transaction->isVersionChange()) {
         ASSERT(m_versionChangeTransaction == transaction);
         m_versionChangeTransaction = 0;
+        m_metadata = m_backend->metadata();
     }
 
     if (m_closePending && m_transactions.isEmpty())
         closeConnection();
 }
 
+PassRefPtr<DOMStringList> IDBDatabase::objectStoreNames() const
+{
+    RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
+    for (IDBDatabaseMetadata::ObjectStoreMap::const_iterator it = m_metadata.objectStores.begin(); it != m_metadata.objectStores.end(); ++it)
+        objectStoreNames->append(it->first);
+    objectStoreNames->sort();
+    return objectStoreNames.release();
+}
+
 PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, const Dictionary& options, ExceptionCode& ec)
 {
     if (!m_versionChangeTransaction) {
@@ -136,7 +148,10 @@ PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, co
         return 0;
     }
 
-    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(objectStoreBackend.release(), m_versionChangeTransaction.get());
+    IDBObjectStoreMetadata metadata(name, keyPath, autoIncrement);
+    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(metadata, objectStoreBackend.release(), m_versionChangeTransaction.get());
+    m_metadata.objectStores.set(name, metadata);
+
     m_versionChangeTransaction->objectStoreCreated(name, objectStore);
     return objectStore.release();
 }
@@ -149,8 +164,10 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
     }
 
     m_backend->deleteObjectStore(name, m_versionChangeTransaction->backend(), ec);
-    if (!ec)
+    if (!ec) {
         m_versionChangeTransaction->objectStoreDeleted(name);
+        m_metadata.objectStores.remove(name);
+    }
 }
 
 PassRefPtr<IDBVersionChangeRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabase.h b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
index adad32d86..a248cd80d 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
@@ -33,6 +33,7 @@
 #include "EventTarget.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseCallbacksImpl.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStore.h"
 #include "IDBTransaction.h"
 #include <wtf/PassRefPtr.h>
@@ -57,9 +58,9 @@ public:
     void transactionFinished(IDBTransaction*);
 
     // Implement the IDL
-    String name() const { return m_backend->name(); }
-    String version() const { return m_backend->version(); }
-    PassRefPtr<DOMStringList> objectStoreNames() const { return m_backend->objectStoreNames(); }
+    const String name() const { return m_metadata.name; }
+    const String version() const { return m_metadata.version; }
+    PassRefPtr<DOMStringList> objectStoreNames() const;
 
     // FIXME: Try to modify the code generator so this is unneeded.
     PassRefPtr<IDBObjectStore> createObjectStore(const String& name, ExceptionCode& ec) { return createObjectStore(name, Dictionary(), ec); }
@@ -87,6 +88,7 @@ public:
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
     void registerFrontendCallbacks();
+    const IDBDatabaseMetadata metadata() const { return m_metadata; }
     void enqueueEvent(PassRefPtr<Event>);
     bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
     virtual bool dispatchEvent(PassRefPtr<Event>);
@@ -105,6 +107,7 @@ private:
 
     void closeConnection();
 
+    IDBDatabaseMetadata m_metadata;
     RefPtr<IDBDatabaseBackendInterface> m_backend;
     RefPtr<IDBTransaction> m_versionChangeTransaction;
     HashSet<IDBTransaction*> m_transactions;
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index 12f29025a..b636d80a6 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -109,6 +109,7 @@ IDBDatabaseBackendImpl::IDBDatabaseBackendImpl(const String& name, IDBBackingSto
     , m_identifier(uniqueIdentifier)
     , m_factory(factory)
     , m_transactionCoordinator(coordinator)
+    , m_pendingConnectionCount(0)
 {
     ASSERT(!m_name.isNull());
 }
@@ -133,6 +134,14 @@ PassRefPtr<IDBBackingStore> IDBDatabaseBackendImpl::backingStore() const
     return m_backingStore;
 }
 
+IDBDatabaseMetadata IDBDatabaseBackendImpl::metadata() const
+{
+    IDBDatabaseMetadata metadata(m_name, m_version);
+    for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it)
+        metadata.objectStores.set(it->first, it->second->metadata());
+    return metadata;
+}
+
 PassRefPtr<DOMStringList> IDBDatabaseBackendImpl::objectStoreNames() const
 {
     RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
@@ -222,7 +231,7 @@ void IDBDatabaseBackendImpl::setVersion(const String& version, PassRefPtr<IDBCal
     // FIXME: Only fire onBlocked if there are open connections after the
     // VersionChangeEvents are received, not just set up to fire.
     // https://bugs.webkit.org/show_bug.cgi?id=71130
-    if (m_databaseCallbacksSet.size() > 1) {
+    if (connectionCount() > 1) {
         callbacks->onBlocked();
         RefPtr<PendingSetVersionCall> pendingSetVersionCall = PendingSetVersionCall::create(version, callbacks, databaseCallbacks);
         m_pendingSetVersionCalls.append(pendingSetVersionCall);
@@ -278,9 +287,14 @@ void IDBDatabaseBackendImpl::transactionFinished(PassRefPtr<IDBTransactionBacken
     }
 }
 
+int32_t IDBDatabaseBackendImpl::connectionCount()
+{
+    return m_databaseCallbacksSet.size() + m_pendingConnectionCount;
+}
+
 void IDBDatabaseBackendImpl::processPendingCalls()
 {
-    ASSERT(m_databaseCallbacksSet.size() <= 1);
+    ASSERT(connectionCount() <= 1);
 
     // Pending calls may be requeued or aborted
     Deque<RefPtr<PendingSetVersionCall> > pendingSetVersionCalls;
@@ -345,18 +359,24 @@ PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(D
 
 void IDBDatabaseBackendImpl::registerFrontendCallbacks(PassRefPtr<IDBDatabaseCallbacks> callbacks)
 {
+    ASSERT(m_backingStore.get());
+    ASSERT(m_pendingConnectionCount);
+    --m_pendingConnectionCount;
     m_databaseCallbacksSet.add(RefPtr<IDBDatabaseCallbacks>(callbacks));
 }
 
 void IDBDatabaseBackendImpl::openConnection(PassRefPtr<IDBCallbacks> callbacks)
 {
+    ASSERT(m_backingStore.get());
     if (!m_pendingDeleteCalls.isEmpty() || m_runningVersionChangeTransaction || !m_pendingSetVersionCalls.isEmpty())
         m_pendingOpenCalls.append(PendingOpenCall::create(callbacks));
     else {
         if (m_id == InvalidId && !openInternal())
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
-        else
+        else {
+            ++m_pendingConnectionCount;
             callbacks->onSuccess(this);
+        }
     }
 }
 
@@ -395,12 +415,12 @@ void IDBDatabaseBackendImpl::close(PassRefPtr<IDBDatabaseCallbacks> prpCallbacks
     RefPtr<IDBDatabaseCallbacks> callbacks = prpCallbacks;
     ASSERT(m_databaseCallbacksSet.contains(callbacks));
     m_databaseCallbacksSet.remove(callbacks);
-    if (m_databaseCallbacksSet.size() > 1)
+    if (connectionCount() > 1)
         return;
 
     processPendingCalls();
 
-    if (!m_databaseCallbacksSet.size()) {
+    if (!connectionCount()) {
         TransactionSet transactions(m_transactions);
         for (TransactionSet::const_iterator it = transactions.begin(); it != transactions.end(); ++it)
             (*it)->abort();
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index cfbca3b63..36eb241fe 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
@@ -58,6 +58,7 @@ public:
     void openConnection(PassRefPtr<IDBCallbacks>);
     void deleteDatabase(PassRefPtr<IDBCallbacks>);
 
+    virtual IDBDatabaseMetadata metadata() const;
     virtual String name() const { return m_name; }
     virtual String version() const { return m_version; }
     virtual PassRefPtr<DOMStringList> objectStoreNames() const;
@@ -78,6 +79,7 @@ private:
 
     bool openInternal();
     void loadObjectStores();
+    int32_t connectionCount();
     void processPendingCalls();
 
     static void createObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
@@ -116,6 +118,10 @@ private:
     class PendingDeleteCall;
     Deque<RefPtr<PendingDeleteCall> > m_pendingDeleteCalls;
 
+    // FIXME: Eliminate the limbo state between openConnection() and registerFrontendCallbacks()
+    // that this counter tracks.
+    int32_t m_pendingConnectionCount;
+
     typedef ListHashSet<RefPtr<IDBDatabaseCallbacks> > DatabaseCallbacksSet;
     DatabaseCallbacksSet m_databaseCallbacksSet;
 };
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
index 424807474..d581777f9 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
@@ -41,6 +41,7 @@ class IDBDatabaseCallbacks;
 class IDBKeyPath;
 class IDBObjectStoreBackendInterface;
 class IDBTransactionBackendInterface;
+struct IDBDatabaseMetadata;
 
 typedef int ExceptionCode;
 
@@ -52,6 +53,7 @@ class IDBDatabaseBackendInterface : public ThreadSafeRefCounted<IDBDatabaseBacke
 public:
     virtual ~IDBDatabaseBackendInterface() { }
 
+    virtual IDBDatabaseMetadata metadata() const = 0;
     virtual String name() const = 0;
     virtual String version() const = 0;
     virtual PassRefPtr<DOMStringList> objectStoreNames() const = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
index 18116f5a3..d3de8f6fa 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
@@ -133,7 +133,7 @@ short IDBFactory::cmp(PassRefPtr<IDBKey> first, PassRefPtr<IDBKey> second, Excep
     ASSERT(first);
     ASSERT(second);
 
-    if (first->type() == IDBKey::InvalidType || second->type() == IDBKey::InvalidType) {
+    if (!first->isValid() || !second->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }    
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
index 608b7c3fa..447ba7751 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
@@ -182,8 +182,8 @@ void IDBFactoryBackendImpl::openInternal(const String& name, IDBCallbacks* callb
 
     RefPtr<IDBDatabaseBackendImpl> databaseBackend = IDBDatabaseBackendImpl::create(name, backingStore.get(), m_transactionCoordinator.get(), this, uniqueIdentifier);
     if (databaseBackend) {
-        callbacks->onSuccess(RefPtr<IDBDatabaseBackendInterface>(databaseBackend.get()).release());
         m_databaseBackendMap.set(uniqueIdentifier, databaseBackend.get());
+        databaseBackend->openConnection(callbacks);
     } else
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndex.cpp b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
index d6d7622bb..31e7f5d4e 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
@@ -42,8 +42,9 @@ namespace WebCore {
 
 static const unsigned short defaultDirection = IDBCursor::NEXT;
 
-IDBIndex::IDBIndex(PassRefPtr<IDBIndexBackendInterface> backend, IDBObjectStore* objectStore, IDBTransaction* transaction)
-    : m_backend(backend)
+IDBIndex::IDBIndex(const IDBIndexMetadata& metadata, PassRefPtr<IDBIndexBackendInterface> backend, IDBObjectStore* objectStore, IDBTransaction* transaction)
+    : m_metadata(metadata)
+    , m_backend(backend)
     , m_objectStore(objectStore)
     , m_transaction(transaction)
     , m_deleted(false)
@@ -186,19 +187,9 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
 PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBIndex::get");
-    if (m_deleted) {
-        ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
-        return 0;
-    }
-    if (key && (key->type() == IDBKey::InvalidType)) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return 0;
-    }
-
     RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
     if (ec)
         return 0;
-
     return get(context, keyRange.release(), ec);
 }
 
@@ -226,15 +217,6 @@ PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr
 PassRefPtr<IDBRequest> IDBIndex::getKey(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBIndex::getKey");
-    if (m_deleted) {
-        ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
-        return 0;
-    }
-    if (key && (key->type() == IDBKey::InvalidType)) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return 0;
-    }
-
     RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
     if (ec)
         return 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndex.h b/Source/WebCore/Modules/indexeddb/IDBIndex.h
index c7e5f78cf..8201d5d33 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndex.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.h
@@ -30,6 +30,8 @@
 #include "IDBIndexBackendInterface.h"
 #include "IDBKeyPath.h"
 #include "IDBKeyRange.h"
+#include "IDBMetadata.h"
+#include "IDBObjectStore.h"
 #include "IDBRequest.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
@@ -42,18 +44,18 @@ class IDBObjectStore;
 
 class IDBIndex : public RefCounted<IDBIndex> {
 public:
-    static PassRefPtr<IDBIndex> create(PassRefPtr<IDBIndexBackendInterface> backend, IDBObjectStore* objectStore, IDBTransaction* transaction)
+    static PassRefPtr<IDBIndex> create(const IDBIndexMetadata& metadata, PassRefPtr<IDBIndexBackendInterface> backend, IDBObjectStore* objectStore, IDBTransaction* transaction)
     {
-        return adoptRef(new IDBIndex(backend, objectStore, transaction));
+        return adoptRef(new IDBIndex(metadata, backend, objectStore, transaction));
     }
     ~IDBIndex();
 
     // Implement the IDL
-    String name() const { return m_backend->name(); }
-    IDBObjectStore* objectStore() const { return m_objectStore.get(); }
-    PassRefPtr<IDBAny> keyPath() const { return m_backend->keyPath(); }
-    bool unique() const { return m_backend->unique(); }
-    bool multiEntry() const { return m_backend->multiEntry(); }
+    const String name() const { return m_metadata.name; }
+    PassRefPtr<IDBObjectStore> objectStore() const { return m_objectStore; }
+    PassRefPtr<IDBAny> keyPath() const { return m_metadata.keyPath; }
+    bool unique() const { return m_metadata.unique; }
+    bool multiEntry() const { return m_metadata.multiEntry; }
 
     // FIXME: Try to modify the code generator so this is unneeded.
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, static_cast<IDBKeyRange*>(0), ec); }
@@ -83,8 +85,9 @@ public:
     void markDeleted() { m_deleted = true; }
 
 private:
-    IDBIndex(PassRefPtr<IDBIndexBackendInterface>, IDBObjectStore*, IDBTransaction*);
+    IDBIndex(const IDBIndexMetadata&, PassRefPtr<IDBIndexBackendInterface>, IDBObjectStore*, IDBTransaction*);
 
+    IDBIndexMetadata m_metadata;
     RefPtr<IDBIndexBackendInterface> m_backend;
     RefPtr<IDBObjectStore> m_objectStore;
     RefPtr<IDBTransaction> m_transaction;
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index 98614dfb3..a087e6aaf 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
@@ -36,6 +36,7 @@
 #include "IDBDatabaseException.h"
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStoreBackendImpl.h"
 #include "IDBTracing.h"
 
@@ -67,6 +68,11 @@ IDBIndexBackendImpl::~IDBIndexBackendImpl()
 {
 }
 
+IDBIndexMetadata IDBIndexBackendImpl::metadata() const
+{
+    return IDBIndexMetadata(m_name, m_keyPath, m_unique, m_multiEntry);
+}
+
 void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, unsigned short untypedDirection, IDBCursorBackendInterface::CursorType cursorType, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     IDB_TRACE("IDBIndexBackendImpl::openCursorInternal");
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
index d8b197d17..6410cbac3 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
@@ -32,6 +32,7 @@
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBIndexBackendInterface.h"
 #include "IDBKeyPath.h"
+#include "IDBMetadata.h"
 
 namespace WebCore {
 
@@ -63,6 +64,7 @@ public:
     bool addingKeyAllowed(const IDBKey* indexKey, const IDBKey* primaryKey = 0);
 
     // Implements IDBIndexBackendInterface.
+    virtual IDBIndexMetadata metadata() const;
     virtual String name() { return m_name; }
     virtual IDBKeyPath keyPath() { return m_keyPath; }
     virtual bool unique() { return m_unique; }
diff --git a/Source/WebCore/Modules/indexeddb/IDBKey.cpp b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
index 598686e1a..b76ed2cee 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKey.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
@@ -40,6 +40,21 @@ IDBKey::~IDBKey()
 {
 }
 
+bool IDBKey::isValid() const
+{
+    if (m_type == InvalidType)
+        return false;
+
+    if (m_type == ArrayType) {
+        for (size_t i = 0; i < m_array.size(); i++) {
+            if (!m_array[i]->isValid())
+                return false;
+        }
+    }
+
+    return true;
+}
+
 int IDBKey::compare(const IDBKey* other) const
 {
     ASSERT(other);
diff --git a/Source/WebCore/Modules/indexeddb/IDBKey.h b/Source/WebCore/Modules/indexeddb/IDBKey.h
index 40ce833f9..cbfdf1d4f 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKey.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.h
@@ -73,6 +73,32 @@ public:
         return idbKey.release();
     }
 
+    static PassRefPtr<IDBKey> createMultiEntryArray(const KeyArray& array)
+    {
+        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
+        idbKey->m_type = ArrayType;
+        KeyArray& result = idbKey->m_array;
+
+        for (size_t i = 0; i < array.size(); i++) {
+            if (!array[i]->isValid())
+                continue;
+
+            bool skip = false;
+            for (size_t j = 0; j < result.size(); j++) {
+                if (array[i]->isEqual(result[j].get())) {
+                    skip = true;
+                    break;
+                }
+            }
+            if (!skip) {
+                result.append(array[i]);
+                idbKey->m_sizeEstimate += array[i]->m_sizeEstimate;
+            }
+        }
+        ASSERT(idbKey->isValid());
+        return idbKey.release();
+    }
+
     static PassRefPtr<IDBKey> createArray(const KeyArray& array)
     {
         RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
@@ -98,7 +124,7 @@ public:
     };
 
     Type type() const { return m_type; }
-    bool isValid() const { return m_type != InvalidType; }
+    bool isValid() const;
 
     const KeyArray& array() const
     {
diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
index 0c2326e5d..341e2cf72 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
@@ -44,7 +44,7 @@ IDBKeyRange::IDBKeyRange(PassRefPtr<IDBKey> lower, PassRefPtr<IDBKey> upper, Low
 PassRefPtr<IDBKeyRange> IDBKeyRange::only(PassRefPtr<IDBKey> prpKey, ExceptionCode& ec)
 {
     RefPtr<IDBKey> key = prpKey;
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    if (!key || !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -54,7 +54,7 @@ PassRefPtr<IDBKeyRange> IDBKeyRange::only(PassRefPtr<IDBKey> prpKey, ExceptionCo
 
 PassRefPtr<IDBKeyRange> IDBKeyRange::lowerBound(PassRefPtr<IDBKey> bound, bool open, ExceptionCode& ec)
 {
-    if (bound && (bound->type() == IDBKey::InvalidType)) {
+    if (!bound || !bound->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -64,7 +64,7 @@ PassRefPtr<IDBKeyRange> IDBKeyRange::lowerBound(PassRefPtr<IDBKey> bound, bool o
 
 PassRefPtr<IDBKeyRange> IDBKeyRange::upperBound(PassRefPtr<IDBKey> bound, bool open, ExceptionCode& ec)
 {
-    if (bound && (bound->type() == IDBKey::InvalidType)) {
+    if (!bound || !bound->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -74,15 +74,15 @@ PassRefPtr<IDBKeyRange> IDBKeyRange::upperBound(PassRefPtr<IDBKey> bound, bool o
 
 PassRefPtr<IDBKeyRange> IDBKeyRange::bound(PassRefPtr<IDBKey> lower, PassRefPtr<IDBKey> upper, bool lowerOpen, bool upperOpen, ExceptionCode& ec)
 {
-    if ((lower && (lower->type() == IDBKey::InvalidType)) || (upper && (upper->type() == IDBKey::InvalidType))) {
+    if (!lower || !lower->isValid() || !upper || !upper->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
-    if (lower && upper && upper->isLessThan(lower.get())) {
+    if (upper->isLessThan(lower.get())) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
-    if (lower && upper && upper->isEqual(lower.get()) && (lowerOpen || upperOpen)) {
+    if (upper->isEqual(lower.get()) && (lowerOpen || upperOpen)) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index 49777c61b..c44a4c9de 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
@@ -77,6 +77,9 @@ static bool getInt(DBOrTransaction* db, const Vector<char>& key, int64_t& foundI
 template <typename DBOrTransaction>
 static bool putInt(DBOrTransaction* db, const Vector<char>& key, int64_t value)
 {
+    ASSERT(value >= 0);
+    if (value < 0)
+        return false;
     return db->put(key, encodeInt(value));
 }
 
@@ -587,6 +590,7 @@ static int64_t getNewVersionNumber(LevelDBTransaction* transaction, int64_t data
 
 bool IDBLevelDBBackingStore::putObjectStoreRecord(int64_t databaseId, int64_t objectStoreId, const IDBKey& key, const String& value, ObjectStoreRecordIdentifier* recordIdentifier)
 {
+    ASSERT(key.isValid());
     ASSERT(m_currentTransaction);
     int64_t version = getNewVersionNumber(m_currentTransaction.get(), databaseId, objectStoreId);
     const Vector<char> objectStoredataKey = ObjectStoreDataKey::encode(databaseId, objectStoreId, key);
@@ -869,6 +873,7 @@ void IDBLevelDBBackingStore::deleteIndex(int64_t databaseId, int64_t objectStore
 
 bool IDBLevelDBBackingStore::putIndexDataForRecord(int64_t databaseId, int64_t objectStoreId, int64_t indexId, const IDBKey& key, const ObjectStoreRecordIdentifier* recordIdentifier)
 {
+    ASSERT(key.isValid());
     ASSERT(indexId >= kMinimumIndexId);
     const LevelDBRecordIdentifier* levelDBRecordIdentifier = static_cast<const LevelDBRecordIdentifier*>(recordIdentifier);
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
index 47c9f7d3d..183637721 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
@@ -194,9 +194,10 @@ bool decodeBool(const char* begin, const char* end)
     return *begin;
 }
 
-Vector<char> encodeInt(int64_t n)
+Vector<char> encodeInt(int64_t nParam)
 {
-    ASSERT(n >= 0);
+    ASSERT(nParam >= 0);
+    uint64_t n = static_cast<uint64_t>(nParam);
     Vector<char> ret; // FIXME: Size this at creation.
 
     do {
@@ -236,8 +237,10 @@ static int compareInts(int64_t a, int64_t b)
     return 0;
 }
 
-Vector<char> encodeVarInt(int64_t n)
+Vector<char> encodeVarInt(int64_t nParam)
 {
+    ASSERT(nParam >= 0);
+    uint64_t n = static_cast<uint64_t>(nParam);
     Vector<char> ret; // FIXME: Size this at creation.
 
     do {
@@ -387,6 +390,7 @@ Vector<char> encodeIDBKey(const IDBKey& key)
 void encodeIDBKey(const IDBKey& key, Vector<char>& into)
 {
     size_t previousSize = into.size();
+    ASSERT(key.isValid());
     switch (key.type()) {
     case IDBKey::InvalidType:
     case IDBKey::MinType:
diff --git a/Source/WebCore/Modules/indexeddb/IDBMetadata.h b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
new file mode 100644
index 000000000..247e84d0f
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/IDBMetadata.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBMetadata_h
+#define IDBMetadata_h
+
+#include "IDBKeyPath.h"
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+#include <wtf/text/StringHash.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+struct IDBObjectStoreMetadata;
+struct IDBIndexMetadata;
+
+struct IDBDatabaseMetadata {
+    IDBDatabaseMetadata() { }
+    IDBDatabaseMetadata(const String& name, const String& version)
+        : name(name)
+        , version(version) { }
+    String name;
+    String version;
+
+    typedef HashMap<String, IDBObjectStoreMetadata> ObjectStoreMap;
+    ObjectStoreMap objectStores;
+};
+
+struct IDBObjectStoreMetadata {
+    IDBObjectStoreMetadata() { }
+    IDBObjectStoreMetadata(const String& name, const IDBKeyPath& keyPath, bool autoIncrement)
+        : name(name)
+        , keyPath(keyPath)
+        , autoIncrement(autoIncrement) { }
+    String name;
+    IDBKeyPath keyPath;
+    bool autoIncrement;
+
+    typedef HashMap<String, IDBIndexMetadata> IndexMap;
+    IndexMap indexes;
+};
+
+struct IDBIndexMetadata {
+    IDBIndexMetadata() { }
+    IDBIndexMetadata(const String& name, const IDBKeyPath& keyPath, bool unique, bool multiEntry)
+        : name(name)
+        , keyPath(keyPath)
+        , unique(unique)
+        , multiEntry(multiEntry) { }
+    String name;
+    IDBKeyPath keyPath;
+    bool unique;
+    bool multiEntry;
+};
+
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBMetadata_h
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 2afcb30e1..68bc17165 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -30,6 +30,7 @@
 
 #include "DOMStringList.h"
 #include "IDBAny.h"
+#include "IDBDatabase.h"
 #include "IDBDatabaseException.h"
 #include "IDBIndex.h"
 #include "IDBKey.h"
@@ -44,8 +45,9 @@ namespace WebCore {
 
 static const unsigned short defaultDirection = IDBCursor::NEXT;
 
-IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransaction* transaction)
-    : m_backend(idbObjectStore)
+IDBObjectStore::IDBObjectStore(const IDBObjectStoreMetadata& metadata, PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransaction* transaction)
+    : m_metadata(metadata)
+    , m_backend(idbObjectStore)
     , m_transaction(transaction)
     , m_deleted(false)
 {
@@ -55,40 +57,23 @@ IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObj
     relaxAdoptionRequirement();
 }
 
-String IDBObjectStore::name() const
-{
-    IDB_TRACE("IDBObjectStore::name");
-    return m_backend->name();
-}
-
-PassRefPtr<IDBAny> IDBObjectStore::keyPath() const
-{
-    IDB_TRACE("IDBObjectStore::keyPath");
-    return m_backend->keyPath();
-}
-
 PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
 {
     IDB_TRACE("IDBObjectStore::indexNames");
-    return m_backend->indexNames();
-}
-
-IDBTransaction* IDBObjectStore::transaction() const
-{
-    IDB_TRACE("IDBObjectStore::transaction");
-    return m_transaction.get();
-}
-
-bool IDBObjectStore::autoIncrement() const
-{
-    IDB_TRACE("IDBObjectStore::autoIncrement");
-    return m_backend->autoIncrement();
+    RefPtr<DOMStringList> indexNames = DOMStringList::create();
+    for (IDBObjectStoreMetadata::IndexMap::const_iterator it = m_metadata.indexes.begin(); it != m_metadata.indexes.end(); ++it)
+        indexNames->append(it->first);
+    indexNames->sort();
+    return indexNames.release();
 }
 
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::get");
-
+    if (m_deleted) {
+        ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
+        return 0;
+    }
     if (!keyRange) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -105,16 +90,6 @@ PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, Pass
 PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::get");
-    if (m_deleted) {
-        ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
-        return 0;
-    }
-
-    if (!key || (key->type() == IDBKey::InvalidType)) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return 0;
-    }
-
     RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
     if (ec)
         return 0;
@@ -133,7 +108,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, Pass
         return 0;
     }
 
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    if (key && !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -166,7 +141,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
         return 0;
     }
 
-    if (key && (key->type() == IDBKey::InvalidType)) {
+    if (key && !key->isValid()) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
     }
@@ -216,27 +191,10 @@ PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* co
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStore::delete");
-    if (m_deleted) {
-        ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
-        return 0;
-    }
-    if (m_transaction->isReadOnly()) {
-        ec = IDBDatabaseException::READ_ONLY_ERR;
-        return 0;
-    }
-
-    if (!key || !key->isValid()) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return 0;
-    }
-
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_backend->deleteFunction(key, request, m_transaction->backend(), ec);
-    if (ec) {
-        request->markEarlyDeath();
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
         return 0;
-    }
-    return request.release();
+    return deleteFunction(context, keyRange.release(), ec);
 }
 
 PassRefPtr<IDBRequest> IDBObjectStore::clear(ScriptExecutionContext* context, ExceptionCode& ec)
@@ -303,8 +261,10 @@ PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const IDBKe
     if (ec)
         return 0;
 
-    RefPtr<IDBIndex> index = IDBIndex::create(indexBackend.release(), this, m_transaction.get());
+    IDBIndexMetadata metadata(name, keyPath, unique, multiEntry);
+    RefPtr<IDBIndex> index = IDBIndex::create(metadata, indexBackend.release(), this, m_transaction.get());
     m_indexMap.set(name, index);
+    m_metadata.indexes.set(name, metadata);
 
     return index.release();
 }
@@ -330,7 +290,10 @@ PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec
     if (ec)
         return 0;
 
-    RefPtr<IDBIndex> index = IDBIndex::create(indexBackend.release(), this, m_transaction.get());
+    IDBObjectStoreMetadata::IndexMap::const_iterator mdit = m_metadata.indexes.find(name);
+    ASSERT(mdit != m_metadata.indexes.end());
+
+    RefPtr<IDBIndex> index = IDBIndex::create(mdit->second, indexBackend.release(), this, m_transaction.get());
     m_indexMap.set(name, index);
     return index.release();
 }
@@ -349,6 +312,9 @@ void IDBObjectStore::deleteIndex(const String& name, ExceptionCode& ec)
             it->second->markDeleted();
             m_indexMap.remove(name);
         }
+
+        ASSERT(m_metadata.indexes.contains(name));
+        m_metadata.indexes.remove(name);
     }
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
index 834bd50fc..8181eb931 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
@@ -31,6 +31,7 @@
 #include "IDBIndex.h"
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBRequest.h"
 #include "IDBTransaction.h"
@@ -49,18 +50,18 @@ class IDBAny;
 
 class IDBObjectStore : public RefCounted<IDBObjectStore> {
 public:
-    static PassRefPtr<IDBObjectStore> create(PassRefPtr<IDBObjectStoreBackendInterface> idbObjectStore, IDBTransaction* transaction)
+    static PassRefPtr<IDBObjectStore> create(const IDBObjectStoreMetadata& metadata, PassRefPtr<IDBObjectStoreBackendInterface> backend, IDBTransaction* transaction)
     {
-        return adoptRef(new IDBObjectStore(idbObjectStore, transaction));
+        return adoptRef(new IDBObjectStore(metadata, backend, transaction));
     }
     ~IDBObjectStore() { }
 
     // Implement the IDBObjectStore IDL
-    String name() const;
-    PassRefPtr<IDBAny> keyPath() const;
+    const String name() const { return m_metadata.name; }
+    PassRefPtr<IDBAny> keyPath() const { return m_metadata.keyPath; }
     PassRefPtr<DOMStringList> indexNames() const;
-    IDBTransaction* transaction() const;
-    bool autoIncrement() const;
+    PassRefPtr<IDBTransaction> transaction() const { return m_transaction; }
+    bool autoIncrement() const { return m_metadata.autoIncrement; }
 
     PassRefPtr<IDBRequest> add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return add(context, value, 0, ec);  }
     PassRefPtr<IDBRequest> put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return put(context, value, 0, ec);  }
@@ -97,10 +98,14 @@ public:
     void markDeleted() { m_deleted = true; }
     void transactionFinished();
 
+    IDBObjectStoreMetadata metadata() const { return m_metadata; }
+    void setMetadata(const IDBObjectStoreMetadata& metadata) { m_metadata = metadata; }
+
 private:
-    IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface>, IDBTransaction*);
+    IDBObjectStore(const IDBObjectStoreMetadata&, PassRefPtr<IDBObjectStoreBackendInterface>, IDBTransaction*);
     void removeTransactionFromPendingList();
 
+    IDBObjectStoreMetadata m_metadata;
     RefPtr<IDBObjectStoreBackendInterface> m_backend;
     RefPtr<IDBTransaction> m_transaction;
     bool m_deleted;
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index dc413439a..a62dda8b4 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -72,6 +72,14 @@ IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(const IDBDatabaseBackendImp
 {
 }
 
+IDBObjectStoreMetadata IDBObjectStoreBackendImpl::metadata() const
+{
+    IDBObjectStoreMetadata metadata(m_name, m_keyPath, m_autoIncrement);
+    for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it)
+        metadata.indexes.set(it->first, it->second->metadata());
+    return metadata;
+}
+
 PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
 {
     RefPtr<DOMStringList> indexNames = DOMStringList::create();
@@ -208,6 +216,69 @@ void IDBObjectStoreBackendImpl::revertAutoIncrementKeyCache(ScriptExecutionConte
     objectStore->resetAutoIncrementKeyCache();
 }
 
+namespace {
+class IndexWriter {
+public:
+    explicit IndexWriter(PassRefPtr<IDBIndexBackendImpl> index)
+        : m_index(index)
+    {
+    }
+
+    bool loadIndexKeysForValue(SerializedScriptValue* objectValue, const IDBKey* primaryKey = 0, String* errorMessage = 0)
+    {
+        m_indexKeys.clear();
+
+        RefPtr<IDBKey> indexKey = fetchKeyFromKeyPath(objectValue, m_index->keyPath());
+
+        if (!indexKey)
+            return true;
+
+        if (!m_index->multiEntry() || indexKey->type() != IDBKey::ArrayType) {
+            if (!indexKey->isValid())
+                return true;
+
+            if (!m_index->addingKeyAllowed(indexKey.get(), primaryKey)) {
+                if (errorMessage)
+                    *errorMessage = String::format("Unable to add key to index '%s': the key does not satisfy its uniqueness requirements.",
+                                                   m_index->name().utf8().data());
+                return false;
+            }
+            m_indexKeys.append(indexKey);
+        } else {
+            ASSERT(m_index->multiEntry());
+            ASSERT(indexKey->type() == IDBKey::ArrayType);
+            indexKey = IDBKey::createMultiEntryArray(indexKey->array());
+
+            for (size_t i = 0; i < indexKey->array().size(); ++i) {
+                if (!m_index->addingKeyAllowed(indexKey->array()[i].get(), primaryKey)) {
+                    if (errorMessage)
+                        *errorMessage = String::format("Unable to add key to index '%s': at least one key does not satisfy the uniqueness requirements.",
+                                                       m_index->name().utf8().data());
+                    return false;
+                }
+                m_indexKeys.append(indexKey->array()[i]);
+            }
+        }
+        return true;
+    }
+
+    bool writeIndexKeys(const IDBBackingStore::ObjectStoreRecordIdentifier* recordIdentifier, IDBBackingStore& backingStore, int64_t databaseId, int64_t objectStoreId, String* errorMessage = 0)
+    {
+        for (size_t i = 0; i < m_indexKeys.size(); ++i) {
+            if (!backingStore.deleteIndexDataForRecord(databaseId, objectStoreId, m_index->id(), recordIdentifier))
+                return false;
+            if (!backingStore.putIndexDataForRecord(databaseId, objectStoreId, m_index->id(), *m_indexKeys[i].get(), recordIdentifier))
+                return false;
+        }
+        return true;
+    }
+
+private:
+    RefPtr<IDBIndexBackendImpl> m_index;
+    Vector<RefPtr<IDBKey> > m_indexKeys;
+};
+}
+
 void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, PutMode putMode, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::putInternal");
@@ -259,36 +330,22 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         return;
     }
 
-    Vector<RefPtr<IDBKey> > indexKeys;
+    Vector<OwnPtr<IndexWriter> > indexWriters;
     for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
-        const RefPtr<IDBIndexBackendImpl>& index = it->second;
 
-        RefPtr<IDBKey> indexKey = fetchKeyFromKeyPath(value.get(), index->keyPath());
-        if (!indexKey || !indexKey->isValid()) {
-            // Null/invalid keys not added to index; null entry keeps iterator/vector indexes consistent.
-            indexKey.clear();
-            indexKeys.append(indexKey);
-            continue;
-        }
-        ASSERT(indexKey->isValid());
+        const RefPtr<IDBIndexBackendImpl>& index = it->second;
+        if (!index->hasValidId())
+            continue; // The index object has been created, but does not exist in the database yet.
 
-        if ((!index->multiEntry() || indexKey->type() != IDBKey::ArrayType) && !index->addingKeyAllowed(indexKey.get(), key.get())) {
+        OwnPtr<IndexWriter> indexWriter(adoptPtr(new IndexWriter(index)));
+        String errorMessage;
+        if (!indexWriter->loadIndexKeysForValue(value.get(), key.get(), &errorMessage)) {
             objectStore->resetAutoIncrementKeyCache();
-            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "One of the derived (from a keyPath) keys for an index does not satisfy its uniqueness requirements."));
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, errorMessage));
             return;
         }
 
-        if (index->multiEntry() && indexKey->type() == IDBKey::ArrayType) {
-           for (size_t j = 0; j < indexKey->array().size(); ++j) {
-                if (!index->addingKeyAllowed(indexKey->array()[j].get(), key.get())) {
-                    objectStore->resetAutoIncrementKeyCache();
-                    callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::DATA_ERR, "One of the derived (from a keyPath) keys for an index does not satisfy its uniqueness requirements."));
-                    return;
-                }
-            }
-        }
-
-        indexKeys.append(indexKey.release());
+        indexWriters.append(indexWriter.release());
     }
 
     // Before this point, don't do any mutation.  After this point, rollback the transaction in case of error.
@@ -299,60 +356,19 @@ void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<
         return;
     }
 
-    int i = 0;
-    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it, ++i) {
-        RefPtr<IDBIndexBackendImpl>& index = it->second;
-        if (!index->hasValidId())
-            continue; // The index object has been created, but does not exist in the database yet.
-
-        if (!objectStore->backingStore()->deleteIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), recordIdentifier.get())) {
+    for (size_t i = 0; i < indexWriters.size(); ++i) {
+        if (!indexWriters[i]->writeIndexKeys(recordIdentifier.get(),
+                                             *objectStore->backingStore(), objectStore->databaseId(),
+                                             objectStore->m_id)) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
             transaction->abort();
             return;
         }
-
-        if (!indexKeys[i])
-            continue;
-        RefPtr<IDBKey> indexKey = indexKeys[i];
-
-        if (!index->multiEntry() || indexKey->type() != IDBKey::ArrayType) {
-            if (!objectStore->backingStore()->putIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), *indexKey, recordIdentifier.get())) {
-                callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
-                transaction->abort();
-                return;
-            }
-        } else {
-            ASSERT(index->multiEntry());
-            ASSERT(indexKey->type() == IDBKey::ArrayType);
-            for (size_t j = 0; j < indexKey->array().size(); ++j) {
-                if (!objectStore->backingStore()->putIndexDataForRecord(objectStore->databaseId(), objectStore->id(), index->id(), *indexKey->array()[j], recordIdentifier.get())) {
-                    callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
-                    transaction->abort();
-                    return;
-                }
-            }
-        }
     }
 
     callbacks->onSuccess(key.get());
 }
 
-void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
-{
-    IDB_TRACE("IDBObjectStoreBackendImpl::delete");
-    RefPtr<IDBKey> key = prpKey;
-    if (!key || !key->isValid()) {
-        ec = IDBDatabaseException::DATA_ERR;
-        return;
-    }
-
-    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
-    if (ec)
-        return;
-
-    deleteFunction(keyRange.release(), prpCallbacks, transaction, ec);
-}
-
 void IDBObjectStoreBackendImpl::deleteFunction(PassRefPtr<IDBKeyRange> prpKeyRange, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     IDB_TRACE("IDBObjectStoreBackendImpl::delete");
@@ -422,41 +438,23 @@ public:
         : m_backingStore(backingStore)
         , m_databaseId(databaseId)
         , m_objectStoreId(objectStoreId)
-        , m_index(index)
+        , m_writer(index)
     {
     }
 
     virtual bool callback(const IDBBackingStore::ObjectStoreRecordIdentifier* recordIdentifier, const String& value)
     {
         RefPtr<SerializedScriptValue> objectValue = SerializedScriptValue::createFromWire(value);
-        RefPtr<IDBKey> indexKey = fetchKeyFromKeyPath(objectValue.get(), m_index->keyPath());
-
-        if (!indexKey)
-            return true;
-
-        if (!m_index->multiEntry() || indexKey->type() != IDBKey::ArrayType) {
-            if (!m_index->addingKeyAllowed(indexKey.get()))
-                return false;
-            if (!m_backingStore.putIndexDataForRecord(m_databaseId, m_objectStoreId, m_index->id(), *indexKey, recordIdentifier))
-                return false;
-        } else {
-            ASSERT(m_index->multiEntry());
-            ASSERT(indexKey->type() == IDBKey::ArrayType);
-            for (size_t i = 0; i < indexKey->array().size(); ++i) {
-                if (!m_index->addingKeyAllowed(indexKey.get()))
-                    return false;
-                if (!m_backingStore.putIndexDataForRecord(m_databaseId, m_objectStoreId, m_index->id(), *indexKey->array()[i], recordIdentifier))
-                    return false;
-            }
-        }
-        return true;
+        if (!m_writer.loadIndexKeysForValue(objectValue.get()))
+            return false;
+        return m_writer.writeIndexKeys(recordIdentifier, m_backingStore, m_databaseId, m_objectStoreId);
     }
 
 private:
     IDBBackingStore& m_backingStore;
     int64_t m_databaseId;
     int64_t m_objectStoreId;
-    RefPtr<IDBIndexBackendImpl> m_index;
+    IndexWriter m_writer;
 };
 }
 
@@ -629,7 +627,7 @@ void IDBObjectStoreBackendImpl::loadIndexes()
     ASSERT(uniqueFlags.size() == ids.size());
     ASSERT(multiEntryFlags.size() == ids.size());
 
-    for (size_t i = 0; i < ids.size(); i++)
+    for (size_t i = 0; i < ids.size(); ++i)
         m_indexes.set(names[i], IDBIndexBackendImpl::create(m_database, this, ids[i], names[i], keyPaths[i], uniqueFlags[i], multiEntryFlags[i]));
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
index d372253a3..07ab9fce3 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
@@ -28,6 +28,7 @@
 
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBKeyPath.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include <wtf/HashMap.h>
 #include <wtf/text/StringHash.h>
@@ -40,6 +41,7 @@ class IDBDatabaseBackendImpl;
 class IDBIndexBackendImpl;
 class IDBTransactionBackendInterface;
 class ScriptExecutionContext;
+struct IDBObjectStoreMetadata;
 
 class IDBObjectStoreBackendImpl : public IDBObjectStoreBackendInterface {
 public:
@@ -61,6 +63,7 @@ public:
     }
     void setId(int64_t id) { m_id = id; }
 
+    virtual IDBObjectStoreMetadata metadata() const;
     virtual String name() const { return m_name; }
     virtual IDBKeyPath keyPath() const { return m_keyPath; }
     virtual PassRefPtr<DOMStringList> indexNames() const;
@@ -68,7 +71,6 @@ public:
 
     virtual void get(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
index 5e5d98e88..6002d9e48 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
@@ -61,7 +61,6 @@ public:
         CursorUpdate
     };
     virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, PutMode, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
-    virtual void deleteFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
     virtual void deleteFunction(PassRefPtr<IDBKeyRange>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
     virtual void clear(PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index 641e57641..7087c657e 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -158,25 +158,34 @@ PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, Excep
     if (ec)
         return 0;
 
-    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(objectStoreBackend, this);
+    const IDBDatabaseMetadata& metadata = m_database->metadata();
+    IDBDatabaseMetadata::ObjectStoreMap::const_iterator mdit = metadata.objectStores.find(name);
+    ASSERT(mdit != metadata.objectStores.end());
+
+    RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(mdit->second, objectStoreBackend, this);
     objectStoreCreated(name, objectStore);
     return objectStore.release();
 }
 
-void IDBTransaction::objectStoreCreated(const String& name, PassRefPtr<IDBObjectStore> objectStore)
+void IDBTransaction::objectStoreCreated(const String& name, PassRefPtr<IDBObjectStore> prpObjectStore)
 {
     ASSERT(!m_transactionFinished);
+    RefPtr<IDBObjectStore> objectStore = prpObjectStore;
     m_objectStoreMap.set(name, objectStore);
+    if (isVersionChange())
+        m_objectStoreCleanupMap.set(objectStore, objectStore->metadata());
 }
 
 void IDBTransaction::objectStoreDeleted(const String& name)
 {
     ASSERT(!m_transactionFinished);
+    ASSERT(isVersionChange());
     IDBObjectStoreMap::iterator it = m_objectStoreMap.find(name);
     if (it != m_objectStoreMap.end()) {
         RefPtr<IDBObjectStore> objectStore = it->second;
         m_objectStoreMap.remove(name);
         objectStore->markDeleted();
+        m_objectStoreCleanupMap.set(objectStore, objectStore->metadata());
     }
 }
 
@@ -239,6 +248,11 @@ void IDBTransaction::onAbort()
         request->abort();
     }
 
+    if (isVersionChange()) {
+        for (IDBObjectStoreMetadataMap::iterator it = m_objectStoreCleanupMap.begin(); it != m_objectStoreCleanupMap.end(); ++it)
+            it->first->setMetadata(it->second);
+    }
+    m_objectStoreCleanupMap.clear();
     closeOpenCursors();
     m_database->transactionFinished(this);
 
@@ -251,6 +265,7 @@ void IDBTransaction::onAbort()
 void IDBTransaction::onComplete()
 {
     ASSERT(!m_transactionFinished);
+    m_objectStoreCleanupMap.clear();
     closeOpenCursors();
     m_database->transactionFinished(this);
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index 4f95f5b19..0b2dec6ec 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -35,6 +35,7 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventTarget.h"
+#include "IDBMetadata.h"
 #include "IDBTransactionBackendInterface.h"
 #include "IDBTransactionCallbacks.h"
 #include <wtf/HashSet.h>
@@ -143,6 +144,9 @@ private:
     typedef HashMap<String, RefPtr<IDBObjectStore> > IDBObjectStoreMap;
     IDBObjectStoreMap m_objectStoreMap;
 
+    typedef HashMap<RefPtr<IDBObjectStore>, IDBObjectStoreMetadata> IDBObjectStoreMetadataMap;
+    IDBObjectStoreMetadataMap m_objectStoreCleanupMap;
+
     HashSet<IDBCursor*> m_openCursors;
 
     EventTargetData m_eventTargetData;
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.cpp b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
index 8bdc353c8..fca2ba764 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
@@ -46,8 +46,11 @@ PassRefPtr<SpeechRecognition> SpeechRecognition::create(ScriptExecutionContext*
 
 void SpeechRecognition::start()
 {
-    ASSERT(m_controller); // FIXME: Spec should say what to do if we are already started.
-    m_controller->start(this, m_grammars.get(), m_lang, m_continuous);
+    ASSERT(m_controller);
+    // FIXME: Spec should say what to do if we are already started.
+
+    setPendingActivity(this);
+    m_controller->start(this, m_grammars.get(), m_lang, m_continuous, m_maxAlternatives);
 }
 
 void SpeechRecognition::stopFunction()
@@ -64,7 +67,6 @@ void SpeechRecognition::abort()
 
 void SpeechRecognition::didStartAudio()
 {
-    // FIXME: The spec should specify whether these events can bubble and are cancelable.
     dispatchEvent(Event::create(eventNames().audiostartEvent, /*canBubble=*/false, /*cancelable=*/false));
 }
 
@@ -121,6 +123,7 @@ void SpeechRecognition::didStart()
 void SpeechRecognition::didEnd()
 {
     dispatchEvent(Event::create(eventNames().endEvent, /*canBubble=*/false, /*cancelable=*/false));
+    unsetPendingActivity(this);
 }
 
 const AtomicString& SpeechRecognition::interfaceName() const
@@ -133,10 +136,17 @@ ScriptExecutionContext* SpeechRecognition::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
+void SpeechRecognition::stop()
+{
+    if (hasPendingActivity())
+        abort();
+}
+
 SpeechRecognition::SpeechRecognition(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_grammars(SpeechGrammarList::create()) // FIXME: The spec is not clear on the default value for the grammars attribute.
     , m_continuous(false)
+    , m_maxAlternatives(1)
     , m_controller(0)
 {
     ASSERT(scriptExecutionContext()->isDocument());
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.h b/Source/WebCore/Modules/speech/SpeechRecognition.h
index 3fc244166..1657b573d 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.h
@@ -49,14 +49,15 @@ public:
     static PassRefPtr<SpeechRecognition> create(ScriptExecutionContext*);
     ~SpeechRecognition();
 
+    // Attributes.
     PassRefPtr<SpeechGrammarList> grammars() { return m_grammars; }
     void setGrammars(PassRefPtr<SpeechGrammarList> grammars) { m_grammars = grammars; }
-
     String lang() { return m_lang; }
     void setLang(const String& lang) { m_lang = lang; }
-
     bool continuous() { return m_continuous; }
     void setContinuous(bool continuous) { m_continuous = continuous; }
+    unsigned long maxAlternatives() { return m_maxAlternatives; }
+    void setMaxAlternatives(unsigned long maxAlternatives) { m_maxAlternatives = maxAlternatives; }
 
     // Callable by the user.
     void start();
@@ -77,10 +78,13 @@ public:
     void didStart();
     void didEnd();
 
-    // EventTarget
+    // EventTarget.
     virtual const AtomicString& interfaceName() const OVERRIDE;
     virtual ScriptExecutionContext* scriptExecutionContext() const OVERRIDE;
 
+    // ActiveDOMObject.
+    virtual void stop() OVERRIDE;
+
     using RefCounted<SpeechRecognition>::ref;
     using RefCounted<SpeechRecognition>::deref;
 
@@ -112,6 +116,7 @@ private:
     RefPtr<SpeechGrammarList> m_grammars;
     String m_lang;
     bool m_continuous;
+    unsigned long m_maxAlternatives;
 
     EventTargetData m_eventTargetData;
 
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.idl b/Source/WebCore/Modules/speech/SpeechRecognition.idl
index 5fea70d27..f6e2844d5 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.idl
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.idl
@@ -34,6 +34,7 @@ module core {
         attribute SpeechGrammarList grammars;
         attribute DOMString lang;
         attribute boolean continuous;
+        attribute unsigned long maxAlternatives;
 
         void start();
         [ImplementedAs=stopFunction] void stop();
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionClient.h b/Source/WebCore/Modules/speech/SpeechRecognitionClient.h
index 29bb9f66b..acfd55b5b 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionClient.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionClient.h
@@ -38,7 +38,7 @@ class SpeechRecognition;
 
 class SpeechRecognitionClient {
 public:
-    virtual void start(SpeechRecognition*, const SpeechGrammarList*, const String& lang, bool continuous) = 0;
+    virtual void start(SpeechRecognition*, const SpeechGrammarList*, const String& lang, bool continuous, unsigned long maxAlternatives) = 0;
     virtual void stop(SpeechRecognition*) = 0;
     virtual void abort(SpeechRecognition*) = 0;
 
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionController.h b/Source/WebCore/Modules/speech/SpeechRecognitionController.h
index 50bc5a42f..6e3fcceb6 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionController.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionController.h
@@ -38,7 +38,11 @@ class SpeechRecognitionController : public Supplement<Page> {
 public:
     virtual ~SpeechRecognitionController();
 
-    void start(SpeechRecognition* recognition, const SpeechGrammarList* grammars, const String& lang, bool continuous) { m_client->start(recognition, grammars, lang, continuous); }
+    void start(SpeechRecognition* recognition, const SpeechGrammarList* grammars, const String& lang, bool continuous, unsigned long maxAlternatives)
+    {
+        m_client->start(recognition, grammars, lang, continuous, maxAlternatives);
+    }
+
     void stop(SpeechRecognition* recognition) { m_client->stop(recognition); }
     void abort(SpeechRecognition* recognition) { m_client->abort(recognition); }
 
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
index 670f0b0b2..d6f9ee7df 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
@@ -42,7 +42,7 @@ PassRefPtr<SpeechRecognitionError> SpeechRecognitionError::create(const AtomicSt
 }
 
 SpeechRecognitionError::SpeechRecognitionError(Code code, const String& message)
-    : Event(eventNames().errorEvent, /*canBubble=*/false, /*cancelable=*/false) // FIXME: Spec should say whether it bubbles and is cancelable.
+    : Event(eventNames().errorEvent, /*canBubble=*/false, /*cancelable=*/false)
     , m_code(static_cast<unsigned short>(code))
     , m_message(message)
 {
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index dd9fdc0b1..67fedd625 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -158,7 +158,6 @@ v8 {
         \
         bindings/v8/custom/V8CSSRuleCustom.cpp \
         bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp \
-        bindings/v8/custom/V8CSSStyleSheetCustom.cpp \
         bindings/v8/custom/V8CSSValueCustom.cpp \
         bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp \
         bindings/v8/custom/V8ClipboardCustom.cpp \
@@ -167,8 +166,7 @@ v8 {
         bindings/v8/custom/V8InjectedScriptHostCustom.cpp \
         bindings/v8/custom/V8InjectedScriptManager.cpp \
         bindings/v8/custom/V8InspectorFrontendHostCustom.cpp \
-        bindings/v8/custom/V8DOMStringMapCustom.cpp \
-        bindings/v8/custom/V8DOMTokenListCustom.cpp
+        bindings/v8/custom/V8DOMStringMapCustom.cpp
 
     SOURCES += \
         bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp \
@@ -208,6 +206,7 @@ v8 {
         bindings/v8/custom/V8NodeCustom.cpp \
         bindings/v8/custom/V8NodeListCustom.cpp \
         bindings/v8/custom/V8PerformanceCustom.cpp \
+        bindings/v8/custom/V8PerformanceEntryCustom.cpp \
         bindings/v8/custom/V8SQLResultSetRowListCustom.cpp \
         bindings/v8/custom/V8SQLTransactionCustom.cpp \
         bindings/v8/custom/V8WebSocketCustom.cpp \
@@ -215,7 +214,6 @@ v8 {
         bindings/v8/custom/V8StorageCustom.cpp \
         bindings/v8/custom/V8StyleSheetCustom.cpp \
         bindings/v8/custom/V8StyleSheetListCustom.cpp \
-        bindings/v8/custom/V8TextTrackListCustom.cpp \
         bindings/v8/custom/V8WebKitAnimationCustom.cpp \
         bindings/v8/custom/V8WebKitMutationObserverCustom.cpp \
         bindings/v8/custom/V8WebKitPointConstructor.cpp \
@@ -531,8 +529,8 @@ SOURCES += \
     dom/DeviceMotionController.cpp \
     dom/DeviceMotionData.cpp \
     dom/DeviceMotionEvent.cpp \
-    dom/DeviceOrientation.cpp \
     dom/DeviceOrientationController.cpp \
+    dom/DeviceOrientationData.cpp \    
     dom/DeviceOrientationEvent.cpp \
     dom/Document.cpp \
     dom/DocumentEventQueue.cpp \
@@ -894,6 +892,8 @@ SOURCES += \
     inspector/InjectedScriptBase.cpp \
     inspector/InjectedScriptHost.cpp \
     inspector/InjectedScriptManager.cpp \
+    inspector/InjectedScriptModule.cpp \
+    inspector/InjectedScriptWebGLModule.cpp \
     inspector/InspectorAgent.cpp \
     inspector/InspectorApplicationCacheAgent.cpp \
     inspector/InspectorBaseAgent.cpp \
@@ -1048,6 +1048,7 @@ SOURCES += \
     page/PerformanceEntry.cpp \
     page/PerformanceEntryList.cpp \
     page/PerformanceNavigation.cpp \
+    page/PerformanceResourceTiming.cpp \
     page/PerformanceTiming.cpp \
     page/PrintContext.cpp \
     page/Screen.cpp \
@@ -1274,6 +1275,7 @@ SOURCES += \
     rendering/RenderFrameBase.cpp \
     rendering/RenderFrameSet.cpp \
     rendering/RenderGeometryMap.cpp \
+    rendering/RenderGrid.cpp \
     rendering/RenderHTMLCanvas.cpp \
     rendering/RenderIFrame.cpp \
     rendering/RenderImage.cpp \
@@ -1709,9 +1711,9 @@ HEADERS += \
     dom/DeviceMotionController.h \
     dom/DeviceMotionData.h \
     dom/DeviceMotionEvent.h \
-    dom/DeviceOrientation.h \
     dom/DeviceOrientationClient.h \
     dom/DeviceOrientationController.h \
+    dom/DeviceOrientationData.h \
     dom/DeviceOrientationEvent.h \
     dom/Document.h \
     dom/DocumentFragment.h \
@@ -1743,6 +1745,7 @@ HEADERS += \
     dom/ExceptionCode.h \
     dom/FragmentScriptingPermission.h \
     dom/KeyboardEvent.h \
+    dom/MemoryInstrumentation.h \
     dom/MessageChannel.h \
     dom/MessageEvent.h \
     dom/MessagePortChannel.h \
@@ -2032,17 +2035,19 @@ HEADERS += \
     html/track/WebVTTParser.h \
     html/track/WebVTTToken.h \
     html/track/WebVTTTokenizer.h \
+    inspector/BindingVisitor.h \
     inspector/ConsoleMessage.h \
     inspector/ContentSearchUtils.h \
     inspector/DOMEditor.h \
     inspector/DOMNodeHighlighter.h \
     inspector/DOMPatchSupport.h \
-    inspector/DOMWrapperVisitor.h \
     inspector/IdentifiersFactory.h \
     inspector/InjectedScript.h \
     inspector/InjectedScriptBase.h \
     inspector/InjectedScriptHost.h \
     inspector/InjectedScriptManager.h \
+    inspector/InjectedScriptModule.h \
+    inspector/InjectedScriptWebGLModule.h \
     inspector/InspectorAgent.h \
     inspector/InspectorApplicationCacheAgent.h \
     inspector/InspectorBaseAgent.h \
@@ -2232,7 +2237,7 @@ HEADERS += \
     platform/graphics/filters/CustomFilterGlobalContext.h \
     platform/graphics/filters/CustomFilterMesh.h \
     platform/graphics/filters/CustomFilterNumberParameter.h \
-    platform/graphics/filters/CustomFilterShader.h \
+    platform/graphics/filters/CustomFilterCompiledProgram.h \
     platform/graphics/filters/CustomFilterOperation.h \
     platform/graphics/filters/CustomFilterParameter.h \
     platform/graphics/filters/CustomFilterProgram.h \
@@ -2487,6 +2492,7 @@ HEADERS += \
     rendering/RenderFrameBase.h \
     rendering/RenderFrameSet.h \
     rendering/RenderGeometryMap.h \
+    rendering/RenderGrid.h \
     rendering/RenderHTMLCanvas.h \
     rendering/RenderIFrame.h \
     rendering/RenderImageResource.h \
@@ -3413,7 +3419,7 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/CustomFilterGlobalContext.cpp \
         platform/graphics/filters/CustomFilterOperation.cpp \
         platform/graphics/filters/CustomFilterProgram.cpp \
-        platform/graphics/filters/CustomFilterShader.cpp \
+        platform/graphics/filters/CustomFilterCompiledProgram.cpp \
         platform/graphics/filters/CustomFilterMesh.cpp \
         platform/graphics/filters/DistantLightSource.cpp \
         platform/graphics/filters/FEBlend.cpp \
@@ -3541,7 +3547,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/properties/SVGAttributeToPropertyMap.cpp \
         svg/properties/SVGPathSegListPropertyTearOff.cpp
 
-    linux-g++*:CONFIG(debug, debug|release):isEqual(QT_ARCH,i386) {
+    use_all_in_one_files {
          # Using all in one files to avoid memory exhaustion
          # during the linking phase.
          SOURCES += \
@@ -3596,167 +3602,162 @@ contains(DEFINES, ENABLE_SVG=1) {
               rendering/svg/SVGTextMetrics.cpp \
               rendering/svg/SVGTextMetricsBuilder.cpp \
               rendering/svg/SVGTextQuery.cpp \
-              rendering/svg/SVGTextRunRenderingContext.cpp
-        use_all_in_one_files {
-            SOURCES += svg/SVGAllInOne.cpp
-        } else {
-            SOURCES += \
-                  svg/SVGDocumentExtensions.cpp \
-                  svg/ColorDistance.cpp \
-                  svg/SVGAElement.cpp \
-                  svg/SVGAltGlyphDefElement.cpp \
-                  svg/SVGAltGlyphElement.cpp \
-                  svg/SVGAltGlyphItemElement.cpp \
-                  svg/SVGAngle.cpp \
-                  svg/SVGAnimateColorElement.cpp \
-                  svg/SVGAnimatedAngle.cpp \
-                  svg/SVGAnimatedBoolean.cpp \
-                  svg/SVGAnimatedColor.cpp \
-                  svg/SVGAnimatedEnumeration.cpp \
-                  svg/SVGAnimatedInteger.cpp \
-                  svg/SVGAnimatedIntegerOptionalInteger.cpp \
-                  svg/SVGAnimatedLength.cpp \
-                  svg/SVGAnimatedLengthList.cpp \
-                  svg/SVGAnimatedNumber.cpp \
-                  svg/SVGAnimatedNumberList.cpp \
-                  svg/SVGAnimatedNumberOptionalNumber.cpp \
-                  svg/SVGAnimatedPath.cpp \
-                  svg/SVGAnimatedPointList.cpp \
-                  svg/SVGAnimatedPreserveAspectRatio.cpp \
-                  svg/SVGAnimatedRect.cpp \
-                  svg/SVGAnimatedString.cpp \
-                  svg/SVGAnimatedTransformList.cpp \
-                  svg/SVGAnimatedType.cpp \
-                  svg/SVGAnimateElement.cpp \
-                  svg/SVGAnimateMotionElement.cpp \
-                  svg/SVGAnimateTransformElement.cpp \
-                  svg/SVGAnimationElement.cpp \
-                  svg/SVGCircleElement.cpp \
-                  svg/SVGClipPathElement.cpp \
-                  svg/SVGColor.cpp \
-                  svg/SVGComponentTransferFunctionElement.cpp \
-                  svg/SVGCursorElement.cpp \
-                  svg/SVGDefsElement.cpp \
-                  svg/SVGDescElement.cpp \
-                  svg/SVGDocument.cpp \
-                  svg/SVGElement.cpp \
-                  svg/SVGElementInstance.cpp \
-                  svg/SVGElementInstanceList.cpp \
-                  svg/SVGEllipseElement.cpp \
-                  svg/SVGException.cpp \
-                  svg/SVGExternalResourcesRequired.cpp \
-                  svg/SVGFEBlendElement.cpp \
-                  svg/SVGFEColorMatrixElement.cpp \
-                  svg/SVGFEComponentTransferElement.cpp \
-                  svg/SVGFECompositeElement.cpp \
-                  svg/SVGFEConvolveMatrixElement.cpp \
-                  svg/SVGFEDiffuseLightingElement.cpp \
-                  svg/SVGFEDisplacementMapElement.cpp \
-                  svg/SVGFEDistantLightElement.cpp \
-                  svg/SVGFEDropShadowElement.cpp \
-                  svg/SVGFEFloodElement.cpp \
-                  svg/SVGFEFuncAElement.cpp \
-                  svg/SVGFEFuncBElement.cpp \
-                  svg/SVGFEFuncGElement.cpp \
-                  svg/SVGFEFuncRElement.cpp \
-                  svg/SVGFEGaussianBlurElement.cpp \
-                  svg/SVGFEImageElement.cpp \
-                  svg/SVGFELightElement.cpp \
-                  svg/SVGFEMergeElement.cpp \
-                  svg/SVGFEMergeNodeElement.cpp \
-                  svg/SVGFEMorphologyElement.cpp \
-                  svg/SVGFEOffsetElement.cpp \
-                  svg/SVGFEPointLightElement.cpp \
-                  svg/SVGFESpecularLightingElement.cpp \
-                  svg/SVGFESpotLightElement.cpp \
-                  svg/SVGFETileElement.cpp \
-                  svg/SVGFETurbulenceElement.cpp \
-                  svg/SVGFilterElement.cpp \
-                  svg/SVGFilterPrimitiveStandardAttributes.cpp \
-                  svg/SVGFitToViewBox.cpp \
-                  svg/SVGFontData.cpp \
-                  svg/SVGFontElement.cpp \
-                  svg/SVGFontFaceElement.cpp \
-                  svg/SVGFontFaceFormatElement.cpp \
-                  svg/SVGFontFaceNameElement.cpp \
-                  svg/SVGFontFaceSrcElement.cpp \
-                  svg/SVGFontFaceUriElement.cpp \
-                  svg/SVGForeignObjectElement.cpp \
-                  svg/SVGGElement.cpp \
-                  svg/SVGGlyphElement.cpp \
-                  svg/SVGGlyphRefElement.cpp \
-                  svg/SVGGradientElement.cpp \
-                  svg/SVGHKernElement.cpp \
-                  svg/SVGImageElement.cpp \
-                  svg/SVGImageLoader.cpp \
-                  svg/SVGLangSpace.cpp \
-                  svg/SVGLength.cpp \
-                  svg/SVGLengthContext.cpp \
-                  svg/SVGLengthList.cpp \
-                  svg/SVGLinearGradientElement.cpp \
-                  svg/SVGLineElement.cpp \
-                  svg/SVGLocatable.cpp \
-                  svg/SVGMarkerElement.cpp \
-                  svg/SVGMaskElement.cpp \
-                  svg/SVGMetadataElement.cpp \
-                  svg/SVGMissingGlyphElement.cpp \
-                  svg/SVGMPathElement.cpp \
-                  svg/SVGNumberList.cpp \
-                  svg/SVGPaint.cpp \
-                  svg/SVGParserUtilities.cpp \
-                  svg/SVGPathBlender.cpp \
-                  svg/SVGPathBuilder.cpp \
-                  svg/SVGPathByteStreamBuilder.cpp \
-                  svg/SVGPathByteStreamSource.cpp \
-                  svg/SVGPathElement.cpp \
-                  svg/SVGPathParser.cpp \
-                  svg/SVGPathSegList.cpp \
-                  svg/SVGPathSegListBuilder.cpp \
-                  svg/SVGPathSegListSource.cpp \
-                  svg/SVGPathStringBuilder.cpp \
-                  svg/SVGPathStringSource.cpp \
-                  svg/SVGPathTraversalStateBuilder.cpp \
-                  svg/SVGPathUtilities.cpp \
-                  svg/SVGPatternElement.cpp \
-                  svg/SVGPointList.cpp \
-                  svg/SVGPolyElement.cpp \
-                  svg/SVGPolygonElement.cpp \
-                  svg/SVGPolylineElement.cpp \
-                  svg/SVGPreserveAspectRatio.cpp \
-                  svg/SVGRadialGradientElement.cpp \
-                  svg/SVGRectElement.cpp \
-                  svg/SVGSVGElement.cpp \
-                  svg/SVGScriptElement.cpp \
-                  svg/SVGSetElement.cpp \
-                  svg/SVGStopElement.cpp \
-                  svg/SVGStringList.cpp \
-                  svg/SVGStylable.cpp \
-                  svg/SVGStyleElement.cpp \
-                  svg/SVGStyledElement.cpp \
-                  svg/SVGStyledLocatableElement.cpp \
-                  svg/SVGStyledTransformableElement.cpp \
-                  svg/SVGSwitchElement.cpp \
-                  svg/SVGSymbolElement.cpp \
-                  svg/SVGTRefElement.cpp \
-                  svg/SVGTSpanElement.cpp \
-                  svg/SVGTests.cpp \
-                  svg/SVGTextContentElement.cpp \
-                  svg/SVGTextElement.cpp \
-                  svg/SVGTextPathElement.cpp \
-                  svg/SVGTextPositioningElement.cpp \
-                  svg/SVGTitleElement.cpp \
-                  svg/SVGTransform.cpp \
-                  svg/SVGTransformDistance.cpp \
-                  svg/SVGTransformList.cpp \
-                  svg/SVGTransformable.cpp \
-                  svg/SVGURIReference.cpp \
-                  svg/SVGUseElement.cpp \
-                  svg/SVGVKernElement.cpp \
-                  svg/SVGViewElement.cpp \
-                  svg/SVGViewSpec.cpp \
-                  svg/SVGZoomAndPan.cpp \
-                  svg/SVGZoomEvent.cpp
-        }
+              rendering/svg/SVGTextRunRenderingContext.cpp \
+              svg/SVGDocumentExtensions.cpp \
+              svg/ColorDistance.cpp \
+              svg/SVGAElement.cpp \
+              svg/SVGAltGlyphDefElement.cpp \
+              svg/SVGAltGlyphElement.cpp \
+              svg/SVGAltGlyphItemElement.cpp \
+              svg/SVGAngle.cpp \
+              svg/SVGAnimateColorElement.cpp \
+              svg/SVGAnimatedAngle.cpp \
+              svg/SVGAnimatedBoolean.cpp \
+              svg/SVGAnimatedColor.cpp \
+              svg/SVGAnimatedEnumeration.cpp \
+              svg/SVGAnimatedInteger.cpp \
+              svg/SVGAnimatedIntegerOptionalInteger.cpp \
+              svg/SVGAnimatedLength.cpp \
+              svg/SVGAnimatedLengthList.cpp \
+              svg/SVGAnimatedNumber.cpp \
+              svg/SVGAnimatedNumberList.cpp \
+              svg/SVGAnimatedNumberOptionalNumber.cpp \
+              svg/SVGAnimatedPath.cpp \
+              svg/SVGAnimatedPointList.cpp \
+              svg/SVGAnimatedPreserveAspectRatio.cpp \
+              svg/SVGAnimatedRect.cpp \
+              svg/SVGAnimatedString.cpp \
+              svg/SVGAnimatedTransformList.cpp \
+              svg/SVGAnimatedType.cpp \
+              svg/SVGAnimateElement.cpp \
+              svg/SVGAnimateMotionElement.cpp \
+              svg/SVGAnimateTransformElement.cpp \
+              svg/SVGAnimationElement.cpp \
+              svg/SVGCircleElement.cpp \
+              svg/SVGClipPathElement.cpp \
+              svg/SVGColor.cpp \
+              svg/SVGComponentTransferFunctionElement.cpp \
+              svg/SVGCursorElement.cpp \
+              svg/SVGDefsElement.cpp \
+              svg/SVGDescElement.cpp \
+              svg/SVGDocument.cpp \
+              svg/SVGElement.cpp \
+              svg/SVGElementInstance.cpp \
+              svg/SVGElementInstanceList.cpp \
+              svg/SVGEllipseElement.cpp \
+              svg/SVGException.cpp \
+              svg/SVGExternalResourcesRequired.cpp \
+              svg/SVGFEBlendElement.cpp \
+              svg/SVGFEColorMatrixElement.cpp \
+              svg/SVGFEComponentTransferElement.cpp \
+              svg/SVGFECompositeElement.cpp \
+              svg/SVGFEConvolveMatrixElement.cpp \
+              svg/SVGFEDiffuseLightingElement.cpp \
+              svg/SVGFEDisplacementMapElement.cpp \
+              svg/SVGFEDistantLightElement.cpp \
+              svg/SVGFEDropShadowElement.cpp \
+              svg/SVGFEFloodElement.cpp \
+              svg/SVGFEFuncAElement.cpp \
+              svg/SVGFEFuncBElement.cpp \
+              svg/SVGFEFuncGElement.cpp \
+              svg/SVGFEFuncRElement.cpp \
+              svg/SVGFEGaussianBlurElement.cpp \
+              svg/SVGFEImageElement.cpp \
+              svg/SVGFELightElement.cpp \
+              svg/SVGFEMergeElement.cpp \
+              svg/SVGFEMergeNodeElement.cpp \
+              svg/SVGFEMorphologyElement.cpp \
+              svg/SVGFEOffsetElement.cpp \
+              svg/SVGFEPointLightElement.cpp \
+              svg/SVGFESpecularLightingElement.cpp \
+              svg/SVGFESpotLightElement.cpp \
+              svg/SVGFETileElement.cpp \
+              svg/SVGFETurbulenceElement.cpp \
+              svg/SVGFilterElement.cpp \
+              svg/SVGFilterPrimitiveStandardAttributes.cpp \
+              svg/SVGFitToViewBox.cpp \
+              svg/SVGFontData.cpp \
+              svg/SVGFontElement.cpp \
+              svg/SVGFontFaceElement.cpp \
+              svg/SVGFontFaceFormatElement.cpp \
+              svg/SVGFontFaceNameElement.cpp \
+              svg/SVGFontFaceSrcElement.cpp \
+              svg/SVGFontFaceUriElement.cpp \
+              svg/SVGForeignObjectElement.cpp \
+              svg/SVGGElement.cpp \
+              svg/SVGGlyphElement.cpp \
+              svg/SVGGlyphRefElement.cpp \
+              svg/SVGGradientElement.cpp \
+              svg/SVGHKernElement.cpp \
+              svg/SVGImageElement.cpp \
+              svg/SVGImageLoader.cpp \
+              svg/SVGLangSpace.cpp \
+              svg/SVGLength.cpp \
+              svg/SVGLengthContext.cpp \
+              svg/SVGLengthList.cpp \
+              svg/SVGLinearGradientElement.cpp \
+              svg/SVGLineElement.cpp \
+              svg/SVGLocatable.cpp \
+              svg/SVGMarkerElement.cpp \
+              svg/SVGMaskElement.cpp \
+              svg/SVGMetadataElement.cpp \
+              svg/SVGMissingGlyphElement.cpp \
+              svg/SVGMPathElement.cpp \
+              svg/SVGNumberList.cpp \
+              svg/SVGPaint.cpp \
+              svg/SVGParserUtilities.cpp \
+              svg/SVGPathBlender.cpp \
+              svg/SVGPathBuilder.cpp \
+              svg/SVGPathByteStreamBuilder.cpp \
+              svg/SVGPathByteStreamSource.cpp \
+              svg/SVGPathElement.cpp \
+              svg/SVGPathParser.cpp \
+              svg/SVGPathSegList.cpp \
+              svg/SVGPathSegListBuilder.cpp \
+              svg/SVGPathSegListSource.cpp \
+              svg/SVGPathStringBuilder.cpp \
+              svg/SVGPathStringSource.cpp \
+              svg/SVGPathTraversalStateBuilder.cpp \
+              svg/SVGPathUtilities.cpp \
+              svg/SVGPatternElement.cpp \
+              svg/SVGPointList.cpp \
+              svg/SVGPolyElement.cpp \
+              svg/SVGPolygonElement.cpp \
+              svg/SVGPolylineElement.cpp \
+              svg/SVGPreserveAspectRatio.cpp \
+              svg/SVGRadialGradientElement.cpp \
+              svg/SVGRectElement.cpp \
+              svg/SVGSVGElement.cpp \
+              svg/SVGScriptElement.cpp \
+              svg/SVGSetElement.cpp \
+              svg/SVGStopElement.cpp \
+              svg/SVGStringList.cpp \
+              svg/SVGStylable.cpp \
+              svg/SVGStyleElement.cpp \
+              svg/SVGStyledElement.cpp \
+              svg/SVGStyledLocatableElement.cpp \
+              svg/SVGStyledTransformableElement.cpp \
+              svg/SVGSwitchElement.cpp \
+              svg/SVGSymbolElement.cpp \
+              svg/SVGTRefElement.cpp \
+              svg/SVGTSpanElement.cpp \
+              svg/SVGTests.cpp \
+              svg/SVGTextContentElement.cpp \
+              svg/SVGTextElement.cpp \
+              svg/SVGTextPathElement.cpp \
+              svg/SVGTextPositioningElement.cpp \
+              svg/SVGTitleElement.cpp \
+              svg/SVGTransform.cpp \
+              svg/SVGTransformDistance.cpp \
+              svg/SVGTransformList.cpp \
+              svg/SVGTransformable.cpp \
+              svg/SVGURIReference.cpp \
+              svg/SVGUseElement.cpp \
+              svg/SVGVKernElement.cpp \
+              svg/SVGViewElement.cpp \
+              svg/SVGViewSpec.cpp \
+              svg/SVGZoomAndPan.cpp \
+              svg/SVGZoomEvent.cpp
    }
 }
 
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index fffc26b13..6775e952d 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -74,7 +74,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8AudioContextCustom.cpp
     bindings/v8/custom/V8CSSRuleCustom.cpp
     bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
-    bindings/v8/custom/V8CSSStyleSheetCustom.cpp
     bindings/v8/custom/V8CSSValueCustom.cpp
     bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
     bindings/v8/custom/V8ClipboardCustom.cpp
@@ -85,7 +84,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8CustomXPathNSResolver.cpp
     bindings/v8/custom/V8DOMFormDataCustom.cpp
     bindings/v8/custom/V8DOMStringMapCustom.cpp
-    bindings/v8/custom/V8DOMTokenListCustom.cpp
     bindings/v8/custom/V8DOMWindowCustom.cpp
     bindings/v8/custom/V8DataViewCustom.cpp
     bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -140,6 +138,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8NotificationCustom.cpp
     bindings/v8/custom/V8NotificationCenterCustom.cpp
     bindings/v8/custom/V8PerformanceCustom.cpp
+    bindings/v8/custom/V8PerformanceEntryCustom.cpp
     bindings/v8/custom/V8PopStateEventCustom.cpp
     bindings/v8/custom/V8SQLResultSetRowListCustom.cpp
     bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -147,7 +146,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8StorageCustom.cpp
     bindings/v8/custom/V8StyleSheetCustom.cpp
     bindings/v8/custom/V8StyleSheetListCustom.cpp
-    bindings/v8/custom/V8TextTrackListCustom.cpp
     bindings/v8/custom/V8Uint16ArrayCustom.cpp
     bindings/v8/custom/V8Uint32ArrayCustom.cpp
     bindings/v8/custom/V8Uint8ArrayCustom.cpp
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index da8f94422..abddfb722 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -254,7 +254,7 @@ __ZN7WebCore14DocumentWriter11setEncodingERKN3WTF6StringEb
 __ZN7WebCore14FileIconLoader14notifyFinishedEN3WTF10PassRefPtrINS_4IconEEE
 __ZN7WebCore14FrameSelection10setFocusedEb
 __ZN7WebCore14FrameSelection12setSelectionERKNS_16VisibleSelectionEjNS0_19CursorAlignOnScrollENS_15TextGranularityE
-__ZN7WebCore14FrameSelection15revealSelectionERKNS_15ScrollAlignmentEb
+__ZN7WebCore14FrameSelection15revealSelectionERKNS_15ScrollAlignmentENS_18RevealExtentOptionE
 __ZN7WebCore14FrameSelection16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
 __ZN7WebCore14FrameSelection19absoluteCaretBoundsEv
 __ZN7WebCore14FrameSelection20setSelectionFromNoneEv
@@ -613,7 +613,7 @@ __ZN7WebCore26UserTypingGestureIndicator28focusedElementAtGestureStartEv
 __ZN7WebCore26stopObservingCookieChangesEv
 __ZN7WebCore27AuthenticationChallengeBaseC2Ev
 __ZN7WebCore27CSSComputedStyleDeclarationC1EN3WTF10PassRefPtrINS_4NodeEEEbRKNS1_6StringE
-__ZN7WebCore27DeviceOrientationClientMock14setOrientationEN3WTF10PassRefPtrINS_17DeviceOrientationEEE
+__ZN7WebCore27DeviceOrientationClientMock14setOrientationEN3WTF10PassRefPtrINS_21DeviceOrientationDataEEE
 __ZN7WebCore27DeviceOrientationClientMockC1Ev
 __ZN7WebCore27startObservingCookieChangesEv
 __ZN7WebCore28encodeWithURLEscapeSequencesERKN3WTF6StringE
@@ -802,6 +802,7 @@ __ZN7WebCore7RunLoop21initializeMainRunLoopEv
 __ZN7WebCore7RunLoop3runEv
 __ZN7WebCore7RunLoop4mainEv
 __ZN7WebCore7RunLoop4stopEv
+__ZN7WebCore7RunLoop6wakeUpEv
 __ZN7WebCore7RunLoop7currentEv
 __ZN7WebCore7RunLoop8dispatchERKN3WTF8FunctionIFvvEEE
 __ZN7WebCore7RunLoop9TimerBase4stopEv
@@ -1524,7 +1525,7 @@ __ZN7WebCore16FontPlatformDataC1EP6NSFontfbbbNS_15FontOrientationENS_15TextOrien
 __ZN7WebCore16FontPlatformDataC2EP6NSFontfbbbNS_15FontOrientationENS_15TextOrientationENS_16FontWidthVariantE
 __ZN7WebCore16colorFromNSColorEP7NSColor
 __ZN7WebCore16enclosingIntRectERK7_NSRect
-__ZN7WebCore17DeviceOrientation6createEbdbdbdbb
+__ZN7WebCore21DeviceOrientationData6createEbdbdbdbb
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore19applicationIsSafariEv
 __ZN7WebCore20PlatformEventFactory24createPlatformMouseEventEP7NSEventP6NSView
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index d95f4cdb5..cfca7714e 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -275,7 +275,7 @@
         'cflags!': ['-g'],
       },
     }],
-    ['os_posix==1 and OS!="mac" and OS!="android" and gcc_version==46', {
+    ['os_posix==1 and OS!="mac" and gcc_version==46', {
       'target_defaults': {
         # Disable warnings about c++0x compatibility, as some names (such as nullptr) conflict
         # with upcoming c++0x types.
@@ -441,21 +441,21 @@
       'type': 'none',
       'actions': [
         {
-          'action_name': 'generateInjectedWebGLScriptSource',
+          'action_name': 'generateInjectedScriptWebGLModuleSource',
           'inputs': [
-            '../inspector/InjectedWebGLScriptSource.js',
+            '../inspector/InjectedScriptWebGLModuleSource.js',
           ],
           'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/webkit/InjectedWebGLScriptSource.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/InjectedScriptWebGLModuleSource.h',
           ],
           'action': [
             'perl',
             '../inspector/xxd.pl',
-            'InjectedWebGLScriptSource_js',
+            'InjectedScriptWebGLModuleSource_js',
             '<@(_inputs)',
             '<@(_outputs)'
           ],
-          'message': 'Generating InjectedWebGLScriptSource.h from InjectedWebGLScriptSource.js',
+          'message': 'Generating InjectedScriptWebGLModuleSource.h from InjectedScriptWebGLModuleSource.js',
         },
       ]
     },
@@ -1825,7 +1825,7 @@
         },{ # OS!="mac"
           'sources/': [['exclude', 'Mac\\.(cpp|mm?)$']]
         }],
-        ['os_posix == 1 and OS != "mac" and OS != "android" and gcc_version == 42', {
+        ['os_posix == 1 and OS != "mac" and gcc_version == 42', {
           # Due to a bug in gcc 4.2.1 (the current version on hardy), we get
           # warnings about uninitialized this.
           'cflags': ['-Wno-uninitialized'],
@@ -1979,7 +1979,7 @@
             ['exclude', '/(Windows|Uniscribe)[^/]*\\.cpp$']
           ],
         }],
-        ['os_posix == 1 and OS != "mac" and OS != "android" and gcc_version == 42', {
+        ['os_posix == 1 and OS != "mac" and gcc_version == 42', {
           # Due to a bug in gcc 4.2.1 (the current version on hardy), we get
           # warnings about uninitialized this.
           'cflags': ['-Wno-uninitialized'],
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index c8974d2d6..d73e670ea 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -625,8 +625,8 @@
             'dom/DOMTimeStamp.h',
             'dom/DeviceMotionClient.h',
             'dom/DeviceMotionData.h',
-            'dom/DeviceOrientation.h',
             'dom/DeviceOrientationClient.h',
+            'dom/DeviceOrientationData.h',
             'dom/Document.h',
             'dom/DocumentFragment.h',
             'dom/DocumentMarker.h',
@@ -1167,6 +1167,7 @@
             'page/PerformanceEntry.idl',
             'page/PerformanceEntryList.idl',
             'page/PerformanceNavigation.idl',
+            'page/PerformanceResourceTiming.idl',
             'page/PerformanceTiming.idl',
             'page/PointerLock.idl',
             'page/Screen.idl',
@@ -1491,6 +1492,7 @@
             'Modules/indexeddb/IDBLevelDBCoding.h',
             'Modules/indexeddb/IDBLevelDBBackingStore.cpp',
             'Modules/indexeddb/IDBLevelDBBackingStore.h',
+            'Modules/indexeddb/IDBMetadata.h',
             'Modules/indexeddb/IDBObjectStore.cpp',
             'Modules/indexeddb/IDBObjectStore.h',
             'Modules/indexeddb/IDBObjectStoreBackendImpl.cpp',
@@ -2262,7 +2264,6 @@
             'bindings/v8/custom/V8BlobCustom.cpp',
             'bindings/v8/custom/V8CSSRuleCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
-            'bindings/v8/custom/V8CSSStyleSheetCustom.cpp',
             'bindings/v8/custom/V8CSSValueCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
@@ -2275,7 +2276,6 @@
             'bindings/v8/custom/V8CustomXPathNSResolver.h',
             'bindings/v8/custom/V8DOMFormDataCustom.cpp',
             'bindings/v8/custom/V8DOMStringMapCustom.cpp',
-            'bindings/v8/custom/V8DOMTokenListCustom.cpp',
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
@@ -2335,6 +2335,7 @@
             'bindings/v8/custom/V8NotificationCustom.cpp',
             'bindings/v8/custom/V8NotificationCenterCustom.cpp',
             'bindings/v8/custom/V8PerformanceCustom.cpp',
+            'bindings/v8/custom/V8PerformanceEntryCustom.cpp',
             'bindings/v8/custom/V8PopStateEventCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
@@ -2348,7 +2349,6 @@
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
-            'bindings/v8/custom/V8TextTrackListCustom.cpp',
             'bindings/v8/custom/V8TrackEventCustom.cpp',
             'bindings/v8/custom/V8Uint16ArrayCustom.cpp',
             'bindings/v8/custom/V8Uint32ArrayCustom.cpp',
@@ -2753,6 +2753,7 @@
             'icu/unicode/utf_old.h',
             'icu/unicode/utypes.h',
             'icu/unicode/uversion.h',
+            'inspector/BindingVisitors.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
             'inspector/ContentSearchUtils.cpp',
@@ -2763,7 +2764,6 @@
             'inspector/DOMNodeHighlighter.h',
             'inspector/DOMPatchSupport.cpp',
             'inspector/DOMPatchSupport.h',
-            'inspector/DOMWrapperVisitor.h',
             'inspector/IdentifiersFactory.cpp',
             'inspector/IdentifiersFactory.h',
             'inspector/InjectedScript.cpp',
@@ -2774,6 +2774,10 @@
             'inspector/InjectedScriptHost.h',
             'inspector/InjectedScriptManager.cpp',
             'inspector/InjectedScriptManager.h',
+            'inspector/InjectedScriptModule.cpp',
+            'inspector/InjectedScriptModule.h',
+            'inspector/InjectedScriptWebGLModule.cpp',
+            'inspector/InjectedScriptWebGLModule.h',
             'inspector/InspectorAgent.cpp',
             'inspector/InspectorApplicationCacheAgent.cpp',
             'inspector/InspectorApplicationCacheAgent.h',
@@ -3068,6 +3072,8 @@
             'page/PerformanceEntryList.h',
             'page/PerformanceNavigation.cpp',
             'page/PerformanceNavigation.h',
+            'page/PerformanceResourceTiming.cpp',
+            'page/PerformanceResourceTiming.h',
             'page/PerformanceTiming.cpp',
             'page/PerformanceTiming.h',
             'page/PointerLock.cpp',
@@ -3810,8 +3816,8 @@
             'platform/graphics/filters/CustomFilterParameter.h',
             'platform/graphics/filters/CustomFilterProgram.cpp',
             'platform/graphics/filters/CustomFilterProgram.h',
-            'platform/graphics/filters/CustomFilterShader.cpp',
-            'platform/graphics/filters/CustomFilterShader.h',
+            'platform/graphics/filters/CustomFilterCompiledProgram.cpp',
+            'platform/graphics/filters/CustomFilterCompiledProgram.h',
             'platform/graphics/filters/CustomFilterMesh.cpp',
             'platform/graphics/filters/DistantLightSource.cpp',
             'platform/graphics/filters/DistantLightSource.h',
@@ -4839,6 +4845,8 @@
             'rendering/RenderFrameSet.h',
             'rendering/RenderFullScreen.cpp',
             'rendering/RenderFullScreen.h',
+            'rendering/RenderGrid.cpp',
+            'rendering/RenderGrid.h',
             'rendering/RenderGeometryMap.cpp',
             'rendering/RenderGeometryMap.h',
             'rendering/RenderHTMLCanvas.cpp',
@@ -5284,9 +5292,9 @@
             'dom/DeviceMotionData.h',
             'dom/DeviceMotionEvent.cpp',
             'dom/DeviceMotionEvent.h',
-            'dom/DeviceOrientation.cpp',
             'dom/DeviceOrientationController.cpp',
             'dom/DeviceOrientationController.h',
+            'dom/DeviceOrientationData.cpp',
             'dom/DeviceOrientationEvent.cpp',
             'dom/DeviceOrientationEvent.h',
             'dom/Document.cpp',
@@ -5335,6 +5343,7 @@
             'dom/IconURL.cpp',
             'dom/IconURL.h',
             'dom/KeyboardEvent.cpp',
+            'dom/MemoryInstrumentation.h',
             'dom/MessageChannel.cpp',
             'dom/MessageChannel.h',
             'dom/MessageEvent.cpp',
@@ -7264,7 +7273,7 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HeaderDetection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InjectedScriptSource.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/InjectedWebGLScriptSource.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/InjectedScriptWebGLModuleSource.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InspectorBackendDispatcher.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InspectorBackendDispatcher.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InspectorBackendCommands.js',
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 619e829f7..a002e29da 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -594,7 +594,7 @@
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\InjectedWebGLScriptSource.h"
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\InjectedScriptWebGLModuleSource.h"
 				>
 			</File>
 			<File
@@ -26879,6 +26879,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\PerformanceResourceTiming.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\PerformanceResourceTiming.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\PerformanceTiming.cpp"
 				>
 			</File>
@@ -31469,11 +31477,11 @@
 						>
 					</File>
 					<File
-						RelativePath="..\platform\graphics\filters\CustomFilterShader.cpp"
+						RelativePath="..\platform\graphics\filters\CustomFilterCompiledProgram.cpp"
 						>
 					</File>
 					<File
-						RelativePath="..\platform\graphics\filters\CustomFilterShader.h"
+						RelativePath="..\platform\graphics\filters\CustomFilterCompiledProgram.h"
 						>
 					</File>
 					<File
@@ -39546,6 +39554,14 @@
 				RelativePath="..\rendering\RenderGeometryMap.h"
 				>
 			</File>
+                        <File
+				RelativePath="..\rendering\RenderGrid.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\rendering\RenderGrid.h"
+				>
+			</File>
 			<File
 				RelativePath="..\rendering\RenderHTMLCanvas.cpp"
 				>
@@ -49231,7 +49247,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\DeviceOrientation.cpp"
+				RelativePath="..\dom\DeviceOrientationClient.h"
+				>
+			</File>
+			<File
+				RelativePath="..\dom\DeviceOrientationController.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -49283,15 +49303,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\dom\DeviceOrientation.h"
-				>
-			</File>
-			<File
-				RelativePath="..\dom\DeviceOrientationClient.h"
+				RelativePath="..\dom\DeviceOrientationController.h"
 				>
 			</File>
 			<File
-				RelativePath="..\dom\DeviceOrientationController.cpp"
+				RelativePath="..\dom\DeviceOrientationData.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -49343,9 +49359,9 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\dom\DeviceOrientationController.h"
+				RelativePath="..\dom\DeviceOrientationData.h"
 				>
-			</File>
+			</File>	
 			<File
 				RelativePath="..\dom\DeviceOrientationEvent.cpp"
 				>
@@ -51175,6 +51191,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\MemoryInstrumentation.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\MessageChannel.cpp"
 				>
 				<FileConfiguration
@@ -73167,6 +73187,10 @@
 			Name="inspector"
 			>
 			<File
+				RelativePath="..\inspector\BindingVisitors.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\ConsoleMessage.cpp"
 				>
 				<FileConfiguration
@@ -73287,10 +73311,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\inspector\DOMWrapperVisitor.h"
-				>
-			</File>
-			<File
 				RelativePath="..\inspector\IdentifiersFactory.cpp"
 				>
 				<FileConfiguration
@@ -73411,6 +73431,54 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InjectedScriptModule.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\InjectedScriptModule.h"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InjectedScriptWebGLModule.cpp"
+				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\inspector\InjectedScriptWebGLModule.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorAgent.cpp"
 				>
 				<FileConfiguration
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index be8b5fd24..07f929236 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -1428,6 +1428,7 @@
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205512EAE7B3005C2874 /* InspectorAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */; };
 		4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */; };
 		4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3289B411A42AAB005ABE7E /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1465,8 +1466,8 @@
 		50D403C814768C9400D30BB5 /* FECustomFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D403C614768C9400D30BB5 /* FECustomFilter.h */; };
 		50D405F9147D31F300D30BB5 /* CustomFilterMesh.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */; };
 		50D405FA147D31F300D30BB5 /* CustomFilterMesh.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */; };
-		50D40611147D49DE00D30BB5 /* CustomFilterShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D4060F147D49DE00D30BB5 /* CustomFilterShader.cpp */; };
-		50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D40610147D49DE00D30BB5 /* CustomFilterShader.h */; };
+		50D40611147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */; };
+		50D40612147D49DE00D30BB5 /* CustomFilterCompiledProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */; };
 		50E566D6139E38C500214433 /* CSSWrapShapes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 501BAAB11395114B00F7ACEB /* CSSWrapShapes.cpp */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5101846A0B08602A004A825F /* CachedPage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510184680B08602A004A825F /* CachedPage.cpp */; };
@@ -1603,7 +1604,7 @@
 		57CF4C8714F7597A00ECFF14 /* ElementShadow.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF4C8514F7597A00ECFF14 /* ElementShadow.h */; };
 		5905ADBF1302F3CE00F116DF /* XMLTreeViewer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */; };
 		5905ADC01302F3CE00F116DF /* XMLTreeViewer.h in Headers */ = {isa = PBXBuildFile; fileRef = 5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */; };
-		590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		590E1B4911E4EF4B0069F784 /* DeviceOrientationData.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientationData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		590E1B4B11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */; };
 		59102FBB14327D3B003C9D04 /* ContentSearchUtils.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59102FB914327D3B003C9D04 /* ContentSearchUtils.cpp */; };
 		59102FBC14327D3B003C9D04 /* ContentSearchUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 59102FBA14327D3B003C9D04 /* ContentSearchUtils.h */; };
@@ -1639,7 +1640,7 @@
 		59C27F07138D28CF0079B7E2 /* NetworkResourcesData.h in Headers */ = {isa = PBXBuildFile; fileRef = 59C27F06138D28CF0079B7E2 /* NetworkResourcesData.h */; };
 		59C28045138DC2410079B7E2 /* XMLErrors.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59C28043138DC2410079B7E2 /* XMLErrors.cpp */; };
 		59C28046138DC2410079B7E2 /* XMLErrors.h in Headers */ = {isa = PBXBuildFile; fileRef = 59C28044138DC2410079B7E2 /* XMLErrors.h */; };
-		59D1C10411EB5DCF00B638C8 /* DeviceOrientation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59D1C10311EB5DCF00B638C8 /* DeviceOrientation.cpp */; };
+		59D1C10411EB5DCF00B638C8 /* DeviceOrientationData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59D1C10311EB5DCF00B638C8 /* DeviceOrientationData.cpp */; };
 		59DE790413F16C7F0007FCDF /* JavaMethodJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59DE790313F16C7F0007FCDF /* JavaMethodJSC.cpp */; };
 		59DE790613F16C8C0007FCDF /* JavaMethodJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59DE790513F16C8C0007FCDF /* JavaMethodJSC.h */; };
 		59E560A71105336600AA1258 /* JavaClassJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59E560A61105336600AA1258 /* JavaClassJSC.h */; };
@@ -1779,12 +1780,12 @@
 		6E21C6C01126338500A7BE02 /* GraphicsContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E21C6BF1126338500A7BE02 /* GraphicsContext3D.cpp */; };
 		6E21C6C21126339900A7BE02 /* GraphicsContext3DCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E21C6C11126339900A7BE02 /* GraphicsContext3DCG.cpp */; };
 		6E3FAD3814733F4000E42306 /* JSWebGLCompressedTextureS3TC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E3FAD3614733F4000E42306 /* JSWebGLCompressedTextureS3TC.cpp */; };
-		6E3FAD3914733F4000E42306 /* JSWebGLCompressedTextureS3TC.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAD3714733F4000E42306 /* JSWebGLCompressedTextureS3TC.h */; };
-		6E3FAE8E14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E3FAE8C14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp */; };
-		6E3FAE8F14733FDB00E42306 /* WebGLCompressedTextureS3TC.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAE8D14733FDB00E42306 /* WebGLCompressedTextureS3TC.h */; };
 		6E3FAD3814733F4000E42307 /* JSWebGLDepthTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E3FAD3614733F4000E42307 /* JSWebGLDepthTexture.cpp */; };
+		6E3FAD3914733F4000E42306 /* JSWebGLCompressedTextureS3TC.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAD3714733F4000E42306 /* JSWebGLCompressedTextureS3TC.h */; };
 		6E3FAD3914733F4000E42307 /* JSWebGLDepthTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAD3714733F4000E42307 /* JSWebGLDepthTexture.h */; };
+		6E3FAE8E14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E3FAE8C14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp */; };
 		6E3FAE8E14733FDB00E42307 /* WebGLDepthTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E3FAE8C14733FDB00E42307 /* WebGLDepthTexture.cpp */; };
+		6E3FAE8F14733FDB00E42306 /* WebGLCompressedTextureS3TC.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAE8D14733FDB00E42306 /* WebGLCompressedTextureS3TC.h */; };
 		6E3FAE8F14733FDB00E42307 /* WebGLDepthTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E3FAE8D14733FDB00E42307 /* WebGLDepthTexture.h */; };
 		6E47E66010B7944B00B186C8 /* WebGLGetInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */; };
 		6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */; };
@@ -2898,6 +2899,8 @@
 		861C2EA413FB4FDD00062ABB /* DocumentLoadTiming.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 861C2EA313FB4FDD00062ABB /* DocumentLoadTiming.cpp */; };
 		861C2EA613FB4FFF00062ABB /* ResourceLoadTiming.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 861C2EA513FB4FFF00062ABB /* ResourceLoadTiming.cpp */; };
 		86243D0111BC31F700CC006A /* JSArrayBufferViewHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = 86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */; };
+		86512EDE154A2AEF00A90426 /* PerformanceResourceTiming.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86512EDB154A2AEE00A90426 /* PerformanceResourceTiming.cpp */; };
+		86512EDF154A2AEF00A90426 /* PerformanceResourceTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 86512EDC154A2AEF00A90426 /* PerformanceResourceTiming.h */; };
 		86BE340015058CB200CE0FD8 /* PerformanceEntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BE33FA15058CB200CE0FD8 /* PerformanceEntry.cpp */; };
 		86BE340115058CB200CE0FD8 /* PerformanceEntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BE33FB15058CB200CE0FD8 /* PerformanceEntry.h */; };
 		86BE340315058CB200CE0FD8 /* PerformanceEntryList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BE33FD15058CB200CE0FD8 /* PerformanceEntryList.cpp */; };
@@ -4465,8 +4468,12 @@
 		AA21ECCD0ABF0FC6002B834C /* CSSCursorImageValue.h in Headers */ = {isa = PBXBuildFile; fileRef = AA0978EE0ABAA6E100874480 /* CSSCursorImageValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		AA4C3A760B2B1679002334A2 /* StyleElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AA4C3A740B2B1679002334A2 /* StyleElement.cpp */; };
 		AA4C3A770B2B1679002334A2 /* StyleElement.h in Headers */ = {isa = PBXBuildFile; fileRef = AA4C3A750B2B1679002334A2 /* StyleElement.h */; };
+		AA73183E159255B900A93E6E /* InjectedScriptWebGLModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AA73183C159255B900A93E6E /* InjectedScriptWebGLModule.cpp */; };
+		AA73183F159255B900A93E6E /* InjectedScriptWebGLModule.h in Headers */ = {isa = PBXBuildFile; fileRef = AA73183D159255B900A93E6E /* InjectedScriptWebGLModule.h */; };
 		AAB6054E15874C58007B5031 /* InjectedScriptBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AAB6054A15874C58007B5031 /* InjectedScriptBase.cpp */; };
 		AAB6054F15874C58007B5031 /* InjectedScriptBase.h in Headers */ = {isa = PBXBuildFile; fileRef = AAB6054B15874C58007B5031 /* InjectedScriptBase.h */; };
+		AAB6055015874C58007B5031 /* InjectedScriptModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AAB6054C15874C58007B5031 /* InjectedScriptModule.cpp */; };
+		AAB6055115874C58007B5031 /* InjectedScriptModule.h in Headers */ = {isa = PBXBuildFile; fileRef = AAB6054D15874C58007B5031 /* InjectedScriptModule.h */; };
 		AAD766EB157E502F00E85423 /* InspectorWebGLAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AAD766E8157E502F00E85423 /* InspectorWebGLAgent.cpp */; };
 		AAD766EC157E502F00E85423 /* InspectorWebGLAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = AAD766E9157E502F00E85423 /* InspectorWebGLAgent.h */; };
 		AAD766ED157E502F00E85423 /* InspectorWebGLInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = AAD766EA157E502F00E85423 /* InspectorWebGLInstrumentation.h */; };
@@ -5223,6 +5230,8 @@
 		BC124EE80C2641CD009E2349 /* BarInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC124EE50C2641CD009E2349 /* BarInfo.h */; };
 		BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC124EFD0C26447A009E2349 /* JSBarInfo.cpp */; };
 		BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC124EFE0C26447A009E2349 /* JSBarInfo.h */; };
+		BC128A73137C867C00CAC845 /* RenderGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = BC128A72137C867C00CAC845 /* RenderGrid.h */; };
+		BC128B01137C8D4600CAC845 /* RenderGrid.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC128B00137C8D4600CAC845 /* RenderGrid.cpp */; };
 		BC14028A0E83680800319717 /* ScrollbarThemeComposite.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC1402880E83680800319717 /* ScrollbarThemeComposite.cpp */; };
 		BC14028B0E83680800319717 /* ScrollbarThemeComposite.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1402890E83680800319717 /* ScrollbarThemeComposite.h */; };
 		BC17F9660B64EBB8004A65CB /* JSHTMLSelectElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC17F9650B64EBB8004A65CB /* JSHTMLSelectElementCustom.cpp */; };
@@ -6111,7 +6120,7 @@
 		F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */; };
 		F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */; };
 		F350B73513F1377D00880C43 /* InstrumentingAgents.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F350B73413F1377D00880C43 /* InstrumentingAgents.cpp */; };
-		F35AE5AC14925F5B004D5776 /* DOMWrapperVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = F35AE5AB14925F5B004D5776 /* DOMWrapperVisitor.h */; };
+		F35AE5AC14925F5B004D5776 /* BindingVisitors.h in Headers */ = {isa = PBXBuildFile; fileRef = F35AE5AB14925F5B004D5776 /* BindingVisitors.h */; };
 		F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3644AFD1119805900E0D537 /* InjectedScript.cpp */; };
 		F3644B001119805900E0D537 /* InjectedScript.h in Headers */ = {isa = PBXBuildFile; fileRef = F3644AFE1119805900E0D537 /* InjectedScript.h */; };
 		F36E07A41358A8BE00AACBC9 /* WorkerInspectorController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F36E07A21358A8BE00AACBC9 /* WorkerInspectorController.cpp */; };
@@ -8493,6 +8502,7 @@
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
 		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
+		4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentation.h; sourceTree = "<group>"; };
 		4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorAgent.cpp; sourceTree = "<group>"; };
 		4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorValues.cpp; sourceTree = "<group>"; };
 		4F3289B411A42AAB005ABE7E /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
@@ -8533,8 +8543,8 @@
 		50D403C614768C9400D30BB5 /* FECustomFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FECustomFilter.h; path = filters/FECustomFilter.h; sourceTree = "<group>"; };
 		50D405F7147D31F300D30BB5 /* CustomFilterMesh.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterMesh.cpp; path = filters/CustomFilterMesh.cpp; sourceTree = "<group>"; };
 		50D405F8147D31F300D30BB5 /* CustomFilterMesh.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterMesh.h; path = filters/CustomFilterMesh.h; sourceTree = "<group>"; };
-		50D4060F147D49DE00D30BB5 /* CustomFilterShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterShader.cpp; path = filters/CustomFilterShader.cpp; sourceTree = "<group>"; };
-		50D40610147D49DE00D30BB5 /* CustomFilterShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterShader.h; path = filters/CustomFilterShader.h; sourceTree = "<group>"; };
+		50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CustomFilterCompiledProgram.cpp; path = filters/CustomFilterCompiledProgram.cpp; sourceTree = "<group>"; };
+		50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomFilterCompiledProgram.h; path = filters/CustomFilterCompiledProgram.h; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
 		510184680B08602A004A825F /* CachedPage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedPage.cpp; sourceTree = "<group>"; };
 		510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamErrorBase.cpp; sourceTree = "<group>"; };
@@ -8678,7 +8688,7 @@
 		57CF4C8514F7597A00ECFF14 /* ElementShadow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ElementShadow.h; sourceTree = "<group>"; };
 		5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTreeViewer.cpp; sourceTree = "<group>"; };
 		5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTreeViewer.h; sourceTree = "<group>"; };
-		590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientation.h; sourceTree = "<group>"; };
+		590E1B4811E4EF4B0069F784 /* DeviceOrientationData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientationData.h; sourceTree = "<group>"; };
 		590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDeviceOrientationEventCustom.cpp; sourceTree = "<group>"; };
 		59102FB914327D3B003C9D04 /* ContentSearchUtils.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSearchUtils.cpp; sourceTree = "<group>"; };
 		59102FBA14327D3B003C9D04 /* ContentSearchUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSearchUtils.h; sourceTree = "<group>"; };
@@ -8717,7 +8727,7 @@
 		59C27F06138D28CF0079B7E2 /* NetworkResourcesData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkResourcesData.h; sourceTree = "<group>"; };
 		59C28043138DC2410079B7E2 /* XMLErrors.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLErrors.cpp; sourceTree = "<group>"; };
 		59C28044138DC2410079B7E2 /* XMLErrors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLErrors.h; sourceTree = "<group>"; };
-		59D1C10311EB5DCF00B638C8 /* DeviceOrientation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeviceOrientation.cpp; sourceTree = "<group>"; };
+		59D1C10311EB5DCF00B638C8 /* DeviceOrientationData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeviceOrientationData.cpp; sourceTree = "<group>"; };
 		59DE790313F16C7F0007FCDF /* JavaMethodJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaMethodJSC.cpp; path = jsc/JavaMethodJSC.cpp; sourceTree = "<group>"; };
 		59DE790513F16C8C0007FCDF /* JavaMethodJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaMethodJSC.h; path = jsc/JavaMethodJSC.h; sourceTree = "<group>"; };
 		59E560A61105336600AA1258 /* JavaClassJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaClassJSC.h; path = jsc/JavaClassJSC.h; sourceTree = "<group>"; };
@@ -8862,14 +8872,14 @@
 		6E21C6BF1126338500A7BE02 /* GraphicsContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContext3D.cpp; sourceTree = "<group>"; };
 		6E21C6C11126339900A7BE02 /* GraphicsContext3DCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContext3DCG.cpp; sourceTree = "<group>"; };
 		6E3FAD3614733F4000E42306 /* JSWebGLCompressedTextureS3TC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLCompressedTextureS3TC.cpp; sourceTree = "<group>"; };
-		6E3FAD3714733F4000E42306 /* JSWebGLCompressedTextureS3TC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLCompressedTextureS3TC.h; sourceTree = "<group>"; };
-		6E3FAE8C14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLCompressedTextureS3TC.cpp; path = canvas/WebGLCompressedTextureS3TC.cpp; sourceTree = "<group>"; };
-		6E3FAE8D14733FDB00E42306 /* WebGLCompressedTextureS3TC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLCompressedTextureS3TC.h; path = canvas/WebGLCompressedTextureS3TC.h; sourceTree = "<group>"; };
-		6E3FAE9014733FEA00E42306 /* WebGLCompressedTextureS3TC.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLCompressedTextureS3TC.idl; path = canvas/WebGLCompressedTextureS3TC.idl; sourceTree = "<group>"; };
 		6E3FAD3614733F4000E42307 /* JSWebGLDepthTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLDepthTexture.cpp; sourceTree = "<group>"; };
+		6E3FAD3714733F4000E42306 /* JSWebGLCompressedTextureS3TC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLCompressedTextureS3TC.h; sourceTree = "<group>"; };
 		6E3FAD3714733F4000E42307 /* JSWebGLDepthTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLDepthTexture.h; sourceTree = "<group>"; };
+		6E3FAE8C14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLCompressedTextureS3TC.cpp; path = canvas/WebGLCompressedTextureS3TC.cpp; sourceTree = "<group>"; };
 		6E3FAE8C14733FDB00E42307 /* WebGLDepthTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLDepthTexture.cpp; path = canvas/WebGLDepthTexture.cpp; sourceTree = "<group>"; };
+		6E3FAE8D14733FDB00E42306 /* WebGLCompressedTextureS3TC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLCompressedTextureS3TC.h; path = canvas/WebGLCompressedTextureS3TC.h; sourceTree = "<group>"; };
 		6E3FAE8D14733FDB00E42307 /* WebGLDepthTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLDepthTexture.h; path = canvas/WebGLDepthTexture.h; sourceTree = "<group>"; };
+		6E3FAE9014733FEA00E42306 /* WebGLCompressedTextureS3TC.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLCompressedTextureS3TC.idl; path = canvas/WebGLCompressedTextureS3TC.idl; sourceTree = "<group>"; };
 		6E3FAE9014733FEA00E42307 /* WebGLDepthTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebGLDepthTexture.idl; path = canvas/WebGLDepthTexture.idl; sourceTree = "<group>"; };
 		6E47E65E10B7944B00B186C8 /* WebGLGetInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebGLGetInfo.cpp; path = canvas/WebGLGetInfo.cpp; sourceTree = "<group>"; };
 		6E47E65F10B7944B00B186C8 /* WebGLGetInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLGetInfo.h; path = canvas/WebGLGetInfo.h; sourceTree = "<group>"; };
@@ -9956,6 +9966,9 @@
 		861C2EA313FB4FDD00062ABB /* DocumentLoadTiming.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoadTiming.cpp; sourceTree = "<group>"; };
 		861C2EA513FB4FFF00062ABB /* ResourceLoadTiming.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadTiming.cpp; sourceTree = "<group>"; };
 		86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferViewHelper.h; sourceTree = "<group>"; };
+		86512EDB154A2AEE00A90426 /* PerformanceResourceTiming.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PerformanceResourceTiming.cpp; sourceTree = "<group>"; };
+		86512EDC154A2AEF00A90426 /* PerformanceResourceTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PerformanceResourceTiming.h; sourceTree = "<group>"; };
+		86512EDD154A2AEF00A90426 /* PerformanceResourceTiming.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PerformanceResourceTiming.idl; sourceTree = "<group>"; };
 		86BE33FA15058CB200CE0FD8 /* PerformanceEntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PerformanceEntry.cpp; sourceTree = "<group>"; };
 		86BE33FB15058CB200CE0FD8 /* PerformanceEntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PerformanceEntry.h; sourceTree = "<group>"; };
 		86BE33FC15058CB200CE0FD8 /* PerformanceEntry.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PerformanceEntry.idl; sourceTree = "<group>"; };
@@ -11476,10 +11489,14 @@
 		AA0978EE0ABAA6E100874480 /* CSSCursorImageValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSCursorImageValue.h; sourceTree = "<group>"; };
 		AA4C3A740B2B1679002334A2 /* StyleElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StyleElement.cpp; sourceTree = "<group>"; };
 		AA4C3A750B2B1679002334A2 /* StyleElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyleElement.h; sourceTree = "<group>"; };
-		AA9030FE157E16A000276247 /* InjectedWebGLScriptSource.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InjectedWebGLScriptSource.js; sourceTree = "<group>"; };
-		AA912750157E35A500454E54 /* InjectedWebGLScriptSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedWebGLScriptSource.h; sourceTree = "<group>"; };
+		AA73183C159255B900A93E6E /* InjectedScriptWebGLModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptWebGLModule.cpp; sourceTree = "<group>"; };
+		AA73183D159255B900A93E6E /* InjectedScriptWebGLModule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptWebGLModule.h; sourceTree = "<group>"; };
+		AA9030FE157E16A000276247 /* InjectedScriptWebGLModuleSource.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InjectedScriptWebGLModuleSource.js; sourceTree = "<group>"; };
+		AA912750157E35A500454E54 /* InjectedScriptWebGLModuleSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptWebGLModuleSource.h; sourceTree = "<group>"; };
 		AAB6054A15874C58007B5031 /* InjectedScriptBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptBase.cpp; sourceTree = "<group>"; };
 		AAB6054B15874C58007B5031 /* InjectedScriptBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptBase.h; sourceTree = "<group>"; };
+		AAB6054C15874C58007B5031 /* InjectedScriptModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptModule.cpp; sourceTree = "<group>"; };
+		AAB6054D15874C58007B5031 /* InjectedScriptModule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptModule.h; sourceTree = "<group>"; };
 		AAD766E8157E502F00E85423 /* InspectorWebGLAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorWebGLAgent.cpp; sourceTree = "<group>"; };
 		AAD766E9157E502F00E85423 /* InspectorWebGLAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorWebGLAgent.h; sourceTree = "<group>"; };
 		AAD766EA157E502F00E85423 /* InspectorWebGLInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorWebGLInstrumentation.h; sourceTree = "<group>"; };
@@ -12385,6 +12402,8 @@
 		BC124EE60C2641CD009E2349 /* BarInfo.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = BarInfo.idl; sourceTree = "<group>"; };
 		BC124EFD0C26447A009E2349 /* JSBarInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSBarInfo.cpp; sourceTree = "<group>"; };
 		BC124EFE0C26447A009E2349 /* JSBarInfo.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSBarInfo.h; sourceTree = "<group>"; };
+		BC128A72137C867C00CAC845 /* RenderGrid.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderGrid.h; sourceTree = "<group>"; };
+		BC128B00137C8D4600CAC845 /* RenderGrid.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderGrid.cpp; sourceTree = "<group>"; };
 		BC1402880E83680800319717 /* ScrollbarThemeComposite.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollbarThemeComposite.cpp; sourceTree = "<group>"; };
 		BC1402890E83680800319717 /* ScrollbarThemeComposite.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarThemeComposite.h; sourceTree = "<group>"; };
 		BC17F9650B64EBB8004A65CB /* JSHTMLSelectElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLSelectElementCustom.cpp; sourceTree = "<group>"; };
@@ -12742,6 +12761,7 @@
 		BCC5BDFE0C0E93110011C2DB /* JSCSSStyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSStyleSheet.cpp; sourceTree = "<group>"; };
 		BCC5BDFF0C0E93110011C2DB /* JSCSSStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSStyleSheet.h; sourceTree = "<group>"; };
 		BCC64F600DCFB84E0081EF3B /* English */ = {isa = PBXFileReference; fileEncoding = 10; lastKnownFileType = sourcecode.javascript; name = English; path = English.lproj/localizedStrings.js; sourceTree = SOURCE_ROOT; };
+		BCC65145159294C300ACC9E4 /* IDBMetadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBMetadata.h; path = Modules/indexeddb/IDBMetadata.h; sourceTree = "<group>"; };
 		BCC8CFCA0986CD2400140BF2 /* ColorData.gperf */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = ColorData.gperf; sourceTree = "<group>"; };
 		BCCBAD3A0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCollectionCustom.cpp; sourceTree = "<group>"; };
 		BCCBAD3E0C18C14200CE890F /* JSHTMLCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCollection.cpp; sourceTree = "<group>"; };
@@ -13368,7 +13388,7 @@
 		F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptDebugServer.cpp; sourceTree = "<group>"; };
 		F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptDebugServer.h; sourceTree = "<group>"; };
 		F350B73413F1377D00880C43 /* InstrumentingAgents.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InstrumentingAgents.cpp; sourceTree = "<group>"; };
-		F35AE5AB14925F5B004D5776 /* DOMWrapperVisitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWrapperVisitor.h; sourceTree = "<group>"; };
+		F35AE5AB14925F5B004D5776 /* BindingVisitors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BindingVisitors.h; sourceTree = "<group>"; };
 		F3644AFD1119805900E0D537 /* InjectedScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScript.cpp; sourceTree = "<group>"; };
 		F3644AFE1119805900E0D537 /* InjectedScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScript.h; sourceTree = "<group>"; };
 		F36E07A21358A8BE00AACBC9 /* WorkerInspectorController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerInspectorController.cpp; sourceTree = "<group>"; };
@@ -14369,7 +14389,7 @@
 			isa = PBXGroup;
 			children = (
 				7A563E5412DE32B000F4536D /* InjectedScriptSource.h */,
-				AA912750157E35A500454E54 /* InjectedWebGLScriptSource.h */,
+				AA912750157E35A500454E54 /* InjectedScriptWebGLModuleSource.h */,
 				4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */,
 				4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */,
 				4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */,
@@ -14394,6 +14414,7 @@
 			isa = PBXGroup;
 			children = (
 				1C81B9590E97330800266E07 /* front-end */,
+				F35AE5AB14925F5B004D5776 /* BindingVisitors.h */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
 				59102FB914327D3B003C9D04 /* ContentSearchUtils.cpp */,
@@ -14404,7 +14425,6 @@
 				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
 				7A54881614E432A1006AE05A /* DOMPatchSupport.cpp */,
 				7A54881514E432A1006AE05A /* DOMPatchSupport.h */,
-				F35AE5AB14925F5B004D5776 /* DOMWrapperVisitor.h */,
 				5913A23F13D49EBA00F5B05C /* IdentifiersFactory.cpp */,
 				5913A24013D49EBA00F5B05C /* IdentifiersFactory.h */,
 				F3644AFD1119805900E0D537 /* InjectedScript.cpp */,
@@ -14416,8 +14436,12 @@
 				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
 				F31639691329481A00A649CB /* InjectedScriptManager.cpp */,
 				F316396A1329481A00A649CB /* InjectedScriptManager.h */,
+				AAB6054C15874C58007B5031 /* InjectedScriptModule.cpp */,
+				AAB6054D15874C58007B5031 /* InjectedScriptModule.h */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
-				AA9030FE157E16A000276247 /* InjectedWebGLScriptSource.js */,
+				AA73183C159255B900A93E6E /* InjectedScriptWebGLModule.cpp */,
+				AA73183D159255B900A93E6E /* InjectedScriptWebGLModule.h */,
+				AA9030FE157E16A000276247 /* InjectedScriptWebGLModuleSource.js */,
 				1C435CD414E8545B004E10EA /* Inspector-0.1.json */,
 				1C435CD514E8545B004E10EA /* Inspector-1.0.json */,
 				1C435CD314E8544F004E10EA /* Inspector.json */,
@@ -15607,6 +15631,9 @@
 				8AF4E55211DC5A36000ED3DE /* PerformanceNavigation.cpp */,
 				8AF4E55311DC5A36000ED3DE /* PerformanceNavigation.h */,
 				8AF4E55411DC5A36000ED3DE /* PerformanceNavigation.idl */,
+				86512EDB154A2AEE00A90426 /* PerformanceResourceTiming.cpp */,
+				86512EDC154A2AEF00A90426 /* PerformanceResourceTiming.h */,
+				86512EDD154A2AEF00A90426 /* PerformanceResourceTiming.idl */,
 				8AF4E55811DC5A63000ED3DE /* PerformanceTiming.cpp */,
 				8AF4E55911DC5A63000ED3DE /* PerformanceTiming.h */,
 				8AF4E55A11DC5A63000ED3DE /* PerformanceTiming.idl */,
@@ -17546,6 +17573,7 @@
 				9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */,
 				9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */,
 				9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */,
+				BCC65145159294C300ACC9E4 /* IDBMetadata.h */,
 				9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */,
 				9712A59115004EDA0048AF10 /* IDBObjectStore.h */,
 				9712A59215004EDA0048AF10 /* IDBObjectStore.idl */,
@@ -17904,8 +17932,8 @@
 				503D0CA714B5B08700F32F57 /* CustomFilterProgram.cpp */,
 				503D0CA814B5B08700F32F57 /* CustomFilterProgram.h */,
 				503D0CA914B5B08700F32F57 /* CustomFilterProgramClient.h */,
-				50D4060F147D49DE00D30BB5 /* CustomFilterShader.cpp */,
-				50D40610147D49DE00D30BB5 /* CustomFilterShader.h */,
+				50D4060F147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp */,
+				50D40610147D49DE00D30BB5 /* CustomFilterCompiledProgram.h */,
 				A1E1154313015C3D0054AC8C /* DistantLightSource.cpp */,
 				84730D5A1248F0B300D3A9C9 /* DistantLightSource.h */,
 				A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */,
@@ -21063,6 +21091,8 @@
 				A871DEC90A1530C700B12A68 /* RenderFrameSet.h */,
 				CDEA7C831276230400B846DD /* RenderFullScreen.cpp */,
 				CDEA7C821276230400B846DD /* RenderFullScreen.h */,
+				BC128B00137C8D4600CAC845 /* RenderGrid.cpp */,
+				BC128A72137C867C00CAC845 /* RenderGrid.h */,
 				0F3F0E57157030C3006DA57F /* RenderGeometryMap.cpp */,
 				0F3F0E58157030C3006DA57F /* RenderGeometryMap.h */,
 				BCEA482A097D93020094C9E4 /* RenderHTMLCanvas.cpp */,
@@ -21278,11 +21308,11 @@
 				31FB1A54120A5D0600DC02A0 /* DeviceMotionEvent.cpp */,
 				31FB1A55120A5D0600DC02A0 /* DeviceMotionEvent.h */,
 				31FB1A56120A5D0600DC02A0 /* DeviceMotionEvent.idl */,
-				59D1C10311EB5DCF00B638C8 /* DeviceOrientation.cpp */,
-				590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */,
 				59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */,
 				59A8F1D311A69508001AC34A /* DeviceOrientationController.cpp */,
 				59A8F1D511A69513001AC34A /* DeviceOrientationController.h */,
+				59D1C10311EB5DCF00B638C8 /* DeviceOrientationData.cpp */,
+				590E1B4811E4EF4B0069F784 /* DeviceOrientationData.h */,
 				59A85EA1119D68D900DEF1EF /* DeviceOrientationEvent.cpp */,
 				59A85EA3119D68EC00DEF1EF /* DeviceOrientationEvent.h */,
 				59A85EAA119D7B6E00DEF1EF /* DeviceOrientationEvent.idl */,
@@ -21388,6 +21418,7 @@
 				BC9A6144146859D9006057FD /* make_dom_exceptions.pl */,
 				BC9A6145146859D9006057FD /* make_event_factory.pl */,
 				BC9A6146146859D9006057FD /* make_names.pl */,
+				4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */,
 				E1ADECCD0E76AD8B004A1A5E /* MessageChannel.cpp */,
 				E1ADECCC0E76AD8B004A1A5E /* MessageChannel.h */,
 				E1ADECD00E76ADAB004A1A5E /* MessageChannel.idl */,
@@ -22005,6 +22036,7 @@
 				938192050F87E1EC00D5352A /* BinaryPropertyList.h in Headers */,
 				A622A8FB122C44A600A785B3 /* BindingSecurity.h in Headers */,
 				A622A8FD122C44A600A785B3 /* BindingSecurityBase.h in Headers */,
+				F35AE5AC14925F5B004D5776 /* BindingVisitors.h in Headers */,
 				FD31608D12B026F700C1A359 /* Biquad.h in Headers */,
 				FD31602512B0267600C1A359 /* BiquadDSPKernel.h in Headers */,
 				FDC54F051399B0DA008D9117 /* BiquadFilterNode.h in Headers */,
@@ -22205,7 +22237,7 @@
 				509CC9FB14C069ED00BBECBD /* CustomFilterParameter.h in Headers */,
 				503D0CAB14B5B08700F32F57 /* CustomFilterProgram.h in Headers */,
 				503D0CAC14B5B08700F32F57 /* CustomFilterProgramClient.h in Headers */,
-				50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */,
+				50D40612147D49DE00D30BB5 /* CustomFilterCompiledProgram.h in Headers */,
 				A8CB413E0E8633FD0032C4F0 /* DashArray.h in Headers */,
 				A80E6D0B0A1989CA007FB8C5 /* DashboardRegion.h in Headers */,
 				97BC6A211505F081001B74AC /* Database.h in Headers */,
@@ -22247,10 +22279,10 @@
 				31FB1A59120A5D0600DC02A0 /* DeviceMotionController.h in Headers */,
 				31FB1A5B120A5D0600DC02A0 /* DeviceMotionData.h in Headers */,
 				31FB1A5D120A5D0600DC02A0 /* DeviceMotionEvent.h in Headers */,
-				590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */,
 				59A8F1D811A69520001AC34A /* DeviceOrientationClient.h in Headers */,
 				59309A1311F4AE6A00250603 /* DeviceOrientationClientMock.h in Headers */,
 				59A8F1D611A69513001AC34A /* DeviceOrientationController.h in Headers */,
+				590E1B4911E4EF4B0069F784 /* DeviceOrientationData.h in Headers */,
 				59A85EA4119D68EC00DEF1EF /* DeviceOrientationEvent.h in Headers */,
 				CECADFC7153778FF00E37068 /* DictationAlternative.h in Headers */,
 				CECADFC9153778FF00E37068 /* DictationCommand.h in Headers */,
@@ -22889,7 +22921,6 @@
 				97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */,
 				89F60B11157F686E0075E157 /* DOMWindowQuota.h in Headers */,
 				A8CCBB49151F831600AB7CE9 /* DOMWindowWebDatabase.h in Headers */,
-				F35AE5AC14925F5B004D5776 /* DOMWrapperVisitor.h in Headers */,
 				BC53DA2E1143121E000D817E /* DOMWrapperWorld.h in Headers */,
 				1A1D13800A5325520064BF5F /* DOMXPath.h in Headers */,
 				858015CE0ABCA75D0080588D /* DOMXPathException.h in Headers */,
@@ -23332,6 +23363,8 @@
 				AAB6054F15874C58007B5031 /* InjectedScriptBase.h in Headers */,
 				7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
 				F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */,
+				AAB6055115874C58007B5031 /* InjectedScriptModule.h in Headers */,
+				AA73183F159255B900A93E6E /* InjectedScriptWebGLModule.h in Headers */,
 				A8CFF5E50A155A05000A4234 /* InlineBox.h in Headers */,
 				A8CFF5E30A155A05000A4234 /* InlineFlowBox.h in Headers */,
 				BCE789161120D6080060ECE5 /* InlineIterator.h in Headers */,
@@ -24147,6 +24180,7 @@
 				86BE340115058CB200CE0FD8 /* PerformanceEntry.h in Headers */,
 				86BE340415058CB200CE0FD8 /* PerformanceEntryList.h in Headers */,
 				8AF4E55611DC5A36000ED3DE /* PerformanceNavigation.h in Headers */,
+				86512EDF154A2AEF00A90426 /* PerformanceResourceTiming.h in Headers */,
 				8AF4E55C11DC5A63000ED3DE /* PerformanceTiming.h in Headers */,
 				49D5DC2E0F423A73008F20FD /* PerspectiveTransformOperation.h in Headers */,
 				D0FF2A5E11F8C45A007E74E0 /* PingLoader.h in Headers */,
@@ -24210,6 +24244,7 @@
 				7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
 				379E371713736A6600B9E919 /* QuotedPrintable.h in Headers */,
+				BC128A73137C867C00CAC845 /* RenderGrid.h in Headers */,
 				5A574F29131DB96D00471B88 /* QuotesData.h in Headers */,
 				B22279720D00BF220071B782 /* RadialGradientAttributes.h in Headers */,
 				F55B3DCC1251F12D003EF269 /* RadioInputType.h in Headers */,
@@ -25112,6 +25147,7 @@
 				CE7B2DB31586ABAD0098B3FA /* AlternativeTextUIController.h in Headers */,
 				CE7B2DB51586ABAD0098B3FA /* TextAlternativeWithRange.h in Headers */,
 				50987C27157D676D00BDA835 /* CustomFilterGlobalContext.h in Headers */,
+				4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25720,7 +25756,7 @@
 				50D405F9147D31F300D30BB5 /* CustomFilterMesh.cpp in Sources */,
 				50CC0A3914C6F5B10017AB51 /* CustomFilterOperation.cpp in Sources */,
 				503D0CAA14B5B08700F32F57 /* CustomFilterProgram.cpp in Sources */,
-				50D40611147D49DE00D30BB5 /* CustomFilterShader.cpp in Sources */,
+				50D40611147D49DE00D30BB5 /* CustomFilterCompiledProgram.cpp in Sources */,
 				97BC6A201505F081001B74AC /* Database.cpp in Sources */,
 				97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */,
 				97BC6A271505F081001B74AC /* DatabaseContext.cpp in Sources */,
@@ -25752,9 +25788,9 @@
 				31FB1A58120A5D0600DC02A0 /* DeviceMotionController.cpp in Sources */,
 				31FB1A5A120A5D0600DC02A0 /* DeviceMotionData.cpp in Sources */,
 				31FB1A5C120A5D0600DC02A0 /* DeviceMotionEvent.cpp in Sources */,
-				59D1C10411EB5DCF00B638C8 /* DeviceOrientation.cpp in Sources */,
 				59309A1111F4AE5800250603 /* DeviceOrientationClientMock.cpp in Sources */,
 				59A8F1D411A69508001AC34A /* DeviceOrientationController.cpp in Sources */,
+				59D1C10411EB5DCF00B638C8 /* DeviceOrientationData.cpp in Sources */,
 				59A85EA2119D68D900DEF1EF /* DeviceOrientationEvent.cpp in Sources */,
 				CECADFC6153778FF00E37068 /* DictationAlternative.cpp in Sources */,
 				CECADFC8153778FF00E37068 /* DictationCommand.cpp in Sources */,
@@ -26471,6 +26507,8 @@
 				AAB6054E15874C58007B5031 /* InjectedScriptBase.cpp in Sources */,
 				7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */,
 				F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */,
+				AAB6055015874C58007B5031 /* InjectedScriptModule.cpp in Sources */,
+				AA73183E159255B900A93E6E /* InjectedScriptWebGLModule.cpp in Sources */,
 				A8CFF5E60A155A05000A4234 /* InlineBox.cpp in Sources */,
 				A8CFF5E40A155A05000A4234 /* InlineFlowBox.cpp in Sources */,
 				BCEA4859097D93020094C9E4 /* InlineTextBox.cpp in Sources */,
@@ -27378,6 +27416,7 @@
 				86BE340015058CB200CE0FD8 /* PerformanceEntry.cpp in Sources */,
 				86BE340315058CB200CE0FD8 /* PerformanceEntryList.cpp in Sources */,
 				8AF4E55511DC5A36000ED3DE /* PerformanceNavigation.cpp in Sources */,
+				86512EDE154A2AEF00A90426 /* PerformanceResourceTiming.cpp in Sources */,
 				8AF4E55B11DC5A63000ED3DE /* PerformanceTiming.cpp in Sources */,
 				49D5DC2D0F423A73008F20FD /* PerspectiveTransformOperation.cpp in Sources */,
 				D0FF2A5D11F8C45A007E74E0 /* PingLoader.cpp in Sources */,
@@ -27418,6 +27457,7 @@
 				E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */,
 				550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */,
 				379E371613736A6600B9E919 /* QuotedPrintable.cpp in Sources */,
+				BC128B01137C8D4600CAC845 /* RenderGrid.cpp in Sources */,
 				5A574F28131DB96D00471B88 /* QuotesData.cpp in Sources */,
 				F55B3DCB1251F12D003EF269 /* RadioInputType.cpp in Sources */,
 				B658FFA51522EFAA00DD5595 /* RadioNodeList.cpp in Sources */,
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index fd8a64457..ba41d21d5 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -4013,7 +4013,7 @@ void AccessibilityRenderObject::scrollTo(const IntPoint& point) const
         return;
 
     RenderLayer* layer = box->layer();
-    layer->scrollToOffset(point.x(), point.y(), RenderLayer::ScrollOffsetClamped);
+    layer->scrollToOffset(toSize(point), RenderLayer::ScrollOffsetClamped);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp b/Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp
index ec7871d51..5a0ff7d73 100644
--- a/Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp
@@ -29,7 +29,7 @@
 
 #include "JSDeviceOrientationEvent.h"
 
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 #include "DeviceOrientationEvent.h"
 
 using namespace JSC;
@@ -83,7 +83,7 @@ JSValue JSDeviceOrientationEvent::initDeviceOrientationEvent(ExecState* exec)
     double gamma = exec->argument(5).toNumber(exec);
     bool absoluteProvided = !exec->argument(5).isUndefinedOrNull();
     bool absolute = exec->argument(6).toBoolean();
-    RefPtr<DeviceOrientation> orientation = DeviceOrientation::create(alphaProvided, alpha, betaProvided, beta, gammaProvided, gamma, absoluteProvided, absolute);
+    RefPtr<DeviceOrientationData> orientation = DeviceOrientationData::create(alphaProvided, alpha, betaProvided, beta, gammaProvided, gamma, absoluteProvided, absolute);
     DeviceOrientationEvent* imp = static_cast<DeviceOrientationEvent*>(impl());
     imp->initDeviceOrientationEvent(type, bubbles, cancelable, orientation.get());
     return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSNodeListCustom.cpp b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
index ff37978f7..741615970 100644
--- a/Source/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -43,7 +43,7 @@ bool JSNodeListOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handl
         return false;
     if (!jsNodeList->impl()->isDynamicNodeList())
         return false;
-    return visitor.containsOpaqueRoot(root(static_cast<DynamicNodeList*>(jsNodeList->impl())->node()));
+    return visitor.containsOpaqueRoot(root(static_cast<DynamicNodeList*>(jsNodeList->impl())->ownerNode()));
 }
 
 bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, PropertyName propertyName)
diff --git a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp
index 39a246a15..41ffafc36 100644
--- a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp
@@ -34,15 +34,9 @@
 
 #include "JSWebKitMutationObserver.h"
 
-#include "ExceptionCode.h"
-#include "JSDictionary.h"
 #include "JSMutationCallback.h"
-#include "JSNode.h"
-#include "Node.h"
 #include "WebKitMutationObserver.h"
 #include <runtime/Error.h>
-#include <wtf/HashSet.h>
-#include <wtf/text/AtomicString.h>
 
 using namespace JSC;
 
@@ -64,59 +58,6 @@ EncodedJSValue JSC_HOST_CALL JSWebKitMutationObserverConstructor::constructJSWeb
     return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), WebKitMutationObserver::create(callback.release()))));
 }
 
-struct BooleanOption {
-    const char* name;
-    MutationObserverOptions value;
-};
-
-static const BooleanOption booleanOptions[] = {
-    { "childList", WebKitMutationObserver::ChildList },
-    { "attributes", WebKitMutationObserver::Attributes },
-    { "characterData", WebKitMutationObserver::CharacterData },
-    { "subtree", WebKitMutationObserver::Subtree },
-    { "attributeOldValue", WebKitMutationObserver::AttributeOldValue },
-    { "characterDataOldValue", WebKitMutationObserver::CharacterDataOldValue }
-};
-
-static const size_t numBooleanOptions = sizeof(booleanOptions) / sizeof(BooleanOption);
-
-JSValue JSWebKitMutationObserver::observe(ExecState* exec)
-{
-    if (exec->argumentCount() < 2)
-        return throwError(exec, createNotEnoughArgumentsError(exec));
-    Node* target = toNode(exec->argument(0));
-    if (exec->hadException())
-        return jsUndefined();
-
-    JSObject* optionsObject = exec->argument(1).getObject();
-    if (!optionsObject) {
-        setDOMException(exec, TYPE_MISMATCH_ERR);
-        return jsUndefined();
-    }
-
-    JSDictionary dictionary(exec, optionsObject);
-    MutationObserverOptions options = 0;
-    for (unsigned i = 0; i < numBooleanOptions; ++i) {
-        bool option = false;
-        if (!dictionary.tryGetProperty(booleanOptions[i].name, option))
-            return jsUndefined();
-        if (option)
-            options |= booleanOptions[i].value;
-    }
-
-    HashSet<AtomicString> attributeFilter;
-    if (!dictionary.tryGetProperty("attributeFilter", attributeFilter))
-        return jsUndefined();
-    if (!attributeFilter.isEmpty())
-        options |= WebKitMutationObserver::AttributeFilter;
-
-    ExceptionCode ec = 0;
-    impl()->observe(target, options, attributeFilter, ec);
-    if (ec)
-        setDOMException(exec, ec);
-    return jsUndefined();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(MUTATION_OBSERVERS)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 2d91d8a5e..f2227c745 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -472,6 +472,21 @@ void ScriptDebugServer::recompileAllJSFunctionsSoon()
     m_recompileTimer.startOneShot(0);
 }
 
+void ScriptDebugServer::compileScript(ScriptState*, const String&, const String&, String*, String*)
+{
+    // FIXME(89652): implement this.
+}
+
+void ScriptDebugServer::clearCompiledScripts()
+{
+    // FIXME(89652): implement this.
+}
+
+void ScriptDebugServer::runScript(ScriptState*, const String&, ScriptValue*, bool*, String*)
+{
+    // FIXME(89652): implement this.
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index fad261174..84fba5c67 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -86,12 +86,17 @@ public:
     void updateCallStack(ScriptValue* callFrame);
 
     bool causesRecompilation() { return true; }
+    bool supportsSeparateScriptCompilationAndExecution() { return false; }
 
     void recompileAllJSFunctionsSoon();
     virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) = 0;
 
     bool isPaused() { return m_paused; }
 
+    void compileScript(ScriptState*, const String& expression, const String& sourceURL, String* scriptId, String* exceptionMessage);
+    void clearCompiledScripts();
+    void runScript(ScriptState*, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage);
+
     class Task {
     public:
         virtual ~Task() { }
diff --git a/Source/WebCore/bindings/js/ScriptObject.cpp b/Source/WebCore/bindings/js/ScriptObject.cpp
index 1fcd9cb80..0cfb82b6e 100644
--- a/Source/WebCore/bindings/js/ScriptObject.cpp
+++ b/Source/WebCore/bindings/js/ScriptObject.cpp
@@ -50,6 +50,12 @@ ScriptObject::ScriptObject(ScriptState* scriptState, JSObject* object)
 {
 }
 
+ScriptObject::ScriptObject(ScriptState* scriptState, const ScriptValue& scriptValue)
+    : ScriptValue(scriptState->globalData(), scriptValue.jsValue())
+    , m_scriptState(scriptState)
+{
+}
+
 static bool handleException(ScriptState* scriptState)
 {
     if (!scriptState->hadException())
diff --git a/Source/WebCore/bindings/js/ScriptObject.h b/Source/WebCore/bindings/js/ScriptObject.h
index eb02e9b7a..2c1ae4d33 100644
--- a/Source/WebCore/bindings/js/ScriptObject.h
+++ b/Source/WebCore/bindings/js/ScriptObject.h
@@ -44,7 +44,8 @@ namespace WebCore {
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(ScriptState*, JSC::JSObject*);
-        ScriptObject() {}
+        ScriptObject(ScriptState*, const ScriptValue&);
+        ScriptObject() { }
         JSC::JSObject* jsObject() const { return asObject(jsValue()); }
         ScriptState* scriptState() const { return m_scriptState; }
 
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index 04a615ddb..57685354f 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -36,7 +36,9 @@
 
 namespace WebCore {
 
-class DOMWrapperVisitor;
+class ExternalArrayVisitor;
+class ExternalStringVisitor;
+class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
 class ScriptValue;
@@ -72,8 +74,9 @@ public:
     static bool isSampling() { return false; }
     static bool hasHeapProfiler() { return false; }
     // FIXME: Implement this counter for JSC. See bug 73936 for more details.
-    static void visitJSDOMWrappers(DOMWrapperVisitor*) { }
-    static void visitExternalJSStrings(DOMWrapperVisitor*) { }
+    static void visitNodeWrappers(NodeWrapperVisitor*) { }
+    static void visitExternalStrings(ExternalStringVisitor*) { }
+    static void visitExternalArrays(ExternalArrayVisitor*) { }
     static size_t profilerSnapshotsSize() { return 0; }
 };
 
diff --git a/Source/WebCore/bindings/js/ScriptWrappable.h b/Source/WebCore/bindings/js/ScriptWrappable.h
index 508a93700..2d92bb455 100644
--- a/Source/WebCore/bindings/js/ScriptWrappable.h
+++ b/Source/WebCore/bindings/js/ScriptWrappable.h
@@ -54,6 +54,12 @@ public:
         weakClear(m_wrapper, wrapper);
     }
 
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        memoryObjectInfo->reportObject(m_wrapper);
+    }
+
 private:
     JSC::Weak<JSDOMWrapper> m_wrapper;
 };
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index ec48f45c6..e45e762db 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -384,6 +384,18 @@ sub prototypeHashTableAccessor
     }
 }
 
+sub GetGenerateIsReachable
+{
+    my $dataNode = shift;
+    return $dataNode->extendedAttributes->{"GenerateIsReachable"} || $dataNode->extendedAttributes->{"JSGenerateIsReachable"};
+}
+
+sub GetCustomIsReachable
+{
+    my $dataNode = shift;
+    return $dataNode->extendedAttributes->{"CustomIsReachable"} || $dataNode->extendedAttributes->{"JSCustomIsReachable"};
+}
+
 sub GenerateGetOwnPropertySlotBody
 {
     my ($dataNode, $interfaceName, $className, $implClassName, $hasAttributes, $inlined) = @_;
@@ -993,8 +1005,8 @@ sub GenerateHeader
     }
 
     if (!$hasParent ||
-        $dataNode->extendedAttributes->{"JSGenerateIsReachable"} || 
-        $dataNode->extendedAttributes->{"JSCustomIsReachable"} || 
+        GetGenerateIsReachable($dataNode) ||
+        GetCustomIsReachable($dataNode) ||
         $dataNode->extendedAttributes->{"JSCustomFinalize"} ||
         $dataNode->extendedAttributes->{"ActiveDOMObject"}) {
         push(@headerContent, "class JS${implClassName}Owner : public JSC::WeakHandleOwner {\n");
@@ -2285,7 +2297,7 @@ sub GenerateImplementation
         }
     }
 
-    if ((!$hasParent && !$dataNode->extendedAttributes->{"JSCustomIsReachable"})|| $dataNode->extendedAttributes->{"JSGenerateIsReachable"} || $dataNode->extendedAttributes->{"ActiveDOMObject"}) {
+    if ((!$hasParent && !GetCustomIsReachable($dataNode))|| GetGenerateIsReachable($dataNode) || $dataNode->extendedAttributes->{"ActiveDOMObject"}) {
         push(@implContent, "static inline bool isObservable(JS${implClassName}* js${implClassName})\n");
         push(@implContent, "{\n");
         push(@implContent, "    if (js${implClassName}->hasCustomProperties())\n");
@@ -2313,21 +2325,21 @@ sub GenerateImplementation
         }
         push(@implContent, "    if (!isObservable(js${implClassName}))\n");
         push(@implContent, "        return false;\n");
-        if ($dataNode->extendedAttributes->{"JSGenerateIsReachable"}) {
+        if (GetGenerateIsReachable($dataNode)) {
             my $rootString;
-            if ($dataNode->extendedAttributes->{"JSGenerateIsReachable"} eq "Impl") {
+            if (GetGenerateIsReachable($dataNode) eq "Impl") {
                 $rootString  = "    ${implType}* root = js${implClassName}->impl();\n";
-            } elsif ($dataNode->extendedAttributes->{"JSGenerateIsReachable"} eq "ImplContext") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplContext") {
                 $rootString  = "    WebGLRenderingContext* root = js${implClassName}->impl()->context();\n";
-            } elsif ($dataNode->extendedAttributes->{"JSGenerateIsReachable"} eq "ImplFrame") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplFrame") {
                 $rootString  = "    Frame* root = js${implClassName}->impl()->frame();\n";
                 $rootString .= "    if (!root)\n";
                 $rootString .= "        return false;\n";
-            } elsif ($dataNode->extendedAttributes->{"JSGenerateIsReachable"} eq "ImplDocument") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplDocument") {
                 $rootString  = "    Document* root = js${implClassName}->impl()->document();\n";
                 $rootString .= "    if (!root)\n";
                 $rootString .= "        return false;\n";
-            } elsif ($dataNode->extendedAttributes->{"JSGenerateIsReachable"} eq "ImplElementRoot") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplElementRoot") {
                 $rootString  = "    Element* element = js${implClassName}->impl()->element();\n";
                 $rootString .= "    if (!element)\n";
                 $rootString .= "        return false;\n";
@@ -2351,8 +2363,8 @@ sub GenerateImplementation
 
     if (!$dataNode->extendedAttributes->{"JSCustomFinalize"} &&
         (!$hasParent ||
-         $dataNode->extendedAttributes->{"JSGenerateIsReachable"} ||
-         $dataNode->extendedAttributes->{"JSCustomIsReachable"} ||
+         GetGenerateIsReachable($dataNode) ||
+         GetCustomIsReachable($dataNode) ||
          $dataNode->extendedAttributes->{"ActiveDOMObject"})) {
         push(@implContent, "void JS${implClassName}Owner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)\n");
         push(@implContent, "{\n");
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index d38a15593..a92989a52 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -181,6 +181,63 @@ sub AddIncludesForType
     }
 }
 
+sub NeedsToVisitDOMWrapper
+{
+    my $dataNode = shift;
+    return GetGenerateIsReachable($dataNode) || GetCustomIsReachable($dataNode);
+}
+
+sub GetGenerateIsReachable
+{
+    my $dataNode = shift;
+    return $dataNode->extendedAttributes->{"GenerateIsReachable"} || $dataNode->extendedAttributes->{"V8GenerateIsReachable"} || ""
+}
+
+sub GetCustomIsReachable
+{
+    my $dataNode = shift;
+    return $dataNode->extendedAttributes->{"CustomIsReachable"} || $dataNode->extendedAttributes->{"V8CustomIsReachable"};
+}
+
+sub GenerateVisitDOMWrapper
+{
+    my ($dataNode, $implClassName) = @_;
+
+    if (GetCustomIsReachable($dataNode)) {
+        return;
+    }
+
+    push(@implContent, <<END);
+void V8${implClassName}::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+{
+    ${implClassName}* impl = static_cast<${implClassName}*>(object);
+END
+    if (GetGenerateIsReachable($dataNode) eq  "ImplElementRoot" ||
+        GetGenerateIsReachable($dataNode) eq  "ImplOwnerRoot" ||
+        GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot") {
+
+        my $methodName;
+        $methodName = "element" if (GetGenerateIsReachable($dataNode) eq "ImplElementRoot");
+        $methodName = "owner" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerRoot");
+        $methodName = "ownerNode" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerNodeRoot");
+
+        push(@implContent, <<END);
+    if (Node* owner = impl->${methodName}()) {
+        v8::Persistent<v8::Object> ownerWrapper = store->domNodeMap().get(owner);
+        if (!ownerWrapper.IsEmpty()) {
+            v8::Persistent<v8::Value> value = wrapper;
+            v8::V8::AddImplicitReferences(ownerWrapper, &value, 1);
+        }
+    }
+END
+    }
+
+    push(@implContent, <<END);
+}
+
+END
+}
+
 sub GetSVGPropertyTypes
 {
     my $implType = shift;
@@ -235,7 +292,8 @@ sub GenerateHeader
     $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@allParents, 1);
     $codeGenerator->LinkOverloadedFunctions($dataNode);
 
-    my $hasDependentLifetime = $dataNode->extendedAttributes->{"V8DependentLifetime"} || $dataNode->extendedAttributes->{"ActiveDOMObject"} || $className =~ /SVG/;
+    my $hasDependentLifetime = $dataNode->extendedAttributes->{"V8DependentLifetime"} || $dataNode->extendedAttributes->{"ActiveDOMObject"}
+         || GetGenerateIsReachable($dataNode) || $className =~ /SVG/;
     if (!$hasDependentLifetime) {
         foreach (@{$dataNode->parents}) {
             my $parent = $codeGenerator->StripModule($_);
@@ -329,6 +387,7 @@ END
     }
     inline static v8::Handle<v8::Object> wrap(${nativeType}*, v8::Isolate* = 0${forceNewObjectParameter});
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
 END
     if ($dataNode->extendedAttributes->{"ActiveDOMObject"}) {
@@ -1871,12 +1930,12 @@ sub GenerateNamedConstructorCallback
 
     if ($dataNode->extendedAttributes->{"ActiveDOMObject"}) {
         push(@implContent, <<END);
-WrapperTypeInfo V8${implClassName}Constructor::info = { V8${implClassName}Constructor::GetTemplate, V8${implClassName}::derefObject, V8${implClassName}::toActiveDOMObject, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8${implClassName}Constructor::info = { V8${implClassName}Constructor::GetTemplate, V8${implClassName}::derefObject, V8${implClassName}::toActiveDOMObject, 0, 0, WrapperTypeObjectPrototype };
 
 END
     } else {
         push(@implContent, <<END);
-WrapperTypeInfo V8${implClassName}Constructor::info = { V8${implClassName}Constructor::GetTemplate, 0, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8${implClassName}Constructor::info = { V8${implClassName}Constructor::GetTemplate, 0, 0, 0, 0, WrapperTypeObjectPrototype };
 
 END
     }
@@ -2428,6 +2487,7 @@ sub GenerateImplementation
     AddIncludesForType($interfaceName);
 
     my $toActive = $dataNode->extendedAttributes->{"ActiveDOMObject"} ? "${className}::toActiveDOMObject" : "0";
+    my $domVisitor = NeedsToVisitDOMWrapper($dataNode) ? "${className}::visitDOMWrapper" : "0";
 
     # Find the super descriptor.
     my $parentClass = "";
@@ -2447,7 +2507,7 @@ sub GenerateImplementation
 
     my $WrapperTypePrototype = $dataNode->isException ? "WrapperTypeErrorPrototype" : "WrapperTypeObjectPrototype";
 
-    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, $toActive, $parentClassInfo, $WrapperTypePrototype };\n\n");
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, $toActive, $domVisitor, $parentClassInfo, $WrapperTypePrototype };\n\n");
     push(@implContentDecls, "namespace ${interfaceName}V8Internal {\n\n");
 
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
@@ -2501,6 +2561,10 @@ sub GenerateImplementation
         GenerateConstructorGetter($dataNode, $implClassName);
     }
 
+    if (NeedsToVisitDOMWrapper($dataNode)) {
+        GenerateVisitDOMWrapper($dataNode, $implClassName);
+    }
+
     my $indexer;
     my $namedPropertyGetter;
     # Generate methods for functions.
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
index 57f50a5ac..4fe771b1c 100644
--- a/Source/WebCore/bindings/scripts/IDLAttributes.txt
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -38,6 +38,7 @@ CustomEnumerateProperty
 CustomGetOwnPropertySlot
 CustomGetter
 CustomIndexedSetter
+CustomIsReachable
 CustomNamedGetter
 CustomNamedSetter
 CustomPutFunction
@@ -51,11 +52,12 @@ DoNotCheckSecurityOnGetter
 DoNotCheckSecurityOnSetter
 EventTarget
 ExtendsDOMGlobalObject
+GenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
 Immutable
 ImplementedAs=*
 IndexedGetter
-InterfaceName=*
 InitializedByEventConstructor
+InterfaceName=*
 IsIndex
 IsWorkerContext
 JSCustom
@@ -107,11 +109,13 @@ URL
 V8Custom
 V8CustomConstructor
 V8CustomGetter
+V8CustomIsReachable
 V8CustomSetter
 V8CustomToJSObject
 V8DependentLifetime
 V8DoNotCheckSignature
 V8EnabledAtRuntime=*
 V8EnabledPerContext=*
+V8GenerateIsReachable=|ImplElementRoot|ImplOwnerRoot|ImplOwnerNodeRoot
 V8ReadOnly
 V8Unforgeable
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index dc3536e7b..d51c9faa6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -43,7 +43,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8Float64Array::info = { V8Float64Array::GetTemplate, V8Float64Array::derefObject, 0, &V8ArrayBufferView::info, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8Float64Array::info = { V8Float64Array::GetTemplate, V8Float64Array::derefObject, 0, 0, &V8ArrayBufferView::info, WrapperTypeObjectPrototype };
 
 namespace Float64ArrayV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
index b0dfd559b..48928a4d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.h
@@ -44,6 +44,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(Float64Array*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 186cf2366..37817d5ff 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestActiveDOMObject::info = { V8TestActiveDOMObject::GetTemplate, V8TestActiveDOMObject::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestActiveDOMObject::info = { V8TestActiveDOMObject::GetTemplate, V8TestActiveDOMObject::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestActiveDOMObjectV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
index b91adbd11..e2cee5a12 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestActiveDOMObject*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
     static bool namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType, v8::Local<v8::Value> data);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index ca1f036f7..180d6fd8c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestCustomNamedGetter::info = { V8TestCustomNamedGetter::GetTemplate, V8TestCustomNamedGetter::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestCustomNamedGetter::info = { V8TestCustomNamedGetter::GetTemplate, V8TestCustomNamedGetter::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestCustomNamedGetterV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
index 36d9196c3..2aedac731 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestCustomNamedGetter*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> namedPropertyGetter(v8::Local<v8::String>, const v8::AccessorInfo&);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index 641ba9470..8dda9252e 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestEventConstructor::info = { V8TestEventConstructor::GetTemplate, V8TestEventConstructor::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestEventConstructor::info = { V8TestEventConstructor::GetTemplate, V8TestEventConstructor::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestEventConstructorV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
index f3c6dc486..433dcc87f 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.h
@@ -44,6 +44,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestEventConstructor*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index 2780bedd1..c5bdbeb4e 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -37,7 +37,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestEventTarget::info = { V8TestEventTarget::GetTemplate, V8TestEventTarget::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestEventTarget::info = { V8TestEventTarget::GetTemplate, V8TestEventTarget::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestEventTargetV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
index 115c5ae8c..afb0de04b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestEventTarget*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> indexedPropertyGetter(uint32_t, const v8::AccessorInfo&);
     static v8::Handle<v8::Value> namedPropertyGetter(v8::Local<v8::String>, const v8::AccessorInfo&);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
index 8066d274b..e2c8e96ec 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestException::info = { V8TestException::GetTemplate, V8TestException::derefObject, 0, 0, WrapperTypeErrorPrototype };
+WrapperTypeInfo V8TestException::info = { V8TestException::GetTemplate, V8TestException::derefObject, 0, 0, 0, WrapperTypeErrorPrototype };
 
 namespace TestExceptionV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestException.h b/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
index 403c0e3b0..8a6904fae 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestException.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestException*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
 private:
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 46759317f..ecc15b173 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, V8TestInterface::toActiveDOMObject, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, V8TestInterface::toActiveDOMObject, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestInterfaceV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
index 0f32963ef..89663c811 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.h
@@ -45,6 +45,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestInterface*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static ActiveDOMObject* toActiveDOMObject(v8::Handle<v8::Object>);
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 9d7a94d75..9c0c0d814 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestMediaQueryListListenerV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
index f53598c1d..c507ef85d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestMediaQueryListListener*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
 private:
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 9360b7dac..ad85cce22 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestNamedConstructor::info = { V8TestNamedConstructor::GetTemplate, V8TestNamedConstructor::derefObject, V8TestNamedConstructor::toActiveDOMObject, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestNamedConstructor::info = { V8TestNamedConstructor::GetTemplate, V8TestNamedConstructor::derefObject, V8TestNamedConstructor::toActiveDOMObject, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestNamedConstructorV8Internal {
 
@@ -42,7 +42,7 @@ template <typename T> void V8_USE(T) { }
 
 } // namespace TestNamedConstructorV8Internal
 
-WrapperTypeInfo V8TestNamedConstructorConstructor::info = { V8TestNamedConstructorConstructor::GetTemplate, V8TestNamedConstructor::derefObject, V8TestNamedConstructor::toActiveDOMObject, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestNamedConstructorConstructor::info = { V8TestNamedConstructorConstructor::GetTemplate, V8TestNamedConstructor::derefObject, V8TestNamedConstructor::toActiveDOMObject, 0, 0, WrapperTypeObjectPrototype };
 
 static v8::Handle<v8::Value> V8TestNamedConstructorConstructorCallback(const v8::Arguments& args)
 {
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
index 9375ae076..e0562b9ef 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.h
@@ -49,6 +49,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestNamedConstructor*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static ActiveDOMObject* toActiveDOMObject(v8::Handle<v8::Object>);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
index a90145d88..ce37e002f 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestNode::info = { V8TestNode::GetTemplate, V8TestNode::derefObject, 0, &V8Node::info, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestNode::info = { V8TestNode::GetTemplate, V8TestNode::derefObject, 0, 0, &V8Node::info, WrapperTypeObjectPrototype };
 
 namespace TestNodeV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.h b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.h
index cc20fe9e5..40bdd3a9d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestNode*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 0c764967a..dd2e6f489 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -76,7 +76,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestObjV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
index 2133bcef4..bc0e17b5c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
@@ -43,6 +43,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestObj*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> customMethodCallback(const v8::Arguments&);
     static v8::Handle<v8::Value> customMethodWithArgsCallback(const v8::Arguments&);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 5b2752f84..28ecd9408 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0, 0, 0, WrapperTypeObjectPrototype };
 
 namespace TestSerializedScriptValueInterfaceV8Internal {
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
index 1290b85ac..abd73e438 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.h
@@ -45,6 +45,7 @@ public:
     }
     inline static v8::Handle<v8::Object> wrap(TestSerializedScriptValueInterface*, v8::Isolate* = 0);
     static void derefObject(void*);
+    static void visitDOMWrapper(DOMDataStore*, void*, v8::Persistent<v8::Object>);
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static const int internalFieldCount = v8DefaultWrapperInternalFieldCount + 0;
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index d316ad729..ee76ee29a 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -65,8 +65,9 @@ static PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value> value, Vec
             v8::Local<v8::Value> item = array->Get(v8::Int32::New(i));
             RefPtr<IDBKey> subkey = createIDBKeyFromValue(item, stack);
             if (!subkey)
-                return 0;
-            subkeys.append(subkey);
+                subkeys.append(IDBKey::createInvalid());
+            else
+                subkeys.append(subkey);
         }
 
         stack.removeLast();
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index ad188eeaa..ccf2f9897 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -53,7 +53,7 @@ namespace WebCore {
 
 WrapperTypeInfo* npObjectTypeInfo()
 {
-    static WrapperTypeInfo typeInfo = { 0, 0, 0, 0, WrapperTypeObjectPrototype };
+    static WrapperTypeInfo typeInfo = { 0, 0, 0, 0, 0, WrapperTypeObjectPrototype };
     return &typeInfo;
 }
 
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
index d9d97e7b6..dce148a84 100755
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "Frame.h"
+#include "InspectorInstrumentation.h"
 #include "Page.h"
 #include "ScriptDebugListener.h"
 #include "V8Binding.h"
@@ -134,6 +135,38 @@ void PageScriptDebugServer::setClientMessageLoop(PassOwnPtr<ClientMessageLoop> c
     m_clientMessageLoop = clientMessageLoop;
 }
 
+void PageScriptDebugServer::compileScript(ScriptState* state, const String& expression, const String& sourceURL, String* scriptId, String* exceptionMessage)
+{
+    ScriptExecutionContext* scriptExecutionContext = state->scriptExecutionContext();
+    RefPtr<Frame> protect = static_cast<Document*>(scriptExecutionContext)->frame();
+    ScriptDebugServer::compileScript(state, expression, sourceURL, scriptId, exceptionMessage);
+    if (!scriptId->isNull())
+        m_compiledScriptURLs.set(*scriptId, sourceURL);
+}
+
+void PageScriptDebugServer::clearCompiledScripts()
+{
+    ScriptDebugServer::clearCompiledScripts();
+    m_compiledScriptURLs.clear();
+}
+
+void PageScriptDebugServer::runScript(ScriptState* state, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage)
+{
+    String sourceURL = m_compiledScriptURLs.take(scriptId);
+
+    ScriptExecutionContext* scriptExecutionContext = state->scriptExecutionContext();
+    Frame* frame = static_cast<Document*>(scriptExecutionContext)->frame();
+    InspectorInstrumentationCookie cookie;
+    if (frame)
+        cookie = InspectorInstrumentation::willEvaluateScript(frame, sourceURL, TextPosition::minimumPosition().m_line.oneBasedInt());
+
+    RefPtr<Frame> protect = frame;
+    ScriptDebugServer::runScript(state, scriptId, result, wasThrown, exceptionMessage);
+
+    if (frame)
+        InspectorInstrumentation::didEvaluateScript(cookie);
+}
+
 ScriptDebugListener* PageScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
 {
     v8::HandleScope scope;
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.h b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
index 751d733d6..df41cc9ed 100644
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
@@ -56,6 +56,10 @@ public:
     };
     void setClientMessageLoop(PassOwnPtr<ClientMessageLoop>);
 
+    virtual void compileScript(ScriptState*, const String& expression, const String& sourceURL, String* scriptId, String* exceptionMessage);
+    virtual void clearCompiledScripts();
+    virtual void runScript(ScriptState*, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage);
+
 private:
     PageScriptDebugServer();
     virtual ~PageScriptDebugServer() { }
@@ -68,6 +72,7 @@ private:
     ListenersMap m_listenersMap;
     OwnPtr<ClientMessageLoop> m_clientMessageLoop;
     Page* m_pausedPage;
+    HashMap<String, String> m_compiledScriptURLs;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 92f7f5b3d..f95f2b6a2 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -417,6 +417,70 @@ bool ScriptDebugServer::isPaused()
     return !m_executionState.get().IsEmpty();
 }
 
+void ScriptDebugServer::compileScript(ScriptState* state, const String& expression, const String& sourceURL, String* scriptId, String* exceptionMessage)
+{
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = state->context();
+    if (context.IsEmpty())
+        return;
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::String> code = v8ExternalString(expression);
+    v8::TryCatch tryCatch;
+
+    v8::ScriptOrigin origin(v8ExternalString(sourceURL), v8::Integer::New(0), v8::Integer::New(0));
+    v8::Handle<v8::Script> script = v8::Script::New(code, &origin);
+
+    if (tryCatch.HasCaught()) {
+        v8::Local<v8::Message> message = tryCatch.Message();
+        if (!message.IsEmpty())
+            *exceptionMessage = toWebCoreStringWithNullOrUndefinedCheck(message->Get());
+        return;
+    }
+    if (script.IsEmpty())
+        return;
+
+    *scriptId = toWebCoreStringWithNullOrUndefinedCheck(script->Id());
+    m_compiledScripts.set(*scriptId, adoptPtr(new OwnHandle<v8::Script>(script)));
+}
+
+void ScriptDebugServer::clearCompiledScripts()
+{
+    m_compiledScripts.clear();
+}
+
+void ScriptDebugServer::runScript(ScriptState* state, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage)
+{
+    v8::HandleScope handleScope;
+    OwnHandle<v8::Script>* scriptOwnHandle = m_compiledScripts.get(scriptId);
+    v8::Local<v8::Script> script = v8::Local<v8::Script>::New(scriptOwnHandle->get());
+    m_compiledScripts.remove(scriptId);
+    if (script.IsEmpty())
+        return;
+
+    v8::Handle<v8::Context> context = state->context();
+    if (context.IsEmpty())
+        return;
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::Value> value;
+    v8::TryCatch tryCatch;
+    {
+        V8RecursionScope recursionScope(state->scriptExecutionContext());
+        value = script->Run();
+    }
+
+    *wasThrown = false;
+    if (tryCatch.HasCaught()) {
+        *wasThrown = true;
+        *result = ScriptValue(tryCatch.Exception());
+        v8::Local<v8::Message> message = tryCatch.Message();
+        if (!message.IsEmpty())
+            *exceptionMessage = toWebCoreStringWithNullOrUndefinedCheck(message->Get());
+    } else
+        *result = ScriptValue(value);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index e97b8dbbc..4d1e65e09 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -48,6 +48,7 @@ namespace WebCore {
 
 class ScriptDebugListener;
 class ScriptObject;
+class ScriptState;
 class ScriptValue;
 
 class ScriptDebugServer {
@@ -80,6 +81,7 @@ public:
     void updateCallStack(ScriptValue* callFrame);
 
     bool causesRecompilation() { return false; }
+    bool supportsSeparateScriptCompilationAndExecution() { return true; }
 
     void recompileAllJSFunctionsSoon() { }
     void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) { }
@@ -96,6 +98,10 @@ public:
 
     v8::Local<v8::Value> functionScopes(v8::Handle<v8::Function>);
 
+    virtual void compileScript(ScriptState*, const String& expression, const String& sourceURL, String* scriptId, String* exceptionMessage);
+    virtual void clearCompiledScripts();
+    virtual void runScript(ScriptState*, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage);
+
 protected:
     ScriptDebugServer();
     ~ScriptDebugServer() { }
@@ -125,6 +131,7 @@ protected:
 
     bool m_breakpointsActivated;
     OwnHandle<v8::FunctionTemplate> m_breakProgramCallbackTemplate;
+    HashMap<String, OwnPtr<OwnHandle<v8::Script> > > m_compiledScripts;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptObject.cpp b/Source/WebCore/bindings/v8/ScriptObject.cpp
index 3d38a9eec..0266df48e 100644
--- a/Source/WebCore/bindings/v8/ScriptObject.cpp
+++ b/Source/WebCore/bindings/v8/ScriptObject.cpp
@@ -51,6 +51,12 @@ ScriptObject::ScriptObject(ScriptState* scriptState, v8::Handle<v8::Object> v8Ob
 {
 }
 
+ScriptObject::ScriptObject(ScriptState* scriptState, const ScriptValue& scriptValue)
+    : ScriptValue(scriptValue)
+    , m_scriptState(scriptState)
+{
+}
+
 v8::Local<v8::Object> ScriptObject::v8Object() const
 {
     ASSERT(v8Value()->IsObject());
diff --git a/Source/WebCore/bindings/v8/ScriptObject.h b/Source/WebCore/bindings/v8/ScriptObject.h
index 4541ab088..1c47a60c0 100644
--- a/Source/WebCore/bindings/v8/ScriptObject.h
+++ b/Source/WebCore/bindings/v8/ScriptObject.h
@@ -43,8 +43,9 @@ namespace WebCore {
     class ScriptObject : public ScriptValue {
     public:
         ScriptObject(ScriptState*, v8::Handle<v8::Object>);
+        ScriptObject(ScriptState*, const ScriptValue&);
         ScriptObject() : m_scriptState(0) { };
-        virtual ~ScriptObject() {}
+        virtual ~ScriptObject() { }
 
         v8::Local<v8::Object> v8Object() const;
         ScriptState* scriptState() const { return m_scriptState; }
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 802161bc7..57bb8080e 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -32,9 +32,10 @@
 #if ENABLE(INSPECTOR)
 #include "ScriptProfiler.h"
 
-#include "DOMWrapperVisitor.h"
+#include "BindingVisitors.h"
 #include "RetainedDOMInfo.h"
 #include "ScriptObject.h"
+#include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8DOMMap.h"
 #include "V8Node.h"
@@ -175,25 +176,47 @@ void ScriptProfiler::initialize()
     v8::HeapProfiler::DefineWrapperClass(v8DOMSubtreeClassId, &retainedDOMInfo);
 }
 
-void ScriptProfiler::visitJSDOMWrappers(DOMWrapperVisitor* visitor)
+void ScriptProfiler::visitNodeWrappers(NodeWrapperVisitor* visitor)
 {
     class VisitorAdapter : public DOMWrapperMap<Node>::Visitor {
     public:
-        VisitorAdapter(DOMWrapperVisitor* visitor) : m_visitor(visitor) { }
+        VisitorAdapter(NodeWrapperVisitor* visitor) : m_visitor(visitor) { }
 
         virtual void visitDOMWrapper(DOMDataStore*, Node* node, v8::Persistent<v8::Object>)
         {
             m_visitor->visitNode(node);
         }
     private:
-        DOMWrapperVisitor* m_visitor;
+        NodeWrapperVisitor* m_visitor;
     } adapter(visitor);
     visitDOMNodes(&adapter);
 }
 
-void ScriptProfiler::visitExternalJSStrings(DOMWrapperVisitor* visitor)
+void ScriptProfiler::visitExternalStrings(ExternalStringVisitor* visitor)
 {
-    V8BindingPerIsolateData::current()->visitJSExternalStrings(visitor);
+    V8BindingPerIsolateData::current()->visitExternalStrings(visitor);
+}
+
+void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
+{
+    class VisitorAdapter : public DOMWrapperMap<void>::Visitor {
+    public:
+        VisitorAdapter(ExternalArrayVisitor* visitor) : m_visitor(visitor) { }
+
+        virtual void visitDOMWrapper(DOMDataStore*, void* impl, v8::Persistent<v8::Object> v8Object)
+        {
+            WrapperTypeInfo* type = V8DOMWrapper::domWrapperType(v8Object);
+            if (!type->isSubclass(&V8ArrayBufferView::info))
+                return;
+            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(v8Object);
+            m_visitor->visitJSExternalArray(arrayBufferView);
+        }
+    private:
+        ExternalArrayVisitor* m_visitor;
+    } adapter(visitor);
+
+    getDOMObjectMap().visit(0, &adapter);
+
 }
 
 size_t ScriptProfiler::profilerSnapshotsSize()
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 3326db442..25f6e129e 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -40,7 +40,9 @@
 
 namespace WebCore {
 
-class DOMWrapperVisitor;
+class ExternalArrayVisitor;
+class ExternalStringVisitor;
+class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
 class ScriptValue;
@@ -76,8 +78,9 @@ public:
     static bool isSampling() { return true; }
     static bool hasHeapProfiler() { return true; }
     static void initialize();
-    static void visitJSDOMWrappers(DOMWrapperVisitor*);
-    static void visitExternalJSStrings(DOMWrapperVisitor*);
+    static void visitNodeWrappers(NodeWrapperVisitor*);
+    static void visitExternalStrings(ExternalStringVisitor*);
+    static void visitExternalArrays(ExternalArrayVisitor*);
     static size_t profilerSnapshotsSize();
 };
 
diff --git a/Source/WebCore/bindings/v8/ScriptWrappable.h b/Source/WebCore/bindings/v8/ScriptWrappable.h
index 850994abb..1c2823216 100644
--- a/Source/WebCore/bindings/v8/ScriptWrappable.h
+++ b/Source/WebCore/bindings/v8/ScriptWrappable.h
@@ -52,6 +52,12 @@ public:
 
     void clearWrapper() { m_wrapper = 0; }
 
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        memoryObjectInfo->reportPointer(m_wrapper, MemoryInstrumentation::DOM);
+    }
+
 private:
     v8::Persistent<v8::Object>* m_wrapper;
 };
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 974da05ca..699018692 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -31,8 +31,8 @@
 #include "config.h"
 #include "V8Binding.h"
 
+#include "BindingVisitors.h"
 #include "DOMStringList.h"
-#include "DOMWrapperVisitor.h"
 #include "Element.h"
 #include "PlatformString.h"
 #include "QualifiedName.h"
@@ -150,7 +150,7 @@ public:
         return m_atomicString;
     }
 
-    void visitStrings(DOMWrapperVisitor* visitor)
+    void visitStrings(ExternalStringVisitor* visitor)
     {
         visitor->visitJSExternalString(m_plainString.impl());
         if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
@@ -178,12 +178,12 @@ private:
 };
 
 #if ENABLE(INSPECTOR)
-void V8BindingPerIsolateData::visitJSExternalStrings(DOMWrapperVisitor* visitor)
+void V8BindingPerIsolateData::visitExternalStrings(ExternalStringVisitor* visitor)
 {
     v8::HandleScope handleScope;
     class VisitorImpl : public v8::ExternalResourceVisitor {
     public:
-        VisitorImpl(DOMWrapperVisitor* visitor) : m_visitor(visitor) { }
+        VisitorImpl(ExternalStringVisitor* visitor) : m_visitor(visitor) { }
         virtual ~VisitorImpl() { }
         virtual void VisitExternalString(v8::Handle<v8::String> string)
         {
@@ -192,7 +192,7 @@ void V8BindingPerIsolateData::visitJSExternalStrings(DOMWrapperVisitor* visitor)
                 resource->visitStrings(m_visitor);
         }
     private:
-        DOMWrapperVisitor* m_visitor;
+        ExternalStringVisitor* m_visitor;
     } v8Visitor(visitor);
     v8::V8::VisitExternalResources(&v8Visitor);
 }
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index f87e4b924..10296a700 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -46,9 +46,9 @@
 namespace WebCore {
 
     class DOMStringList;
-    class DOMWrapperVisitor;
     class EventListener;
     class EventTarget;
+    class ExternalStringVisitor;
 
     // FIXME: Remove V8Binding.
     class V8Binding {
@@ -146,7 +146,7 @@ namespace WebCore {
 
         StringCache* stringCache() { return &m_stringCache; }
 #if ENABLE(INSPECTOR)
-        void visitJSExternalStrings(DOMWrapperVisitor*);
+        void visitExternalStrings(ExternalStringVisitor*);
 #endif
         DOMDataList& allStores() { return m_domDataList; }
 
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 093c644a5..991e88b5c 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -340,6 +340,8 @@ public:
 
     void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
     {
+        WrapperTypeInfo* info = V8DOMWrapper::domWrapperType(wrapper);
+        info->visitDOMWrapper(store, object, wrapper);
     }
 
     void applyGrouping()
diff --git a/Source/WebCore/bindings/v8/WrapperTypeInfo.h b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
index 9e5f04fed..643c0bc26 100644
--- a/Source/WebCore/bindings/v8/WrapperTypeInfo.h
+++ b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
@@ -36,6 +36,7 @@
 namespace WebCore {
     
     class ActiveDOMObject;
+    class DOMDataStore;
     
     static const int v8DOMWrapperTypeIndex = 0;
     static const int v8DOMWrapperObjectIndex = 1;
@@ -46,6 +47,7 @@ namespace WebCore {
     typedef v8::Persistent<v8::FunctionTemplate> (*GetTemplateFunction)();
     typedef void (*DerefObjectFunction)(void*);
     typedef ActiveDOMObject* (*ToActiveDOMObjectFunction)(v8::Handle<v8::Object>);
+    typedef void (*DOMWrapperVisitorFunction)(DOMDataStore*, void*, v8::Persistent<v8::Object>);
 
     enum WrapperTypePrototype {
         WrapperTypeObjectPrototype,
@@ -92,10 +94,17 @@ namespace WebCore {
                 return 0;
             return toActiveDOMObjectFunction(object);
         }
-        
+
+        void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+        {
+            if (domWrapperVisitorFunction)
+                domWrapperVisitorFunction(store, object, wrapper);
+        }
+
         const GetTemplateFunction getTemplateFunction;
         const DerefObjectFunction derefObjectFunction;
         const ToActiveDOMObjectFunction toActiveDOMObjectFunction;
+        const DOMWrapperVisitorFunction domWrapperVisitorFunction;
         const WrapperTypeInfo* parentClass;
         const WrapperTypePrototype wrapperTypePrototype;
     };
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index db045a844..cdbf38581 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -84,19 +84,4 @@ v8::Handle<v8::Value> V8DOMStringMap::namedPropertySetter(v8::Local<v8::String>
     return value;
 }
 
-v8::Handle<v8::Value> toV8(DOMStringMap* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8DOMStringMap::wrap(impl, isolate);
-    // Add a hidden reference from the element to the DOMStringMap.
-    Element* element = impl->element();
-    if (!wrapper.IsEmpty() && element) {
-        v8::Handle<v8::Value> elementValue = toV8(element, isolate);
-        if (!elementValue.IsEmpty() && elementValue->IsObject())
-            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domStringMap(), wrapper);
-    }
-    return wrapper;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
index fc3fc2026..bbdc3fce8 100644
--- a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
@@ -28,7 +28,7 @@
 
 #if ENABLE(DEVICE_ORIENTATION)
 
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8Proxy.h"
@@ -93,7 +93,7 @@ v8::Handle<v8::Value> V8DeviceOrientationEvent::initDeviceOrientationEventCallba
     double gamma = args[5]->NumberValue();
     bool absoluteProvided = !isUndefinedOrNull(args[6]);
     bool absolute = args[6]->BooleanValue();
-    RefPtr<DeviceOrientation> orientation = DeviceOrientation::create(alphaProvided, alpha, betaProvided, beta, gammaProvided, gamma, absoluteProvided, absolute);
+    RefPtr<DeviceOrientationData> orientation = DeviceOrientationData::create(alphaProvided, alpha, betaProvided, beta, gammaProvided, gamma, absoluteProvided, absolute);
     imp->initDeviceOrientationEvent(type, bubbles, cancelable, orientation.get());
     return v8::Handle<v8::Value>();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index e78c95a08..723a0b5b4 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -44,7 +44,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8HTMLImageElementConstructor::info = { V8HTMLImageElementConstructor::GetTemplate, 0, 0, 0, WrapperTypeObjectPrototype };
+WrapperTypeInfo V8HTMLImageElementConstructor::info = { V8HTMLImageElementConstructor::GetTemplate, 0, 0, 0, 0, WrapperTypeObjectPrototype };
 
 static v8::Handle<v8::Value> v8HTMLImageElementConstructorCallback(const v8::Arguments& args)
 {
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 739e8d2eb..d2e348334 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -71,16 +71,4 @@ v8::Handle<v8::Value> V8NamedNodeMap::namedPropertyGetter(v8::Local<v8::String>
     return toV8(result.release(), info.GetIsolate());
 }
 
-v8::Handle<v8::Value> toV8(NamedNodeMap* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8NamedNodeMap::wrap(impl, isolate);
-    // Add a hidden reference from named node map to its owner node.
-    Element* element = impl->element();
-    if (!wrapper.IsEmpty() && element)
-        wrapper->SetHiddenValue(V8HiddenPropertyName::ownerNode(), toV8(element, isolate));
-    return wrapper;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleSheetCustom.cpp b/Source/WebCore/bindings/v8/custom/V8PerformanceEntryCustom.cpp
index c63a2d2f2..74df9c764 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleSheetCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8PerformanceEntryCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,23 +29,33 @@
  */
 
 #include "config.h"
-#include "V8CSSStyleSheet.h"
+#include "PerformanceEntry.h"
 
-#include "V8DOMWrapper.h"
-#include "V8Node.h"
+#if ENABLE(PERFORMANCE_TIMELINE)
+
+#include "Performance.h"
+#include "PerformanceResourceTiming.h"
+
+#include "V8PerformanceEntry.h"
+#include "V8PerformanceResourceTiming.h"
+
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-v8::Handle<v8::Value> toV8(CSSStyleSheet* impl, v8::Isolate* isolate)
+v8::Handle<v8::Value> toV8(PerformanceEntry* impl, v8::Isolate* isolate)
 {
     if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8CSSStyleSheet::wrap(impl, isolate);
-    // Add a hidden reference from stylesheet object to its owner node.
-    Node* ownerNode = impl->ownerNode();
-    if (ownerNode && !wrapper.IsEmpty())
-        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(ownerNode, isolate));
-    return wrapper;
+        return v8::Null();
+
+#if ENABLE(RESOURCE_TIMING)
+    if (impl->isResource())
+        return toV8(static_cast<PerformanceResourceTiming*>(impl), isolate);
+#endif
+
+    return V8PerformanceEntry::wrap(impl);
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(PERFORMANCE_TIMELINE)
diff --git a/Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp
index a58b69909..7a1021ce4 100644
--- a/Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StyleSheetCustom.cpp
@@ -42,13 +42,8 @@ v8::Handle<v8::Value> toV8(StyleSheet* impl, v8::Isolate* isolate)
     if (!impl)
         return v8NullWithCheck(isolate);
     if (impl->isCSSStyleSheet())
-        return toV8(static_cast<CSSStyleSheet*>(impl), isolate);
-    v8::Handle<v8::Object> wrapper = V8StyleSheet::wrap(impl, isolate);
-    // Add a hidden reference from stylesheet object to its owner node.
-    Node* ownerNode = impl->ownerNode();
-    if (ownerNode && !wrapper.IsEmpty())
-        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(ownerNode, isolate));
-    return wrapper;
+        return toV8(static_cast<CSSStyleSheet*>(impl));
+    return V8StyleSheet::wrap(impl, isolate);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
index b4ef5f2ec..7667854b2 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
@@ -34,20 +34,14 @@
 
 #include "V8WebKitMutationObserver.h"
 
-#include "Dictionary.h"
-#include "ExceptionCode.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8DOMWrapper.h"
 #include "V8MutationCallback.h"
-#include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebKitMutationObserver.h"
 
-#include <wtf/HashSet.h>
-#include <wtf/text/AtomicString.h>
-
 namespace WebCore {
 
 v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Arguments& args)
@@ -79,43 +73,6 @@ v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Ar
     return args.Holder();
 }
 
-v8::Handle<v8::Value> V8WebKitMutationObserver::observeCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.WebKitMutationObserver.observe");
-    if (args.Length() < 2)
-        return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
-    WebKitMutationObserver* imp = V8WebKitMutationObserver::toNative(args.Holder());
-    EXCEPTION_BLOCK(Node*, target, V8Node::HasInstance(args[0]) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0);
-
-    if (!args[1]->IsObject())
-        return throwError(TYPE_MISMATCH_ERR, args.GetIsolate());
-
-    Dictionary optionsObject(args[1]);
-    unsigned options = 0;
-    HashSet<AtomicString> attributeFilter;
-    bool option;
-    if (optionsObject.get("childList", option) && option)
-        options |= WebKitMutationObserver::ChildList;
-    if (optionsObject.get("attributes", option) && option)
-        options |= WebKitMutationObserver::Attributes;
-    if (optionsObject.get("attributeFilter", attributeFilter))
-        options |= WebKitMutationObserver::AttributeFilter;
-    if (optionsObject.get("characterData", option) && option)
-        options |= WebKitMutationObserver::CharacterData;
-    if (optionsObject.get("subtree", option) && option)
-        options |= WebKitMutationObserver::Subtree;
-    if (optionsObject.get("attributeOldValue", option) && option)
-        options |= WebKitMutationObserver::AttributeOldValue;
-    if (optionsObject.get("characterDataOldValue", option) && option)
-        options |= WebKitMutationObserver::CharacterDataOldValue;
-
-    ExceptionCode ec = 0;
-    imp->observe(target, options, attributeFilter, ec);
-    if (ec)
-        return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Handle<v8::Value>();
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(MUTATION_OBSERVERS)
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 6082a2380..870dee4a2 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -239,7 +239,6 @@ static const CSSPropertyID computedProperties[] = {
     CSSPropertyWebkitAlignSelf,
     CSSPropertyWebkitFlex,
     CSSPropertyWebkitFlexDirection,
-    CSSPropertyWebkitFlexFlow,
     CSSPropertyWebkitFlexWrap,
     CSSPropertyWebkitJustifyContent,
 #endif
@@ -598,11 +597,12 @@ static PassRefPtr<CSSValue> getPositionOffsetValue(RenderStyle* style, CSSProper
         return cssValuePool().createValue(l);
     }
 
-    if (style->position() == RelativePosition)
+    if (style->position() == RelativePosition) {
         // FIXME: It's not enough to simply return "auto" values for one offset if the other side is defined.
         // In other words if left is auto and right is not auto, then left's computed value is negative right().
         // So we should get the opposite length unit and see if it is auto.
         return cssValuePool().createValue(l);
+    }
 
     return cssValuePool().createIdentifierValue(CSSValueAuto);
 }
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 39fb630ed..63658cbfe 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -194,6 +194,9 @@ CSSParserContext::CSSParserContext(CSSParserMode mode, const KURL& baseURL)
     , isCSSCustomFilterEnabled(false)
     , isCSSRegionsEnabled(false)
     , isCSSGridLayoutEnabled(false)
+#if ENABLE(CSS_VARIABLES)
+    , isCSSVariablesEnabled(false)
+#endif
     , needsSiteSpecificQuirks(false)
     , enforcesCSSMIMETypeInNoQuirksMode(true)
 {
@@ -207,6 +210,9 @@ CSSParserContext::CSSParserContext(Document* document, const KURL& baseURL, cons
     , isCSSCustomFilterEnabled(document->settings() ? document->settings()->isCSSCustomFilterEnabled() : false)
     , isCSSRegionsEnabled(document->cssRegionsEnabled())
     , isCSSGridLayoutEnabled(document->cssGridLayoutEnabled())
+#if ENABLE(CSS_VARIABLES)
+    , isCSSVariablesEnabled(document->settings() ? document->settings()->cssVariablesEnabled() : false)
+#endif
     , needsSiteSpecificQuirks(document->settings() ? document->settings()->needsSiteSpecificQuirks() : false)
     , enforcesCSSMIMETypeInNoQuirksMode(!document->settings() || document->settings()->enforceCSSMIMETypeInNoQuirksMode())
 {
@@ -221,6 +227,9 @@ bool operator==(const CSSParserContext& a, const CSSParserContext& b)
         && a.isCSSCustomFilterEnabled == b.isCSSCustomFilterEnabled
         && a.isCSSRegionsEnabled == b.isCSSRegionsEnabled
         && a.isCSSGridLayoutEnabled == b.isCSSGridLayoutEnabled
+#if ENABLE(CSS_VARIABLES)
+        && a.isCSSVariablesEnabled == b.isCSSVariablesEnabled
+#endif
         && a.needsSiteSpecificQuirks == b.needsSiteSpecificQuirks
         && a.enforcesCSSMIMETypeInNoQuirksMode == b.enforcesCSSMIMETypeInNoQuirksMode;
 }
@@ -1014,6 +1023,25 @@ PassRefPtr<CSSValueList> CSSParser::parseFontFaceValue(const AtomicString& strin
     return static_pointer_cast<CSSValueList>(dummyStyle->getPropertyCSSValue(CSSPropertyFontFamily));
 }
 
+#if ENABLE(CSS_VARIABLES)
+bool CSSParser::parseValue(StylePropertySet* declaration, CSSPropertyID propertyID, const String& string, bool important, Document* document)
+{
+    ASSERT(!string.isEmpty());
+
+    CSSParserContext context(document);
+
+    if (parseSimpleLengthValue(declaration, propertyID, string, important, context.mode))
+        return true;
+    if (parseColorValue(declaration, propertyID, string, important, context.mode))
+        return true;
+    if (parseKeywordValue(declaration, propertyID, string, important, context))
+        return true;
+
+    CSSParser parser(context);
+    return parser.parseValue(declaration, propertyID, string, important, static_cast<StyleSheetContents*>(0));
+}
+#endif
+
 bool CSSParser::parseValue(StylePropertySet* declaration, CSSPropertyID propertyID, const String& string, bool important, CSSParserMode cssParserMode, StyleSheetContents* contextStyleSheet)
 {
     ASSERT(!string.isEmpty());
@@ -1889,18 +1917,29 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
         break;
 
-    case CSSPropertyMaxHeight:           // <length> | <percentage> | none | inherit
-    case CSSPropertyMaxWidth:            // <length> | <percentage> | none | inherit
+    case CSSPropertyMaxWidth: // <length> | <percentage> | none | inherit
     case CSSPropertyWebkitMaxLogicalWidth:
-    case CSSPropertyWebkitMaxLogicalHeight:
         if (id == CSSValueNone) {
             validPrimitive = true;
             break;
         }
         /* nobreak */
-    case CSSPropertyMinHeight:           // <length> | <percentage> | inherit
-    case CSSPropertyMinWidth:            // <length> | <percentage> | inherit
+    case CSSPropertyMinWidth: // <length> | <percentage> | inherit
     case CSSPropertyWebkitMinLogicalWidth:
+        if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic || id == CSSValueWebkitMinContent || id == CSSValueWebkitMaxContent || id == CSSValueWebkitFillAvailable || id == CSSValueWebkitFitContent)
+            validPrimitive = true;
+        else
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
+        break;
+
+    case CSSPropertyMaxHeight: // <length> | <percentage> | none | inherit
+    case CSSPropertyWebkitMaxLogicalHeight:
+        if (id == CSSValueNone) {
+            validPrimitive = true;
+            break;
+        }
+        /* nobreak */
+    case CSSPropertyMinHeight: // <length> | <percentage> | inherit
     case CSSPropertyWebkitMinLogicalHeight:
         if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
             validPrimitive = true;
@@ -1924,9 +1963,14 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
             validPrimitive = (!id && validUnit(value, FLength | FPercent));
         break;
 
-    case CSSPropertyHeight:               // <length> | <percentage> | auto | inherit
-    case CSSPropertyWidth:                // <length> | <percentage> | auto | inherit
+    case CSSPropertyWidth: // <length> | <percentage> | auto | inherit
     case CSSPropertyWebkitLogicalWidth:
+        if (id == CSSValueWebkitMinContent || id == CSSValueWebkitMaxContent || id == CSSValueWebkitFillAvailable || id == CSSValueWebkitFitContent) {
+            validPrimitive = true;
+            break;
+        }
+        /* nobreak */
+    case CSSPropertyHeight: // <length> | <percentage> | auto | inherit
     case CSSPropertyWebkitLogicalHeight:
         if (id == CSSValueAuto || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
             validPrimitive = true;
@@ -2877,6 +2921,11 @@ bool CSSParser::parseFillShorthand(CSSPropertyID propId, const CSSPropertyID* pr
 }
 
 #if ENABLE(CSS_VARIABLES)
+bool CSSParser::cssVariablesEnabled() const
+{
+    return m_context.isCSSVariablesEnabled;
+}
+
 void CSSParser::storeVariableDeclaration(const CSSParserString& name, PassOwnPtr<CSSParserValueList> value, bool important)
 {
     StringBuilder builder;
@@ -6888,12 +6937,16 @@ PassRefPtr<CSSValue> CSSParser::parseImageResolution(CSSParserValueList* valueLi
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     bool haveResolution = false;
     bool haveFromImage = false;
+    bool haveSnap = false;
 
     CSSParserValue* value = valueList->current();
     while (value) {
         if (!haveFromImage && value->id == CSSValueFromImage) {
             list->append(cssValuePool().createIdentifierValue(value->id));
             haveFromImage = true;
+        } else if (!haveSnap && value->id == CSSValueSnap) {
+            list->append(cssValuePool().createIdentifierValue(value->id));
+            haveSnap = true;
         } else if (!haveResolution && validUnit(value, FResolution | FNonNeg) && value->fValue > 0) {
             list->append(createPrimitiveNumericValue(value));
             haveResolution = true;
@@ -6903,6 +6956,8 @@ PassRefPtr<CSSValue> CSSParser::parseImageResolution(CSSParserValueList* valueLi
     }
     if (!list->length())
         return 0;
+    if (!haveFromImage && !haveResolution)
+        return 0;
     return list;
 }
 #endif
@@ -8500,7 +8555,7 @@ inline void CSSParser::detectDashToken(int length)
         else if (isASCIIAlphaCaselessEqual(name[10], 'x') && isEqualToCSSIdentifier(name + 1, "webkit-ma"))
             m_token = MAXFUNCTION;
 #if ENABLE(CSS_VARIABLES)
-        else if (isASCIIAlphaCaselessEqual(name[10], 'r') && isEqualToCSSIdentifier(name + 1, "webkit-va"))
+        else if (cssVariablesEnabled() && isASCIIAlphaCaselessEqual(name[10], 'r') && isEqualToCSSIdentifier(name + 1, "webkit-va"))
             m_token = VARFUNCTION;
 #endif
     } else if (length == 12 && isEqualToCSSIdentifier(name + 1, "webkit-calc"))
@@ -8842,7 +8897,7 @@ restartAfterComment:
 
     case CharacterDash:
 #if ENABLE(CSS_VARIABLES)
-        if (m_currentCharacter[10] == '-' && isEqualToCSSIdentifier(m_currentCharacter, "webkit-var") && isIdentifierStartAfterDash(m_currentCharacter + 11)) {
+        if (cssVariablesEnabled() && m_currentCharacter[10] == '-' && isEqualToCSSIdentifier(m_currentCharacter, "webkit-var") && isIdentifierStartAfterDash(m_currentCharacter + 11)) {
             // handle variable declarations
             m_currentCharacter += 11;
             parseIdentifier(result, hasEscape);
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index b037f03a4..625e1e081 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -92,6 +92,8 @@ public:
     bool parseQuotes(CSSPropertyID, bool important);
 
 #if ENABLE(CSS_VARIABLES)
+    static bool parseValue(StylePropertySet*, CSSPropertyID, const String&, bool important, Document*);
+    bool cssVariablesEnabled() const;
     void storeVariableDeclaration(const CSSParserString&, PassOwnPtr<CSSParserValueList>, bool important);
 #endif
 
diff --git a/Source/WebCore/css/CSSParserMode.h b/Source/WebCore/css/CSSParserMode.h
index d9200b72c..d6b211522 100644
--- a/Source/WebCore/css/CSSParserMode.h
+++ b/Source/WebCore/css/CSSParserMode.h
@@ -26,6 +26,7 @@
  * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  */
 
 #ifndef CSSParserMode_h
@@ -65,6 +66,9 @@ struct CSSParserContext {
     bool isCSSCustomFilterEnabled;
     bool isCSSRegionsEnabled;
     bool isCSSGridLayoutEnabled;
+#if ENABLE(CSS_VARIABLES)
+    bool isCSSVariablesEnabled;
+#endif
     bool needsSiteSpecificQuirks;
     bool enforcesCSSMIMETypeInNoQuirksMode;
 };
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 51d535eb9..16e43dc48 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -189,6 +189,7 @@ unsigned short CSSPrimitiveValue::primitiveType() const
     }
     return CSSPrimitiveValue::CSS_UNKNOWN;
 }
+
 static const AtomicString& valueOrPropertyName(int valueOrPropertyID)
 {
     ASSERT_ARG(valueOrPropertyID, valueOrPropertyID >= 0);
@@ -267,6 +268,22 @@ CSSPrimitiveValue::CSSPrimitiveValue(const Length& length)
             m_primitiveUnitType = CSS_IDENT;
             m_value.ident = CSSValueMinIntrinsic;
             break;
+        case MinContent:
+            m_primitiveUnitType = CSS_IDENT;
+            m_value.ident = CSSValueWebkitMinContent;
+            break;
+        case MaxContent:
+            m_primitiveUnitType = CSS_IDENT;
+            m_value.ident = CSSValueWebkitMaxContent;
+            break;
+        case FillAvailable:
+            m_primitiveUnitType = CSS_IDENT;
+            m_value.ident = CSSValueWebkitFillAvailable;
+            break;
+        case FitContent:
+            m_primitiveUnitType = CSS_IDENT;
+            m_value.ident = CSSValueWebkitFitContent;
+            break;
         case Percent:
             m_primitiveUnitType = CSS_PERCENTAGE;
             ASSERT(isfinite(length.percent()));
diff --git a/Source/WebCore/css/CSSRule.cpp b/Source/WebCore/css/CSSRule.cpp
index 09e356de0..c3105a05e 100644
--- a/Source/WebCore/css/CSSRule.cpp
+++ b/Source/WebCore/css/CSSRule.cpp
@@ -46,6 +46,10 @@ struct SameSizeAsCSSRule : public RefCounted<SameSizeAsCSSRule> {
 
 COMPILE_ASSERT(sizeof(CSSRule) == sizeof(SameSizeAsCSSRule), CSSRule_should_stay_small);
 
+#if ENABLE(CSS_REGIONS)
+COMPILE_ASSERT(StyleRuleBase::Region == static_cast<StyleRuleBase::Type>(CSSRule::WEBKIT_REGION_RULE), enums_should_match);
+#endif
+
 void CSSRule::setCssText(const String& /*cssText*/, ExceptionCode& /*ec*/)
 {
     notImplemented();
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index 5c35ad5e7..e38e161dc 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -58,7 +58,7 @@ public:
         WEBKIT_KEYFRAMES_RULE,
         WEBKIT_KEYFRAME_RULE,
 #if ENABLE(CSS_REGIONS)
-        WEBKIT_REGION_RULE = 10
+        WEBKIT_REGION_RULE = 16
 #endif
     };
 
@@ -125,7 +125,7 @@ protected:
 private:
     mutable unsigned m_hasCachedSelectorText : 1;
     unsigned m_parentIsRule : 1;
-    unsigned m_type : 4;
+    unsigned m_type : 5;
     union {
         CSSRule* m_parentRule;
         CSSStyleSheet* m_parentStyleSheet;
diff --git a/Source/WebCore/css/CSSRule.idl b/Source/WebCore/css/CSSRule.idl
index 05854a27a..79215cb4a 100644
--- a/Source/WebCore/css/CSSRule.idl
+++ b/Source/WebCore/css/CSSRule.idl
@@ -40,7 +40,7 @@ module css {
         const unsigned short WEBKIT_KEYFRAMES_RULE = 7;
         const unsigned short WEBKIT_KEYFRAME_RULE = 8;
 #if defined(ENABLE_CSS_REGIONS) && ENABLE_CSS_REGIONS
-        const unsigned short WEBKIT_REGION_RULE = 10;
+        const unsigned short WEBKIT_REGION_RULE = 16;
 #endif
 
         readonly attribute unsigned short   type;
diff --git a/Source/WebCore/css/CSSStyleSheet.idl b/Source/WebCore/css/CSSStyleSheet.idl
index 962c9dbdc..782db586c 100644
--- a/Source/WebCore/css/CSSStyleSheet.idl
+++ b/Source/WebCore/css/CSSStyleSheet.idl
@@ -22,7 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
-        V8CustomToJSObject
+        V8GenerateIsReachable=ImplOwnerNodeRoot
     ] CSSStyleSheet : StyleSheet {
         readonly attribute CSSRule          ownerRule;
         readonly attribute CSSRuleList      cssRules;
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index b4e8a89e7..b1e262c67 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -30,7 +30,7 @@
 namespace WebCore {
 
 class StyleSheetContents;
-    
+
 // FIXME: The current CSSValue and subclasses should be turned into internal types (StyleValue).
 // The few subtypes that are actually exposed in CSSOM can be seen in the cloneForCSSOM() function.
 // They should be handled by separate wrapper classes.
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index e82a532fb..8dc27c844 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -571,6 +571,14 @@ intrinsic
 min-intrinsic
 
 //
+// CSS3 intrinsic dimension keywords
+//
+-webkit-min-content
+-webkit-max-content
+-webkit-fill-available
+-webkit-fit-content
+
+//
 // CSS_PROP_TEXT_OVERFLOW
 //
 clip
@@ -926,4 +934,6 @@ detached
 
 #if defined(ENABLE_CSS_IMAGE_RESOLUTION) && ENABLE_CSS_IMAGE_RESOLUTION
 from-image
+snap
 #endif
+
diff --git a/Source/WebCore/css/CSSVariableValue.h b/Source/WebCore/css/CSSVariableValue.h
index 2c5b66a6b..15dbf9d69 100644
--- a/Source/WebCore/css/CSSVariableValue.h
+++ b/Source/WebCore/css/CSSVariableValue.h
@@ -24,6 +24,7 @@
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * 
  */
 
 #ifndef CSSVariableValue_h
diff --git a/Source/WebCore/css/LengthFunctions.cpp b/Source/WebCore/css/LengthFunctions.cpp
index 730a7c97c..e6b2abff9 100644
--- a/Source/WebCore/css/LengthFunctions.cpp
+++ b/Source/WebCore/css/LengthFunctions.cpp
@@ -65,11 +65,15 @@ LayoutUnit minimumValueForLength(const Length& length, LayoutUnit maximumValue,
             return static_cast<LayoutUnit>(std::min(viewportSize.width(), viewportSize.height()) * length.viewportPercentageLength() / 100.0f);
         }
         return ZERO_LAYOUT_UNIT;
+    case FillAvailable:
     case Auto:
         return ZERO_LAYOUT_UNIT;
     case Relative:
     case Intrinsic:
     case MinIntrinsic:
+    case MinContent:
+    case MaxContent:
+    case FitContent:
     case Undefined:
         ASSERT_NOT_REACHED();
         return ZERO_LAYOUT_UNIT;
@@ -88,18 +92,15 @@ LayoutUnit valueForLength(const Length& length, LayoutUnit maximumValue, RenderV
     case ViewportPercentageHeight:
     case ViewportPercentageMin:
         return minimumValueForLength(length, maximumValue, renderView, roundPercentages);
+    case FillAvailable:
     case Auto:
         return maximumValue;
-    // multiple assertions are used below to provide more useful debug output.
     case Relative:
-        ASSERT_NOT_REACHED();
-        return ZERO_LAYOUT_UNIT;
     case Intrinsic:
-        ASSERT_NOT_REACHED();
-        return ZERO_LAYOUT_UNIT;
     case MinIntrinsic:
-        ASSERT_NOT_REACHED();
-        return ZERO_LAYOUT_UNIT;
+    case MinContent:
+    case MaxContent:
+    case FitContent:
     case Undefined:
         ASSERT_NOT_REACHED();
         return ZERO_LAYOUT_UNIT;
@@ -116,6 +117,7 @@ float floatValueForLength(const Length& length, LayoutUnit maximumValue, RenderV
         return length.getFloatValue();
     case Percent:
         return static_cast<float>(maximumValue * length.percent() / 100.0f);
+    case FillAvailable:
     case Auto:
         return static_cast<float>(maximumValue);
     case Calculated:
@@ -137,6 +139,9 @@ float floatValueForLength(const Length& length, LayoutUnit maximumValue, RenderV
     case Relative:
     case Intrinsic:
     case MinIntrinsic:
+    case MinContent:
+    case MaxContent:
+    case FitContent:
     case Undefined:
         ASSERT_NOT_REACHED();
         return 0;
@@ -152,6 +157,7 @@ float floatValueForLength(const Length& length, float maximumValue, RenderView*
         return length.getFloatValue();
     case Percent:
         return static_cast<float>(maximumValue * length.percent() / 100.0f);
+    case FillAvailable:
     case Auto:
         return static_cast<float>(maximumValue);
     case Calculated:
@@ -173,6 +179,9 @@ float floatValueForLength(const Length& length, float maximumValue, RenderView*
     case Relative:
     case Intrinsic:
     case MinIntrinsic:
+    case MinContent:
+    case MaxContent:
+    case FitContent:
     case Undefined:
         ASSERT_NOT_REACHED();
         return 0;
diff --git a/Source/WebCore/css/StyleBuilder.cpp b/Source/WebCore/css/StyleBuilder.cpp
index 304db7cdf..2139996bd 100644
--- a/Source/WebCore/css/StyleBuilder.cpp
+++ b/Source/WebCore/css/StyleBuilder.cpp
@@ -331,16 +331,16 @@ public:
 };
 
 enum LengthAuto { AutoDisabled = 0, AutoEnabled };
+enum LengthLegacyIntrinsic { LegacyIntrinsicDisabled = 0, LegacyIntrinsicEnabled };
 enum LengthIntrinsic { IntrinsicDisabled = 0, IntrinsicEnabled };
-enum LengthMinIntrinsic { MinIntrinsicDisabled = 0, MinIntrinsicEnabled };
 enum LengthNone { NoneDisabled = 0, NoneEnabled };
 enum LengthUndefined { UndefinedDisabled = 0, UndefinedEnabled };
 template <Length (RenderStyle::*getterFunction)() const,
           void (RenderStyle::*setterFunction)(Length),
           Length (*initialFunction)(),
           LengthAuto autoEnabled = AutoDisabled,
+          LengthLegacyIntrinsic legacyIntrinsicEnabled = LegacyIntrinsicDisabled,
           LengthIntrinsic intrinsicEnabled = IntrinsicDisabled,
-          LengthMinIntrinsic minIntrinsicEnabled = MinIntrinsicDisabled,
           LengthNone noneEnabled = NoneDisabled,
           LengthUndefined noneUndefined = UndefinedDisabled>
 class ApplyPropertyLength {
@@ -352,29 +352,41 @@ public:
             return;
 
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-        if (noneEnabled && primitiveValue->getIdent() == CSSValueNone)
+        if (noneEnabled && primitiveValue->getIdent() == CSSValueNone) {
             if (noneUndefined)
                 setValue(styleResolver->style(), Length(Undefined));
             else
                 setValue(styleResolver->style(), Length());
-        else if (intrinsicEnabled && primitiveValue->getIdent() == CSSValueIntrinsic)
-            setValue(styleResolver->style(), Length(Intrinsic));
-        else if (minIntrinsicEnabled && primitiveValue->getIdent() == CSSValueMinIntrinsic)
-            setValue(styleResolver->style(), Length(MinIntrinsic));
-        else if (autoEnabled && primitiveValue->getIdent() == CSSValueAuto)
-            setValue(styleResolver->style(), Length());
-        else {
-            if (primitiveValue->isLength()) {
-                Length length = primitiveValue->computeLength<Length>(styleResolver->style(), styleResolver->rootElementStyle(), styleResolver->style()->effectiveZoom());
-                length.setQuirk(primitiveValue->isQuirkValue());
-                setValue(styleResolver->style(), length);
-            } else if (primitiveValue->isPercentage())
-                setValue(styleResolver->style(), Length(primitiveValue->getDoubleValue(), Percent));
-            else if (primitiveValue->isCalculatedPercentageWithLength())
-                setValue(styleResolver->style(), Length(primitiveValue->cssCalcValue()->toCalcValue(styleResolver->style(), styleResolver->rootElementStyle(), styleResolver->style()->effectiveZoom())));
-            else if (primitiveValue->isViewportPercentageLength())
-                setValue(styleResolver->style(), primitiveValue->viewportPercentageLength());
         }
+        if (legacyIntrinsicEnabled) {
+            if (primitiveValue->getIdent() == CSSValueIntrinsic)
+                setValue(styleResolver->style(), Length(Intrinsic));
+            else if (primitiveValue->getIdent() == CSSValueMinIntrinsic)
+                setValue(styleResolver->style(), Length(MinIntrinsic));
+        }
+        if (intrinsicEnabled) {
+            if (primitiveValue->getIdent() == CSSValueWebkitMinContent)
+                setValue(styleResolver->style(), Length(MinContent));
+            else if (primitiveValue->getIdent() == CSSValueWebkitMaxContent)
+                setValue(styleResolver->style(), Length(MaxContent));
+            else if (primitiveValue->getIdent() == CSSValueWebkitFillAvailable)
+                setValue(styleResolver->style(), Length(FillAvailable));
+            else if (primitiveValue->getIdent() == CSSValueWebkitFitContent)
+                setValue(styleResolver->style(), Length(FitContent));
+        }
+
+        if (autoEnabled && primitiveValue->getIdent() == CSSValueAuto)
+            setValue(styleResolver->style(), Length());
+        else if (primitiveValue->isLength()) {
+            Length length = primitiveValue->computeLength<Length>(styleResolver->style(), styleResolver->rootElementStyle(), styleResolver->style()->effectiveZoom());
+            length.setQuirk(primitiveValue->isQuirkValue());
+            setValue(styleResolver->style(), length);
+        } else if (primitiveValue->isPercentage())
+            setValue(styleResolver->style(), Length(primitiveValue->getDoubleValue(), Percent));
+        else if (primitiveValue->isCalculatedPercentageWithLength())
+            setValue(styleResolver->style(), Length(primitiveValue->cssCalcValue()->toCalcValue(styleResolver->style(), styleResolver->rootElementStyle(), styleResolver->style()->effectiveZoom())));
+        else if (primitiveValue->isViewportPercentageLength())
+            setValue(styleResolver->style(), primitiveValue->viewportPercentageLength());
     }
 
     static PropertyHandler createHandler()
@@ -1773,12 +1785,14 @@ public:
     static void applyInheritValue(StyleResolver* styleResolver)
     {
         ApplyPropertyDefaultBase<ImageResolutionSource, &RenderStyle::imageResolutionSource, ImageResolutionSource, &RenderStyle::setImageResolutionSource, ImageResolutionSource, &RenderStyle::initialImageResolutionSource>::applyInheritValue(styleResolver);
+        ApplyPropertyDefaultBase<ImageResolutionSnap, &RenderStyle::imageResolutionSnap, ImageResolutionSnap, &RenderStyle::setImageResolutionSnap, ImageResolutionSnap, &RenderStyle::initialImageResolutionSnap>::applyInheritValue(styleResolver);
         ApplyPropertyDefaultBase<float, &RenderStyle::imageResolution, float, &RenderStyle::setImageResolution, float, &RenderStyle::initialImageResolution>::applyInheritValue(styleResolver);
     }
 
     static void applyInitialValue(StyleResolver* styleResolver)
     {
         ApplyPropertyDefaultBase<ImageResolutionSource, &RenderStyle::imageResolutionSource, ImageResolutionSource, &RenderStyle::setImageResolutionSource, ImageResolutionSource, &RenderStyle::initialImageResolutionSource>::applyInitialValue(styleResolver);
+        ApplyPropertyDefaultBase<ImageResolutionSnap, &RenderStyle::imageResolutionSnap, ImageResolutionSnap, &RenderStyle::setImageResolutionSnap, ImageResolutionSnap, &RenderStyle::initialImageResolutionSnap>::applyInitialValue(styleResolver);
         ApplyPropertyDefaultBase<float, &RenderStyle::imageResolution, float, &RenderStyle::setImageResolution, float, &RenderStyle::initialImageResolution>::applyInitialValue(styleResolver);
     }
 
@@ -1788,6 +1802,7 @@ public:
             return;
         CSSValueList* valueList = static_cast<CSSValueList*>(value);
         ImageResolutionSource source = RenderStyle::initialImageResolutionSource();
+        ImageResolutionSnap snap = RenderStyle::initialImageResolutionSnap();
         double resolution = RenderStyle::initialImageResolution();
         for (size_t i = 0; i < valueList->length(); i++) {
             CSSValue* item = valueList->itemWithoutBoundsCheck(i);
@@ -1796,10 +1811,13 @@ public:
             CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(item);
             if (primitiveValue->getIdent() == CSSValueFromImage)
                 source = ImageResolutionFromImage;
+            else if (primitiveValue->getIdent() == CSSValueSnap)
+                snap = ImageResolutionSnapPixels;
             else
                 resolution = primitiveValue->getDoubleValue(CSSPrimitiveValue::CSS_DPPX);
         }
         styleResolver->style()->setImageResolutionSource(source);
+        styleResolver->style()->setImageResolutionSnap(snap);
         styleResolver->style()->setImageResolution(resolution);
     }
 
@@ -1884,7 +1902,7 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyFontStyle, ApplyPropertyFont<FontItalic, &FontDescription::italic, &FontDescription::setItalic, FontItalicOff>::createHandler());
     setPropertyHandler(CSSPropertyFontVariant, ApplyPropertyFont<FontSmallCaps, &FontDescription::smallCaps, &FontDescription::setSmallCaps, FontSmallCapsOff>::createHandler());
     setPropertyHandler(CSSPropertyFontWeight, ApplyPropertyFontWeight::createHandler());
-    setPropertyHandler(CSSPropertyHeight, ApplyPropertyLength<&RenderStyle::height, &RenderStyle::setHeight, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled>::createHandler());
+    setPropertyHandler(CSSPropertyHeight, ApplyPropertyLength<&RenderStyle::height, &RenderStyle::setHeight, &RenderStyle::initialSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicDisabled, NoneDisabled, UndefinedDisabled>::createHandler());
     setPropertyHandler(CSSPropertyImageRendering, ApplyPropertyDefault<EImageRendering, &RenderStyle::imageRendering, EImageRendering, &RenderStyle::setImageRendering, EImageRendering, &RenderStyle::initialImageRendering>::createHandler());
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     setPropertyHandler(CSSPropertyImageResolution, ApplyPropertyImageResolution::createHandler());
@@ -1901,10 +1919,10 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyMarginLeft, ApplyPropertyLength<&RenderStyle::marginLeft, &RenderStyle::setMarginLeft, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMarginRight, ApplyPropertyLength<&RenderStyle::marginRight, &RenderStyle::setMarginRight, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMarginTop, ApplyPropertyLength<&RenderStyle::marginTop, &RenderStyle::setMarginTop, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMaxHeight, ApplyPropertyLength<&RenderStyle::maxHeight, &RenderStyle::setMaxHeight, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMaxWidth, ApplyPropertyLength<&RenderStyle::maxWidth, &RenderStyle::setMaxWidth, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMinHeight, ApplyPropertyLength<&RenderStyle::minHeight, &RenderStyle::setMinHeight, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMinWidth, ApplyPropertyLength<&RenderStyle::minWidth, &RenderStyle::setMinWidth, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMaxHeight, ApplyPropertyLength<&RenderStyle::maxHeight, &RenderStyle::setMaxHeight, &RenderStyle::initialMaxSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicDisabled, NoneEnabled, UndefinedEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMaxWidth, ApplyPropertyLength<&RenderStyle::maxWidth, &RenderStyle::setMaxWidth, &RenderStyle::initialMaxSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMinHeight, ApplyPropertyLength<&RenderStyle::minHeight, &RenderStyle::setMinHeight, &RenderStyle::initialMinSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicDisabled>::createHandler());
+    setPropertyHandler(CSSPropertyMinWidth, ApplyPropertyLength<&RenderStyle::minWidth, &RenderStyle::setMinWidth, &RenderStyle::initialMinSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicEnabled>::createHandler());
     setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
     setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
     setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
@@ -2078,7 +2096,7 @@ StyleBuilder::StyleBuilder()
 #endif
     setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
     setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
-    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled>::createHandler());
+    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, LegacyIntrinsicEnabled, IntrinsicEnabled, NoneDisabled, UndefinedDisabled>::createHandler());
     setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
     setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 74ce079a4..559cfe661 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -25,6 +25,7 @@
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
+#include "MemoryInstrumentation.h"
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
@@ -115,6 +116,13 @@ public:
     void showStyle();
 #endif
     
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::CSS);
+        if (m_isMutable)
+            memoryObjectInfo->reportPointer(m_mutablePropertyVector, MemoryInstrumentation::CSS);
+    }
+
 private:
     StylePropertySet(CSSParserMode);
     StylePropertySet(const CSSProperty* properties, unsigned count, CSSParserMode, bool makeMutable);
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 93dff2ba5..252298fc5 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -372,6 +372,7 @@ StyleResolver::StyleResolver(Document* document, bool matchAuthorAndUserStyles)
 #endif
 #if ENABLE(STYLE_SCOPED)
     , m_scopeStackParent(0)
+    , m_scopeStackParentBoundsIndex(0)
 #endif
 {
     Element* root = document->documentElement();
@@ -564,13 +565,17 @@ void StyleResolver::setupScopeStack(const ContainerNode* parent)
     ASSERT(!m_scopedAuthorStyles.isEmpty());
 
     m_scopeStack.shrink(0);
+    int authorStyleBoundsIndex = 0;
     for (const ContainerNode* scope = parent; scope; scope = scope->parentOrHostNode()) {
         RuleSet* ruleSet = ruleSetForScope(scope);
         if (ruleSet)
-            m_scopeStack.append(ScopeStackFrame(scope, ruleSet));
+            m_scopeStack.append(ScopeStackFrame(scope, authorStyleBoundsIndex, ruleSet));
+        if (scope->isShadowRoot() && !toShadowRoot(scope)->applyAuthorStyles())
+            --authorStyleBoundsIndex;
     }
     m_scopeStack.reverse();
     m_scopeStackParent = parent;
+    m_scopeStackParentBoundsIndex = 0;
 }
 
 void StyleResolver::pushScope(const ContainerNode* scope, const ContainerNode* scopeParent)
@@ -587,10 +592,12 @@ void StyleResolver::pushScope(const ContainerNode* scope, const ContainerNode* s
         setupScopeStack(scope);
         return;
     }
+    if (scope->isShadowRoot() && !toShadowRoot(scope)->applyAuthorStyles())
+        ++m_scopeStackParentBoundsIndex;
     // Otherwise just push the parent onto the stack.
     RuleSet* ruleSet = ruleSetForScope(scope);
     if (ruleSet)
-        m_scopeStack.append(ScopeStackFrame(scope, ruleSet));
+        m_scopeStack.append(ScopeStackFrame(scope, m_scopeStackParentBoundsIndex, ruleSet));
     m_scopeStackParent = scope;
 }
 
@@ -600,6 +607,8 @@ void StyleResolver::popScope(const ContainerNode* scope)
     if (scopeStackIsConsistent(scope)) {
         if (!m_scopeStack.isEmpty() && m_scopeStack.last().m_scope == scope)
             m_scopeStack.removeLast();
+        if (scope->isShadowRoot() && !toShadowRoot(scope)->applyAuthorStyles())
+            --m_scopeStackParentBoundsIndex;
         m_scopeStackParent = scope->parentOrHostNode();
     }
 }
@@ -926,22 +935,38 @@ void StyleResolver::matchScopedAuthorRules(MatchResult& result, bool includeEmpt
     MatchOptions options(includeEmptyRules);
 
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
-    const ContainerNode* parent = m_element->parentOrHostNode();
-    if (!scopeStackIsConsistent(parent))
-        setupScopeStack(parent);
-    for (size_t i = m_scopeStack.size(); i; --i) {
-        const ScopeStackFrame& frame = m_scopeStack[i - 1];
+    if (!scopeStackIsConsistent(m_element))
+        setupScopeStack(m_element);
+
+    unsigned int firstShadowScopeIndex = 0;
+    if (m_element->treeScope()->applyAuthorStyles()) {
+        unsigned i;
+        for (i = 0; i < m_scopeStack.size() && !m_scopeStack[i].m_scope->isInShadowTree(); ++i) {
+            const ScopeStackFrame& frame = m_scopeStack[i];
+            options.scope = frame.m_scope;
+            collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+            collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
+        }
+        firstShadowScopeIndex = i;
+    }
+
+    if (!m_element->isInShadowTree() || m_scopeStack.isEmpty())
+        return;
+
+    unsigned scopedIndex = m_scopeStack.size();
+    int authorStyleBoundsIndex = m_scopeStackParentBoundsIndex;
+    for ( ; scopedIndex > firstShadowScopeIndex; --scopedIndex) {
+        if (authorStyleBoundsIndex != m_scopeStack[scopedIndex - 1].m_authorStyleBoundsIndex)
+            break;
+    }
+
+    // Ruleset for ancestor nodes should be applied first.
+    for (unsigned i = scopedIndex; i < m_scopeStack.size(); ++i) {
+        const ScopeStackFrame& frame = m_scopeStack[i];
         options.scope = frame.m_scope;
         collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
         collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
-    // Also include the current element.
-    RuleSet* ruleSet = ruleSetForScope(m_element);
-    if (ruleSet) {
-        options.scope = m_element;
-        collectMatchingRules(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
-        collectMatchingRulesForRegion(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
-    }
 #else
     UNUSED_PARAM(result);
     UNUSED_PARAM(includeEmptyRules);
@@ -2051,7 +2076,7 @@ static bool doesNotInheritTextDecoration(RenderStyle* style, Element* e)
 {
     return style->display() == TABLE || style->display() == INLINE_TABLE || style->display() == RUN_IN
         || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX || isAtShadowBoundary(e)
-        || style->isFloating() || style->isPositioned();
+        || style->isFloating() || style->isOutOfFlowPositioned();
 }
 
 void StyleResolver::adjustRenderStyle(RenderStyle* style, RenderStyle* parentStyle, Element *e)
@@ -2924,11 +2949,12 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult, const
         // style declarations. We then only need to apply the inherited properties, if any, as their values can depend on the 
         // element context. This is fast and saves memory by reusing the style data structures.
         m_style->copyNonInheritedFrom(cacheItem->renderStyle.get());
-        if (m_parentStyle->inheritedDataShared(cacheItem->parentRenderStyle.get())) {
+        if (m_parentStyle->inheritedDataShared(cacheItem->parentRenderStyle.get()) && !isAtShadowBoundary(element)) {
             EInsideLink linkStatus = m_style->insideLink();
             // If the cache item parent style has identical inherited properties to the current parent style then the
             // resulting style will be identical too. We copy the inherited properties over from the cache and are done.
-            m_style->inheritFrom(cacheItem->renderStyle.get(), isAtShadowBoundary(element) ? RenderStyle::AtShadowBoundary : RenderStyle::NotAtShadowBoundary);
+            m_style->inheritFrom(cacheItem->renderStyle.get());
+
             // Unfortunately the link status is treated like an inherited property. We need to explicitly restore it.
             m_style->setInsideLink(linkStatus);
             return;
@@ -3297,7 +3323,7 @@ void StyleResolver::resolveVariables(CSSPropertyID id, CSSValue* value, Vector<s
 
     // FIXME: It would be faster not to re-parse from strings, but for now CSS property validation lives inside the parser so we do it there.
     RefPtr<StylePropertySet> resultSet = StylePropertySet::create();
-    if (!CSSParser::parseValue(resultSet.get(), id, expression.second, false, CSSStrictMode, 0))
+    if (!CSSParser::parseValue(resultSet.get(), id, expression.second, false, document()))
         return; // expression failed to parse.
 
     for (unsigned i = 0; i < resultSet->propertyCount(); i++) {
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index 9f9cc2ca4..29f800e0c 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -531,9 +531,10 @@ private:
     ScopedRuleSetMap m_scopedAuthorStyles;
     
     struct ScopeStackFrame {
-        ScopeStackFrame() : m_scope(0), m_ruleSet(0) { }
-        ScopeStackFrame(const ContainerNode* scope, RuleSet* ruleSet) : m_scope(scope), m_ruleSet(ruleSet) { }
+        ScopeStackFrame() : m_scope(0), m_authorStyleBoundsIndex(0), m_ruleSet(0) { }
+        ScopeStackFrame(const ContainerNode* scope, int authorStyleBoundsIndex, RuleSet* ruleSet) : m_scope(scope), m_authorStyleBoundsIndex(authorStyleBoundsIndex), m_ruleSet(ruleSet) { }
         const ContainerNode* m_scope;
+        int m_authorStyleBoundsIndex;
         RuleSet* m_ruleSet;
     };
     // Vector (used as stack) that keeps track of scoping elements (i.e., elements with a <style scoped> child)
@@ -542,6 +543,7 @@ private:
     // Element last seen as parent element when updating m_scopingElementStack.
     // This is used to decide whether m_scopingElementStack is consistent, separately from SelectorChecker::m_parentStack.
     const ContainerNode* m_scopeStackParent;
+    int m_scopeStackParentBoundsIndex;
 #endif
 
     friend class StyleBuilder;
diff --git a/Source/WebCore/css/StyleRule.cpp b/Source/WebCore/css/StyleRule.cpp
index 3387fc964..20b290503 100644
--- a/Source/WebCore/css/StyleRule.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -35,6 +35,12 @@
 
 namespace WebCore {
 
+struct SameSizeAsStyleRuleBase : public WTF::RefCountedBase {
+    unsigned bitfields;
+};
+
+COMPILE_ASSERT(sizeof(StyleRuleBase) == sizeof(SameSizeAsStyleRuleBase), StyleRuleBase_should_stay_small);
+
 PassRefPtr<CSSRule> StyleRuleBase::createCSSOMWrapper(CSSStyleSheet* parentSheet) const
 {
     return createCSSOMWrapper(parentSheet, 0);
diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
index c7be54902..7fc20a303 100644
--- a/Source/WebCore/css/StyleRule.h
+++ b/Source/WebCore/css/StyleRule.h
@@ -45,7 +45,7 @@ public:
         Page,
         Keyframes,
         Keyframe, // Not used. These are internally non-rule StyleKeyframe objects.
-        Region
+        Region = 16
     };
     Type type() const { return static_cast<Type>(m_type); }
     
@@ -83,8 +83,8 @@ private:
     
     PassRefPtr<CSSRule> createCSSOMWrapper(CSSStyleSheet* parentSheet, CSSRule* parentRule) const;
 
-    unsigned m_type : 4;
-    signed m_sourceLine : 28;
+    unsigned m_type : 5;
+    signed m_sourceLine : 27;
 };
 
 class StyleRule : public StyleRuleBase {
diff --git a/Source/WebCore/css/StyleSheet.idl b/Source/WebCore/css/StyleSheet.idl
index 9e20d84ac..b8568bfb2 100644
--- a/Source/WebCore/css/StyleSheet.idl
+++ b/Source/WebCore/css/StyleSheet.idl
@@ -26,7 +26,7 @@ module stylesheets {
         JSGenerateIsReachable,
         CustomToJSObject,
         ObjCPolymorphic,
-        V8DependentLifetime
+        V8GenerateIsReachable=ImplOwnerNodeRoot
     ] StyleSheet {
         readonly attribute [TreatReturnedNullStringAs=Null] DOMString        type;
                  attribute boolean          disabled;
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index b3931016e..6290d3dc3 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -162,7 +162,7 @@ input[type="range"]::-webkit-media-slider-container {
     -webkit-box-sizing: border-box;
     height: 100%;
     width: 100%;
-    border: 1px solid rgb(130, 130, 130);
+    border: 1px solid rgba(230, 230, 230, 0.35);
     border-radius: 4px;
     background-color: transparent; /* Background drawing is managed by C++ code to draw ranges. */
 }
diff --git a/Source/WebCore/dom/ChildNodeList.cpp b/Source/WebCore/dom/ChildNodeList.cpp
index 41ae7ccb2..449fb829a 100644
--- a/Source/WebCore/dom/ChildNodeList.cpp
+++ b/Source/WebCore/dom/ChildNodeList.cpp
@@ -28,13 +28,13 @@
 namespace WebCore {
 
 ChildNodeList::ChildNodeList(PassRefPtr<Node> node)
-    : DynamicNodeList(node)
+    : DynamicNodeList(node, RootedAtNode, DoNotInvalidateOnAttributeChange)
 {
 }
 
 ChildNodeList::~ChildNodeList()
 {
-    node()->removeCachedChildNodeList();
+    ownerNode()->removeCachedChildNodeList();
 }
 
 unsigned ChildNodeList::length() const
@@ -43,7 +43,7 @@ unsigned ChildNodeList::length() const
         return m_caches.cachedLength;
 
     unsigned len = 0;
-    for (Node* n = node()->firstChild(); n; n = n->nextSibling())
+    for (Node* n = rootNode()->firstChild(); n; n = n->nextSibling())
         len++;
 
     m_caches.cachedLength = len;
@@ -55,7 +55,7 @@ unsigned ChildNodeList::length() const
 Node* ChildNodeList::item(unsigned index) const
 {
     unsigned int pos = 0;
-    Node* n = node()->firstChild();
+    Node* n = rootNode()->firstChild();
 
     if (m_caches.isItemCacheValid) {
         if (index == m_caches.lastItemOffset)
@@ -76,7 +76,7 @@ Node* ChildNodeList::item(unsigned index) const
         int diff = index - pos;
         unsigned dist = abs(diff);
         if (dist > m_caches.cachedLength - 1 - index) {
-            n = node()->lastChild();
+            n = rootNode()->lastChild();
             pos = m_caches.cachedLength - 1;
         }
     }
@@ -108,7 +108,7 @@ bool ChildNodeList::nodeMatches(Element* testNode) const
     // Note: Due to the overrides of the length and item functions above,
     // this function will be called only by DynamicNodeList::itemWithName,
     // for an element that was located with getElementById.
-    return testNode->parentNode() == node();
+    return testNode->parentNode() == rootNode();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/ClassNodeList.cpp b/Source/WebCore/dom/ClassNodeList.cpp
index f347647fb..36a89e4e6 100644
--- a/Source/WebCore/dom/ClassNodeList.cpp
+++ b/Source/WebCore/dom/ClassNodeList.cpp
@@ -31,20 +31,21 @@
 #include "ClassNodeList.h"
 
 #include "Document.h"
+#include "NodeRareData.h"
 #include "StyledElement.h"
 
 namespace WebCore {
 
 ClassNodeList::ClassNodeList(PassRefPtr<Node> rootNode, const String& classNames)
     : DynamicSubtreeNodeList(rootNode)
-    , m_classNames(classNames, node()->document()->inQuirksMode())
+    , m_classNames(classNames, document()->inQuirksMode())
     , m_originalClassNames(classNames)
 {
 }
 
 ClassNodeList::~ClassNodeList()
 {
-    node()->removeCachedClassNodeList(this, m_originalClassNames);
+    ownerNode()->nodeLists()->removeCacheWithName(this, DynamicNodeList::ClassNodeListType, m_originalClassNames);
 } 
 
 bool ClassNodeList::nodeMatches(Element* testNode) const
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index be8c78e4d..5f55c7beb 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -99,6 +99,14 @@ public:
     Node* traverseNextNode() const;
     Node* traverseNextNode(const Node* stayWithin) const;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        Node::reportMemoryUsage(memoryObjectInfo);
+        memoryObjectInfo->reportInstrumentedPointer(m_firstChild);
+        memoryObjectInfo->reportInstrumentedPointer(m_lastChild);
+    }
+
 protected:
     ContainerNode(Document*, ConstructionType = CreateContainer);
 
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 148fc3ec9..d3d4902d4 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -55,8 +55,8 @@
 #include "DeviceMotionController.cpp"
 #include "DeviceMotionData.cpp"
 #include "DeviceMotionEvent.cpp"
-#include "DeviceOrientation.cpp"
 #include "DeviceOrientationController.cpp"
+#include "DeviceOrientationData.cpp"
 #include "DeviceOrientationEvent.cpp"
 #include "Document.cpp"
 #include "DocumentEventQueue.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 3fafe193c..3bbf9b600 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -410,7 +410,7 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
      // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
     // Key system is not applicable here.
     DOMImplementationSupportsTypeClient client(frame && frame->settings() && frame->settings()->needsSiteSpecificQuirks(), url.host());
-    if (MediaPlayer::supportsType(ContentType(type), String(), &client))
+    if (MediaPlayer::supportsType(ContentType(type), String(), url, &client))
          return MediaDocument::create(frame, url);
 #endif
 
diff --git a/Source/WebCore/dom/DOMStringMap.idl b/Source/WebCore/dom/DOMStringMap.idl
index 980d044cd..045d52232 100644
--- a/Source/WebCore/dom/DOMStringMap.idl
+++ b/Source/WebCore/dom/DOMStringMap.idl
@@ -26,12 +26,11 @@
 module core {
 
     interface [
-        JSGenerateIsReachable=ImplElementRoot,
+        GenerateIsReachable=ImplElementRoot,
         NamedGetter,
         CustomDeleteProperty,
         CustomEnumerateProperty,
-        CustomNamedSetter,
-        V8CustomToJSObject
+        CustomNamedSetter
     ] DOMStringMap {
     };
 
diff --git a/Source/WebCore/dom/DeviceOrientationClient.h b/Source/WebCore/dom/DeviceOrientationClient.h
index 2c16b0cd8..4049c03a4 100644
--- a/Source/WebCore/dom/DeviceOrientationClient.h
+++ b/Source/WebCore/dom/DeviceOrientationClient.h
@@ -28,18 +28,17 @@
 
 namespace WebCore {
 
-class DeviceOrientation;
 class DeviceOrientationController;
+class DeviceOrientationData;
 class Page;
 
 class DeviceOrientationClient {
 public:
     virtual ~DeviceOrientationClient() {}
-
     virtual void setController(DeviceOrientationController*) = 0;
     virtual void startUpdating() = 0;
     virtual void stopUpdating() = 0;
-    virtual DeviceOrientation* lastOrientation() const = 0;
+    virtual DeviceOrientationData* lastOrientation() const = 0;
     virtual void deviceOrientationControllerDestroyed() = 0;
 };
 
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index 5d4bcddff..0d002c1e2 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "DeviceOrientationController.h"
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 #include "DeviceOrientationEvent.h"
 
 namespace WebCore {
@@ -55,7 +55,7 @@ void DeviceOrientationController::timerFired(Timer<DeviceOrientationController>*
     ASSERT_UNUSED(timer, timer == &m_timer);
     ASSERT(m_client->lastOrientation());
 
-    RefPtr<DeviceOrientation> orientation = m_client->lastOrientation();
+    RefPtr<DeviceOrientationData> orientation = m_client->lastOrientation();
     RefPtr<DeviceOrientationEvent> event = DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation.get());
 
     Vector<RefPtr<DOMWindow> > listenersVector;
@@ -127,7 +127,7 @@ void DeviceOrientationController::resumeEventsForAllListeners(DOMWindow* window)
         addListener(window);
 }
 
-void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientation* orientation)
+void DeviceOrientationController::didChangeDeviceOrientation(DeviceOrientationData* orientation)
 {
     RefPtr<DeviceOrientationEvent> event = DeviceOrientationEvent::create(eventNames().deviceorientationEvent, orientation);
     Vector<RefPtr<DOMWindow> > listenersVector;
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index 7f8c008f0..0f42bf432 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-class DeviceOrientation;
+class DeviceOrientationData;
 class DeviceOrientationClient;
 
 class DeviceOrientationController : public Supplement<Page> {
@@ -50,7 +50,7 @@ public:
     void suspendEventsForAllListeners(DOMWindow*);
     void resumeEventsForAllListeners(DOMWindow*);
 
-    void didChangeDeviceOrientation(DeviceOrientation*);
+    void didChangeDeviceOrientation(DeviceOrientationData*);
 
     bool isActive() { return !m_listeners.isEmpty(); }
 
diff --git a/Source/WebCore/dom/DeviceOrientation.cpp b/Source/WebCore/dom/DeviceOrientationData.cpp
index 9a8c257ca..6e7302fd7 100644
--- a/Source/WebCore/dom/DeviceOrientation.cpp
+++ b/Source/WebCore/dom/DeviceOrientationData.cpp
@@ -24,22 +24,22 @@
  */
 
 #include "config.h"
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 
 namespace WebCore {
 
-PassRefPtr<DeviceOrientation> DeviceOrientation::create()
+PassRefPtr<DeviceOrientationData> DeviceOrientationData::create()
 {
-    return adoptRef(new DeviceOrientation);
+    return adoptRef(new DeviceOrientationData);
 }
 
-PassRefPtr<DeviceOrientation> DeviceOrientation::create(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute)
+PassRefPtr<DeviceOrientationData> DeviceOrientationData::create(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute)
 {
-    return adoptRef(new DeviceOrientation(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma, canProvideAbsolute, absolute));
+    return adoptRef(new DeviceOrientationData(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma, canProvideAbsolute, absolute));
 }
 
 
-DeviceOrientation::DeviceOrientation()
+DeviceOrientationData::DeviceOrientationData()
     : m_canProvideAlpha(false)
     , m_canProvideBeta(false)
     , m_canProvideGamma(false)
@@ -51,7 +51,7 @@ DeviceOrientation::DeviceOrientation()
 {
 }
 
-DeviceOrientation::DeviceOrientation(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute)
+DeviceOrientationData::DeviceOrientationData(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute)
     : m_canProvideAlpha(canProvideAlpha)
     , m_canProvideBeta(canProvideBeta)
     , m_canProvideGamma(canProvideGamma)
@@ -63,42 +63,42 @@ DeviceOrientation::DeviceOrientation(bool canProvideAlpha, double alpha, bool ca
 {
 }
 
-double DeviceOrientation::alpha() const
+double DeviceOrientationData::alpha() const
 {
     return m_alpha;
 }
 
-double DeviceOrientation::beta() const
+double DeviceOrientationData::beta() const
 {
     return m_beta;
 }
 
-double DeviceOrientation::gamma() const
+double DeviceOrientationData::gamma() const
 {
     return m_gamma;
 }
 
-bool DeviceOrientation::absolute() const
+bool DeviceOrientationData::absolute() const
 {
     return m_absolute;
 }
 
-bool DeviceOrientation::canProvideAlpha() const
+bool DeviceOrientationData::canProvideAlpha() const
 {
     return m_canProvideAlpha;
 }
 
-bool DeviceOrientation::canProvideBeta() const
+bool DeviceOrientationData::canProvideBeta() const
 {
     return m_canProvideBeta;
 }
 
-bool DeviceOrientation::canProvideGamma() const
+bool DeviceOrientationData::canProvideGamma() const
 {
     return m_canProvideGamma;
 }
 
-bool DeviceOrientation::canProvideAbsolute() const
+bool DeviceOrientationData::canProvideAbsolute() const
 {
     return m_canProvideAbsolute;
 }
diff --git a/Source/WebCore/dom/DeviceOrientation.h b/Source/WebCore/dom/DeviceOrientationData.h
index c677d4330..1df9b658f 100644
--- a/Source/WebCore/dom/DeviceOrientation.h
+++ b/Source/WebCore/dom/DeviceOrientationData.h
@@ -23,18 +23,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DeviceOrientation_h
-#define DeviceOrientation_h
+#ifndef DeviceOrientationData_h
+#define DeviceOrientationData_h
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-class DeviceOrientation : public RefCounted<DeviceOrientation> {
+class DeviceOrientationData : public RefCounted<DeviceOrientationData> {
 public:
-    static PassRefPtr<DeviceOrientation> create();
-    static PassRefPtr<DeviceOrientation> create(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute = false, bool absolute = false);
+    static PassRefPtr<DeviceOrientationData> create();
+    static PassRefPtr<DeviceOrientationData> create(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute = false, bool absolute = false);
 
     double alpha() const;
     double beta() const;
@@ -46,8 +46,8 @@ public:
     bool canProvideAbsolute() const;
 
 private:
-    DeviceOrientation();
-    DeviceOrientation(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute);
+    DeviceOrientationData();
+    DeviceOrientationData(bool canProvideAlpha, double alpha, bool canProvideBeta, double beta, bool canProvideGamma, double gamma, bool canProvideAbsolute, bool absolute);
 
     bool m_canProvideAlpha;
     bool m_canProvideBeta;
@@ -61,4 +61,4 @@ private:
 
 } // namespace WebCore
 
-#endif // DeviceOrientation_h
+#endif // DeviceOrientationData_h
diff --git a/Source/WebCore/dom/DeviceOrientationEvent.cpp b/Source/WebCore/dom/DeviceOrientationEvent.cpp
index 7decc7c06..babc77e6b 100644
--- a/Source/WebCore/dom/DeviceOrientationEvent.cpp
+++ b/Source/WebCore/dom/DeviceOrientationEvent.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "DeviceOrientationEvent.h"
 
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 #include "EventNames.h"
 
 namespace WebCore {
@@ -36,17 +36,17 @@ DeviceOrientationEvent::~DeviceOrientationEvent()
 }
 
 DeviceOrientationEvent::DeviceOrientationEvent()
-    : m_orientation(DeviceOrientation::create())
+    : m_orientation(DeviceOrientationData::create())
 {
 }
 
-DeviceOrientationEvent::DeviceOrientationEvent(const AtomicString& eventType, DeviceOrientation* orientation)
+DeviceOrientationEvent::DeviceOrientationEvent(const AtomicString& eventType, DeviceOrientationData* orientation)
     : Event(eventType, false, false) // Can't bubble, not cancelable
     , m_orientation(orientation)
 {
 }
 
-void DeviceOrientationEvent::initDeviceOrientationEvent(const AtomicString& type, bool bubbles, bool cancelable, DeviceOrientation* orientation)
+void DeviceOrientationEvent::initDeviceOrientationEvent(const AtomicString& type, bool bubbles, bool cancelable, DeviceOrientationData* orientation)
 {
     if (dispatched())
         return;
diff --git a/Source/WebCore/dom/DeviceOrientationEvent.h b/Source/WebCore/dom/DeviceOrientationEvent.h
index d95984312..e196ea5b9 100644
--- a/Source/WebCore/dom/DeviceOrientationEvent.h
+++ b/Source/WebCore/dom/DeviceOrientationEvent.h
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-class DeviceOrientation;
+class DeviceOrientationData;
 
 class DeviceOrientationEvent : public Event {
 public:
@@ -39,22 +39,22 @@ public:
     {
         return adoptRef(new DeviceOrientationEvent);
     }
-    static PassRefPtr<DeviceOrientationEvent> create(const AtomicString& eventType, DeviceOrientation* orientation)
+    static PassRefPtr<DeviceOrientationEvent> create(const AtomicString& eventType, DeviceOrientationData* orientation)
     {
         return adoptRef(new DeviceOrientationEvent(eventType, orientation));
     }
 
-    void initDeviceOrientationEvent(const AtomicString& type, bool bubbles, bool cancelable, DeviceOrientation*);
+    void initDeviceOrientationEvent(const AtomicString& type, bool bubbles, bool cancelable, DeviceOrientationData*);
 
-    DeviceOrientation* orientation() const { return m_orientation.get(); }
+    DeviceOrientationData* orientation() const { return m_orientation.get(); }
 
     virtual const AtomicString& interfaceName() const;
 
 private:
     DeviceOrientationEvent();
-    DeviceOrientationEvent(const AtomicString& eventType, DeviceOrientation*);
+    DeviceOrientationEvent(const AtomicString& eventType, DeviceOrientationData*);
 
-    RefPtr<DeviceOrientation> m_orientation;
+    RefPtr<DeviceOrientationData> m_orientation;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index b93c6b0a8..132680ab0 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -3864,14 +3864,19 @@ void Document::setCSSTarget(Element* n)
 
 void Document::registerDynamicSubtreeNodeList(DynamicSubtreeNodeList* list)
 {
-    ensureRareData()->ensureNodeLists(this)->m_listsInvalidatedAtDocument.add(list);
+    m_listsInvalidatedAtDocument.add(list);
 }
 
 void Document::unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList* list)
 {
-    ASSERT(hasRareData());
-    ASSERT(rareData()->nodeLists());
-    rareData()->nodeLists()->m_listsInvalidatedAtDocument.remove(list);
+    m_listsInvalidatedAtDocument.remove(list);
+}
+
+void Document::clearNodeListCaches()
+{
+    HashSet<DynamicSubtreeNodeList*>::iterator end = m_listsInvalidatedAtDocument.end();
+    for (HashSet<DynamicSubtreeNodeList*>::iterator it = m_listsInvalidatedAtDocument.begin(); it != end; ++it)
+        (*it)->invalidateCache();
 }
 
 void Document::attachNodeIterator(NodeIterator* ni)
@@ -4126,7 +4131,7 @@ HTMLFrameOwnerElement* Document::ownerElement() const
 
 String Document::cookie(ExceptionCode& ec) const
 {
-    if (page() && !page()->cookieEnabled())
+    if (page() && !page()->settings()->cookieEnabled())
         return String();
 
     // FIXME: The HTML5 DOM spec states that this attribute can raise an
@@ -4147,7 +4152,7 @@ String Document::cookie(ExceptionCode& ec) const
 
 void Document::setCookie(const String& value, ExceptionCode& ec)
 {
-    if (page() && !page()->cookieEnabled())
+    if (page() && !page()->settings()->cookieEnabled())
         return;
 
     // FIXME: The HTML5 DOM spec states that this attribute can raise an
@@ -5921,31 +5926,11 @@ DocumentLoader* Document::loader() const
 #if ENABLE(MICRODATA)
 PassRefPtr<NodeList> Document::getItems(const String& typeNames)
 {
-    NodeListsNodeData* nodeLists = ensureRareData()->ensureNodeLists(this);
-
     // Since documet.getItem() is allowed for microdata, typeNames will be null string.
     // In this case we need to create an unique string identifier to map such request in the cache.
     String localTypeNames = typeNames.isNull() ? String("http://webkit.org/microdata/undefinedItemType") : typeNames;
 
-    NodeListsNodeData::MicroDataItemListCache::AddResult result = nodeLists->m_microDataItemListCache.add(localTypeNames, 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<NodeList>(result.iterator->second);
-
-    RefPtr<MicroDataItemList> list = MicroDataItemList::create(this, typeNames);
-    result.iterator->second = list.get();
-    return list.release();
-}
-
-void Document::removeCachedMicroDataItemList(MicroDataItemList* list, const String& typeNames)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-
-    String localTypeNames = typeNames.isNull() ? String("http://webkit.org/microdata/undefinedItemType") : typeNames;
-    ASSERT_UNUSED(list, list == data->m_microDataItemListCache.get(localTypeNames));
-    data->m_microDataItemListCache.remove(localTypeNames);
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithName<MicroDataItemList>(this, DynamicNodeList::MicroDataItemListType, localTypeNames);
 }
 #endif
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index ab9205a89..68885fb33 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -714,6 +714,7 @@ public:
 
     void registerDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
     void unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
+    void clearNodeListCaches();
 
     void attachNodeIterator(NodeIterator*);
     void detachNodeIterator(NodeIterator*);
@@ -1107,7 +1108,6 @@ public:
 
 #if ENABLE(MICRODATA)
     PassRefPtr<NodeList> getItems(const String& typeNames);
-    void removeCachedMicroDataItemList(MicroDataItemList*, const String&);
 #endif
     
 #if ENABLE(UNDO_MANAGER)
@@ -1393,6 +1393,7 @@ private:
     
     OwnPtr<HTMLCollection> m_collections[NumUnnamedDocumentCachedTypes];
     OwnPtr<HTMLAllCollection> m_allCollection;
+    HashSet<DynamicSubtreeNodeList*> m_listsInvalidatedAtDocument;
 
     typedef HashMap<AtomicStringImpl*, OwnPtr<HTMLNameCollection> > NamedCollectionMap;
     NamedCollectionMap m_documentNamedItemCollections;
diff --git a/Source/WebCore/dom/DynamicNodeList.cpp b/Source/WebCore/dom/DynamicNodeList.cpp
index 5182cfec5..d169a6cda 100644
--- a/Source/WebCore/dom/DynamicNodeList.cpp
+++ b/Source/WebCore/dom/DynamicNodeList.cpp
@@ -28,11 +28,6 @@
 
 namespace WebCore {
 
-DynamicSubtreeNodeList::DynamicSubtreeNodeList(PassRefPtr<Node> node, RootType rootType)
-    : DynamicNodeList(node, rootType)
-{
-}
-
 DynamicSubtreeNodeList::~DynamicSubtreeNodeList()
 {
 }
@@ -43,7 +38,7 @@ unsigned DynamicSubtreeNodeList::length() const
         return m_caches.cachedLength;
 
     unsigned length = 0;
-    Node* rootNode = node();
+    Node* rootNode = this->rootNode();
 
     for (Node* n = rootNode->firstChild(); n; n = n->traverseNextNode(rootNode))
         length += n->isElementNode() && nodeMatches(static_cast<Element*>(n));
@@ -57,7 +52,7 @@ unsigned DynamicSubtreeNodeList::length() const
 Node* DynamicSubtreeNodeList::itemForwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const
 {
     ASSERT(remainingOffset >= 0);
-    Node* rootNode = node();
+    Node* rootNode = this->rootNode();
     for (Node* n = start; n; n = n->traverseNextNode(rootNode)) {
         if (n->isElementNode() && nodeMatches(static_cast<Element*>(n))) {
             if (!remainingOffset) {
@@ -76,7 +71,7 @@ Node* DynamicSubtreeNodeList::itemForwardsFromCurrent(Node* start, unsigned offs
 Node* DynamicSubtreeNodeList::itemBackwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const
 {
     ASSERT(remainingOffset < 0);
-    Node* rootNode = node();
+    Node* rootNode = this->rootNode();
     for (Node* n = start; n; n = n->traversePreviousNode(rootNode)) {
         if (n->isElementNode() && nodeMatches(static_cast<Element*>(n))) {
             if (!remainingOffset) {
@@ -95,7 +90,7 @@ Node* DynamicSubtreeNodeList::itemBackwardsFromCurrent(Node* start, unsigned off
 Node* DynamicSubtreeNodeList::item(unsigned offset) const
 {
     int remainingOffset = offset;
-    Node* start = node()->firstChild();
+    Node* start = rootNode()->firstChild();
     if (m_caches.isItemCacheValid) {
         if (offset == m_caches.lastItemOffset)
             return m_caches.lastItem;
@@ -112,7 +107,7 @@ Node* DynamicSubtreeNodeList::item(unsigned offset) const
 
 Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
 {
-    Node* rootNode = node();
+    Node* rootNode = this->rootNode();
 
     if (rootNode->inDocument()) {
         Element* element = rootNode->treeScope()->getElementById(elementId);
diff --git a/Source/WebCore/dom/DynamicNodeList.h b/Source/WebCore/dom/DynamicNodeList.h
index 8bed37844..8b33e0d0d 100644
--- a/Source/WebCore/dom/DynamicNodeList.h
+++ b/Source/WebCore/dom/DynamicNodeList.h
@@ -36,14 +36,26 @@ class Node;
 
 class DynamicNodeList : public NodeList {
 public:
+    enum NodeListType {
+        ChildNodeListType,
+        ClassNodeListType,
+        NameNodeListType,
+        TagNodeListType,
+        RadioNodeListType,
+        LabelsNodeListType,
+        MicroDataItemListType,
+    };
     enum RootType {
         RootedAtNode,
         RootedAtDocument,
     };
-
-    DynamicNodeList(PassRefPtr<Node> node, RootType rootType = RootedAtNode)
-        : m_node(node)
-        , m_caches(rootType)
+    enum InvalidationType {
+        AlwaysInvalidate,
+        DoNotInvalidateOnAttributeChange,
+    };
+    DynamicNodeList(PassRefPtr<Node> ownerNode, RootType rootType, InvalidationType invalidationType)
+        : m_ownerNode(ownerNode)
+        , m_caches(rootType, invalidationType)
     { }
     virtual ~DynamicNodeList() { }
 
@@ -53,21 +65,25 @@ public:
     virtual Node* itemWithName(const AtomicString&) const;
 
     // Other methods (not part of DOM)
-    Node* node() const
-    {
-        if (m_caches.rootedAtDocument && m_node->inDocument())
-            return m_node->document();
-        return m_node.get();
-    }
-
+    Node* ownerNode() const { return m_ownerNode.get(); }
+    bool isRootedAtDocument() const { return m_caches.rootedAtDocument; }
+    bool shouldInvalidateOnAttributeChange() const { return m_caches.shouldInvalidateOnAttributeChange; }
     void invalidateCache() { m_caches.reset(); }
 
 protected:
+    Node* rootNode() const
+    {
+        if (m_caches.rootedAtDocument && m_ownerNode->inDocument())
+            return m_ownerNode->document();
+        return m_ownerNode.get();
+    }
+    Document* document() const { return m_ownerNode->document(); }
     virtual bool nodeMatches(Element*) const = 0;
 
     struct Caches {
-        Caches(RootType rootType)
+        Caches(RootType rootType, InvalidationType invalidationType)
             : rootedAtDocument(rootType == RootedAtDocument)
+            , shouldInvalidateOnAttributeChange(invalidationType == AlwaysInvalidate)
         {
             reset();
         }
@@ -81,13 +97,17 @@ protected:
 
         Node* lastItem;
         unsigned cachedLength;
-        unsigned lastItemOffset : 29; // Borrow 3-bits for bit fields
+        unsigned lastItemOffset;
         unsigned isLengthCacheValid : 1;
         unsigned isItemCacheValid : 1;
+
+        // Following flags should belong in DynamicSubtreeNode but are here for bit-packing.
+        unsigned type : 4;
         unsigned rootedAtDocument : 1;
+        unsigned shouldInvalidateOnAttributeChange : 1;
     };
 
-    RefPtr<Node> m_node;
+    RefPtr<Node> m_ownerNode;
     mutable Caches m_caches;
 
 private:
@@ -101,12 +121,11 @@ public:
     virtual Node* item(unsigned index) const OVERRIDE;
 
 protected:
-    DynamicSubtreeNodeList(PassRefPtr<Node>, RootType = RootedAtNode);
+    DynamicSubtreeNodeList(PassRefPtr<Node> node, RootType rootType = RootedAtNode, InvalidationType invalidationType = AlwaysInvalidate)
+        : DynamicNodeList(node, rootType, invalidationType)
+    { }
 
 private:
-    using DynamicNodeList::invalidateCache;
-    friend struct NodeListsNodeData;
-
     Node* itemForwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const;
     Node* itemBackwardsFromCurrent(Node* start, unsigned offset, int remainingOffset) const;
 };
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index de3f0c5af..6c52a603c 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -421,6 +421,14 @@ public:
     IntSize savedLayerScrollOffset() const;
     void setSavedLayerScrollOffset(const IntSize&);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        ContainerNode::reportMemoryUsage(memoryObjectInfo);
+        memoryObjectInfo->reportInstrumentedObject(m_tagName);
+        memoryObjectInfo->reportInstrumentedPointer(m_attributeData.get());
+    }
+
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
         : ContainerNode(document, type)
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 8b1b318fe..90f1b91df 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -27,6 +27,7 @@
 #define ElementAttributeData_h
 
 #include "Attribute.h"
+#include "MemoryInstrumentation.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
 #include <wtf/NotFound.h>
@@ -99,6 +100,16 @@ public:
     PassRefPtr<Attr> attrIfExists(Element*, const QualifiedName&);
     PassRefPtr<Attr> ensureAttr(Element*, const QualifiedName&);
 
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        memoryObjectInfo->reportInstrumentedPointer(m_inlineStyleDecl.get());
+        memoryObjectInfo->reportInstrumentedPointer(m_attributeStyle.get());
+        memoryObjectInfo->reportObject(m_classNames);
+        memoryObjectInfo->reportObject(m_idForStyleResolution);
+        memoryObjectInfo->reportObject(m_attributes);
+    }
+
 private:
     friend class Element;
     friend class HTMLConstructionSite;
diff --git a/Source/WebCore/dom/ElementShadow.cpp b/Source/WebCore/dom/ElementShadow.cpp
index 5ae789ce5..1f650f772 100644
--- a/Source/WebCore/dom/ElementShadow.cpp
+++ b/Source/WebCore/dom/ElementShadow.cpp
@@ -74,6 +74,7 @@ void ElementShadow::addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot> sh
         return;
 
     shadowRoot->setHost(shadowHost);
+    shadowRoot->setParentTreeScope(shadowHost->treeScope());
     m_shadowRoots.push(shadowRoot.get());
     invalidateDistribution(shadowHost);
     ChildNodeInsertionNotifier(shadowHost).notify(shadowRoot.get());
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 6de257288..607fda9f5 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -51,12 +51,6 @@ namespace WebCore {
 
 static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
 
-static inline bool isAssignedTo(const Node* node, const InsertionPoint* insertionPoint)
-{
-    ASSERT(insertionPoint);
-    return node && (insertionPoint->contains(node) || (node->isShadowRoot() && toShadowRoot(node)->assignedTo() == insertionPoint));
-}
-
 EventRelatedTargetAdjuster::EventRelatedTargetAdjuster(PassRefPtr<Node> node, PassRefPtr<Node> relatedTarget)
     : m_node(node)
     , m_relatedTarget(relatedTarget)
@@ -67,13 +61,25 @@ EventRelatedTargetAdjuster::EventRelatedTargetAdjuster(PassRefPtr<Node> node, Pa
 
 void EventRelatedTargetAdjuster::adjust(Vector<EventContext>& ancestors)
 {
+    Vector<EventTarget*> relatedTargetStack;
     TreeScope* lastTreeScope = 0;
+    Node* lastNode = 0;
     for (ComposedShadowTreeParentWalker walker(m_relatedTarget.get()); walker.get(); walker.parentIncludingInsertionPointAndShadowRoot()) {
-        TreeScope* scope = walker.get()->treeScope();
-        // Skips adding a node to the map if treeScope does not change.
+        Node* node = walker.get();
+        if (relatedTargetStack.isEmpty())
+            relatedTargetStack.append(node);
+        else if (isInsertionPoint(node) && toInsertionPoint(node)->contains(lastNode))
+            relatedTargetStack.append(relatedTargetStack.last());
+        TreeScope* scope = node->treeScope();
+        // Skips adding a node to the map if treeScope does not change. Just for the performance optimization.
         if (scope != lastTreeScope)
-            m_relatedTargetMap.add(scope, walker.get());
+            m_relatedTargetMap.add(scope, relatedTargetStack.last());
         lastTreeScope = scope;
+        lastNode = node;
+        if (node->isShadowRoot()) {
+            ASSERT(!relatedTargetStack.isEmpty());
+            relatedTargetStack.removeLast();
+        }
     }
 
     lastTreeScope = 0;
@@ -81,7 +87,7 @@ void EventRelatedTargetAdjuster::adjust(Vector<EventContext>& ancestors)
     for (Vector<EventContext>::iterator iter = ancestors.begin(); iter < ancestors.end(); ++iter) {
         TreeScope* scope = iter->node()->treeScope();
         if (scope == lastTreeScope) {
-            // Re-use the previous adjustedRelatedTarget if treeScope does not change.
+            // Re-use the previous adjustedRelatedTarget if treeScope does not change. Just for the performance optimization.
             iter->setRelatedTarget(adjustedRelatedTarget);
         } else {
             adjustedRelatedTarget = findRelatedTarget(scope);
@@ -212,8 +218,10 @@ void EventDispatcher::ensureEventAncestors(Event* event)
     Node* last = 0;
     for (ComposedShadowTreeParentWalker walker(m_node.get()); walker.get(); walker.parentIncludingInsertionPointAndShadowRoot()) {
         Node* node = walker.get();
-        if ((isInsertionPoint(node) && isAssignedTo(last, toInsertionPoint(node))) || targetStack.isEmpty())
+        if (targetStack.isEmpty())
             targetStack.append(eventTargetRespectingSVGTargetRules(node));
+        else if (isInsertionPoint(node) && toInsertionPoint(node)->contains(last))
+            targetStack.append(targetStack.last());
         m_ancestors.append(EventContext(node, eventTargetRespectingSVGTargetRules(node), targetStack.last()));
         if (!inDocument)
             return;
@@ -222,8 +230,10 @@ void EventDispatcher::ensureEventAncestors(Event* event)
             continue;
         if (determineDispatchBehavior(event, toShadowRoot(node)) == StayInsideShadowDOM)
             return;
-        if (!isSVGElement && !targetStack.isEmpty())
+        if (!isSVGElement) {
+            ASSERT(!targetStack.isEmpty());
             targetStack.removeLast();
+        }
     }
 }
 
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index d8f5fdb0a..3056d4a39 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -227,6 +227,8 @@ namespace WebCore {
     \
     macro(webkitnetworkinfochange) \
     \
+    macro(webkitresourcetimingbufferfull) \
+    \
 
 // end of DOM_EVENT_NAMES_FOR_EACH
 
diff --git a/Source/WebCore/dom/EventTargetFactory.in b/Source/WebCore/dom/EventTargetFactory.in
index f01b811ab..3ec6db944 100644
--- a/Source/WebCore/dom/EventTargetFactory.in
+++ b/Source/WebCore/dom/EventTargetFactory.in
@@ -22,6 +22,7 @@ NetworkInfoConnection conditional=NETWORK_INFO
 Node
 Notification conditional=NOTIFICATIONS|LEGACY_NOTIFICATIONS
 PeerConnection00 conditional=MEDIA_STREAM
+Performance conditional=WEB_TIMING
 SharedWorker conditional=SHARED_WORKERS
 SharedWorkerContext conditional=SHARED_WORKERS
 SpeechRecognition conditional=SCRIPTED_SPEECH
diff --git a/Source/WebCore/dom/MemoryInstrumentation.h b/Source/WebCore/dom/MemoryInstrumentation.h
new file mode 100644
index 000000000..6f0e7a470
--- /dev/null
+++ b/Source/WebCore/dom/MemoryInstrumentation.h
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MemoryInstrumentation_h
+#define MemoryInstrumentation_h
+
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class MemoryObjectInfo;
+
+class MemoryInstrumentation {
+public:
+    virtual ~MemoryInstrumentation() { }
+
+    enum ObjectType {
+        Other,
+        DOM,
+        CSS,
+        LastTypeEntry
+    };
+
+    template <typename T> void reportInstrumentedObject(const T&);
+    template <typename T> void reportObject(const T&) { }
+    template <typename T> void reportInstrumentedPointer(const T*);
+    template <typename T> void reportPointer(const T* object, ObjectType objectType)
+    {
+        if (!object || visited(object))
+            return;
+        countObjectSize(objectType, sizeof(T));
+    }
+
+private:
+    friend class MemoryObjectInfo;
+
+    virtual void countObjectSize(ObjectType, size_t) = 0;
+    virtual bool visited(const void*) = 0;
+};
+
+class MemoryObjectInfo {
+public:
+    MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation)
+        : m_memoryInstrumentation(memoryInstrumentation)
+        , m_objectType(MemoryInstrumentation::Other)
+        , m_objectSize(0)
+     { }
+
+    template <typename P>
+    void reportInstrumentedPointer(const P* memberPointer)
+    {
+        m_memoryInstrumentation->reportInstrumentedPointer(memberPointer);
+    }
+
+    template <typename P>
+    void reportPointer(const P* pointer, MemoryInstrumentation::ObjectType objectType)
+    {
+        m_memoryInstrumentation->reportPointer(pointer, objectType);
+    }
+
+    template <typename T>
+    void reportInstrumentedObject(const T& memberObject)
+    {
+        m_memoryInstrumentation->reportInstrumentedObject(memberObject);
+    }
+
+    template <typename T>
+    void reportObject(const T& object) { m_memoryInstrumentation->reportObject(object); }
+
+    template <typename T>
+    void reportObjectInfo(const T*, MemoryInstrumentation::ObjectType objectType)
+    {
+        if (m_objectType != MemoryInstrumentation::Other)
+            return;
+        m_objectType = objectType;
+        m_objectSize = sizeof(T);
+    }
+
+    MemoryInstrumentation::ObjectType objectType() const { return m_objectType; }
+    size_t objectSize() const { return m_objectSize; }
+
+ private:
+    MemoryInstrumentation* m_memoryInstrumentation;
+    MemoryInstrumentation::ObjectType m_objectType;
+    size_t m_objectSize;
+};
+
+template <typename T>
+void MemoryInstrumentation::reportInstrumentedPointer(const T* const object)
+{
+    if (!object || visited(object))
+        return;
+    MemoryObjectInfo memoryObjectInfo(this);
+    object->reportMemoryUsage(&memoryObjectInfo);
+    countObjectSize(memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
+}
+
+template<typename T>
+void MemoryInstrumentation::reportInstrumentedObject(const T& object)
+{
+    if (visited(&object))
+        return;
+    MemoryObjectInfo memoryObjectInfo(this);
+    object.reportMemoryUsage(&memoryObjectInfo);
+}
+
+} // namespace WebCore
+
+#endif // !defined(MemoryInstrumentation_h)
diff --git a/Source/WebCore/dom/MicroDataItemList.cpp b/Source/WebCore/dom/MicroDataItemList.cpp
index b1561a475..7c90dda62 100644
--- a/Source/WebCore/dom/MicroDataItemList.cpp
+++ b/Source/WebCore/dom/MicroDataItemList.cpp
@@ -32,6 +32,7 @@
 #include "Document.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "NodeRareData.h"
 
 namespace WebCore {
 
@@ -46,7 +47,8 @@ MicroDataItemList::MicroDataItemList(PassRefPtr<Node> rootNode, const String& ty
 
 MicroDataItemList::~MicroDataItemList()
 {
-    rootNode()->document()->removeCachedMicroDataItemList(this, m_originalTypeNames);
+    String localTypeNames = m_originalTypeNames.isNull() ? String("http://webkit.org/microdata/undefinedItemType") : m_originalTypeNames;
+    m_node->nodeLists()->removeCacheWithName(this, DynamicNodeList::MicroDataItemListType, localTypeNames);
 }
 
 bool MicroDataItemList::nodeMatches(Element* testNode) const
diff --git a/Source/WebCore/dom/NameNodeList.cpp b/Source/WebCore/dom/NameNodeList.cpp
index b034e8ccd..4ebbed1bc 100644
--- a/Source/WebCore/dom/NameNodeList.cpp
+++ b/Source/WebCore/dom/NameNodeList.cpp
@@ -25,26 +25,27 @@
 
 #include "Element.h"
 #include "HTMLNames.h"
+#include "NodeRareData.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-NameNodeList::NameNodeList(PassRefPtr<Node> rootNode, const String& name)
+NameNodeList::NameNodeList(PassRefPtr<Node> rootNode, const AtomicString& name)
     : DynamicSubtreeNodeList(rootNode)
-    , m_nodeName(name)
+    , m_name(name)
 {
 }
 
 NameNodeList::~NameNodeList()
 {
-    node()->removeCachedNameNodeList(this, m_nodeName);
+    ownerNode()->nodeLists()->removeCacheWithAtomicName(this, DynamicNodeList::NameNodeListType, m_name);
 } 
 
 bool NameNodeList::nodeMatches(Element* testNode) const
 {
-    return testNode->getNameAttribute() == m_nodeName;
+    return testNode->getNameAttribute() == m_name;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NameNodeList.h b/Source/WebCore/dom/NameNodeList.h
index fa664ba86..b030a1f38 100644
--- a/Source/WebCore/dom/NameNodeList.h
+++ b/Source/WebCore/dom/NameNodeList.h
@@ -30,23 +30,23 @@
 
 namespace WebCore {
 
-    // NodeList which lists all Nodes in a Element with a given "name" attribute
-    class NameNodeList : public DynamicSubtreeNodeList {
-    public:
-        static PassRefPtr<NameNodeList> create(PassRefPtr<Node> rootNode, const String& name)
-        {
-            return adoptRef(new NameNodeList(rootNode, name));
-        }
+// NodeList which lists all Nodes in a Element with a given "name" attribute
+class NameNodeList : public DynamicSubtreeNodeList {
+public:
+    static PassRefPtr<NameNodeList> create(PassRefPtr<Node> rootNode, const AtomicString& name)
+    {
+        return adoptRef(new NameNodeList(rootNode, name));
+    }
 
-        virtual ~NameNodeList();
+    virtual ~NameNodeList();
 
-    private:
-        NameNodeList(PassRefPtr<Node> rootNode, const String& name);
+private:
+    NameNodeList(PassRefPtr<Node> rootNode, const AtomicString& name);
 
-        virtual bool nodeMatches(Element*) const;
+    virtual bool nodeMatches(Element*) const;
 
-        AtomicString m_nodeName;
-    };
+    AtomicString m_name;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/NamedNodeMap.idl b/Source/WebCore/dom/NamedNodeMap.idl
index 88820c017..7ee6b7567 100644
--- a/Source/WebCore/dom/NamedNodeMap.idl
+++ b/Source/WebCore/dom/NamedNodeMap.idl
@@ -21,11 +21,10 @@
 module core {
 
     interface [
-        JSGenerateIsReachable=ImplElementRoot,
-        JSCustomMarkFunction,
+        GenerateIsReachable=ImplElementRoot,
         IndexedGetter,
-        NamedGetter,
-        V8CustomToJSObject
+        JSCustomMarkFunction,
+        NamedGetter
     ] NamedNodeMap {
 
         Node getNamedItem(in [Optional=DefaultIsUndefined] DOMString name);
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index f35dc5b99..7446cfa04 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -967,10 +967,7 @@ void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& at
         && (attrName != idAttr || !attributeOwnerElement->isFormControlElement()))
         return;
 
-    if (document()->hasRareData()) {
-        if (NodeListsNodeData* nodeLists = document()->rareData()->nodeLists())
-            nodeLists->invalidateCachesForDocument();
-    }
+    document()->clearNodeListCaches();
 
     if (!treeScope()->hasNodeListCaches())
         return;
@@ -983,7 +980,7 @@ void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& at
         if (!data->nodeLists())
             continue;
 
-        data->nodeLists()->invalidateCachesThatDependOnAttributes();
+        data->nodeLists()->invalidateCaches(&attrName);
     }
 }
 
@@ -992,13 +989,11 @@ void Node::invalidateNodeListsCacheAfterChildrenChanged()
     if (hasRareData())
         rareData()->clearChildNodeListCache();
 
-    if (document()->hasRareData()) {
-        if (NodeListsNodeData* nodeLists = document()->rareData()->nodeLists())
-            nodeLists->invalidateCachesForDocument();
-    }
+    document()->clearNodeListCaches();
 
     if (!treeScope()->hasNodeListCaches())
         return;
+
     for (Node* node = this; node; node = node->parentNode()) {
         if (!node->hasRareData())
             continue;
@@ -1010,54 +1005,9 @@ void Node::invalidateNodeListsCacheAfterChildrenChanged()
     }
 }
 
-void Node::removeCachedClassNodeList(ClassNodeList* list, const String& className)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_classNodeListCache.get(className));
-    data->m_classNodeListCache.remove(className);
-}
-
-void Node::removeCachedNameNodeList(NameNodeList* list, const String& nodeName)
+NodeListsNodeData* Node::nodeLists()
 {
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_nameNodeListCache.get(nodeName));
-    data->m_nameNodeListCache.remove(nodeName);
-}
-
-void Node::removeCachedTagNodeList(TagNodeList* list, const AtomicString& name)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_tagNodeListCache.get(name.impl()));
-    data->m_tagNodeListCache.remove(name.impl());
-}
-
-void Node::removeCachedTagNodeList(TagNodeList* list, const QualifiedName& name)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_tagNodeListCacheNS.get(name.impl()));
-    data->m_tagNodeListCacheNS.remove(name.impl());
-}
-
-void Node::removeCachedLabelsNodeList(DynamicSubtreeNodeList* list)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_labelsNodeListCache);
-    data->m_labelsNodeListCache = 0;
+    return hasRareData() ? rareData()->nodeLists() : 0;
 }
 
 void Node::removeCachedChildNodeList()
@@ -1597,19 +1547,9 @@ PassRefPtr<NodeList> Node::getElementsByTagName(const AtomicString& localName)
     if (localName.isNull())
         return 0;
 
-    AtomicString localNameAtom = localName;
-
-    NodeListsNodeData::TagNodeListCache::AddResult result = ensureRareData()->ensureNodeLists(this)->m_tagNodeListCache.add(localNameAtom, 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<TagNodeList>(result.iterator->second);
-
-    RefPtr<TagNodeList> list;
     if (document()->isHTMLDocument())
-        list = HTMLTagNodeList::create(this, starAtom, localNameAtom);
-    else
-        list = TagNodeList::create(this, starAtom, localNameAtom);
-    result.iterator->second = list.get();
-    return list.release();   
+        return ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<HTMLTagNodeList>(this, DynamicNodeList::TagNodeListType, localName);
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<TagNodeList>(this, DynamicNodeList::TagNodeListType, localName);
 }
 
 PassRefPtr<NodeList> Node::getElementsByTagNameNS(const AtomicString& namespaceURI, const AtomicString& localName)
@@ -1620,39 +1560,23 @@ PassRefPtr<NodeList> Node::getElementsByTagNameNS(const AtomicString& namespaceU
     if (namespaceURI == starAtom)
         return getElementsByTagName(localName);
 
-    AtomicString localNameAtom = localName;
-
-    NodeListsNodeData::TagNodeListCacheNS::AddResult result
-        = ensureRareData()->ensureNodeLists(this)->m_tagNodeListCacheNS.add(QualifiedName(nullAtom, localNameAtom, namespaceURI).impl(), 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<TagNodeList>(result.iterator->second);
-
-    RefPtr<TagNodeList> list = TagNodeList::create(this, namespaceURI.isEmpty() ? nullAtom : namespaceURI, localNameAtom);
-    result.iterator->second = list.get();
-    return list.release();
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithQualifiedName(this, namespaceURI.isEmpty() ? nullAtom : namespaceURI, localName);
 }
 
 PassRefPtr<NodeList> Node::getElementsByName(const String& elementName)
 {
-    NodeListsNodeData::NameNodeListCache::AddResult result = ensureRareData()->ensureNodeLists(this)->m_nameNodeListCache.add(elementName, 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<NodeList>(result.iterator->second);
-
-    RefPtr<NameNodeList> list = NameNodeList::create(this, elementName);
-    result.iterator->second = list.get();
-    return list.release();
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<NameNodeList>(this, DynamicNodeList::NameNodeListType, elementName);
 }
 
 PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
 {
-    NodeListsNodeData::ClassNodeListCache::AddResult result
-        = ensureRareData()->ensureNodeLists(this)->m_classNodeListCache.add(classNames, 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<NodeList>(result.iterator->second);
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithName<ClassNodeList>(this, DynamicNodeList::ClassNodeListType, classNames);
+}
 
-    RefPtr<ClassNodeList> list = ClassNodeList::create(this, classNames);
-    result.iterator->second = list.get();
-    return list.release();
+PassRefPtr<RadioNodeList> Node::radioNodeList(const AtomicString& name)
+{
+    ASSERT(hasTagName(formTag) || hasTagName(fieldsetTag));
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<RadioNodeList>(this, DynamicNodeList::RadioNodeListType, name);
 }
 
 PassRefPtr<Element> Node::querySelector(const AtomicString& selectors, ExceptionCode& ec)
@@ -2314,74 +2238,28 @@ void Node::showTreeForThisAcrossFrame() const
 
 // --------
 
-void NodeListsNodeData::invalidateCaches()
+void NodeListsNodeData::invalidateCaches(const QualifiedName* attrName)
 {
-    TagNodeListCache::const_iterator tagCacheEnd = m_tagNodeListCache.end();
-    for (TagNodeListCache::const_iterator it = m_tagNodeListCache.begin(); it != tagCacheEnd; ++it)
-        it->second->invalidateCache();
-    TagNodeListCacheNS::const_iterator tagCacheNSEnd = m_tagNodeListCacheNS.end();
-    for (TagNodeListCacheNS::const_iterator it = m_tagNodeListCacheNS.begin(); it != tagCacheNSEnd; ++it)
-        it->second->invalidateCache();
-    invalidateCachesThatDependOnAttributes();
-}
-
-void NodeListsNodeData::invalidateCachesForDocument()
-{
-    NodeListsNodeData::NodeListSet::iterator end = m_listsInvalidatedAtDocument.end();
-    for (NodeListsNodeData::NodeListSet::iterator it = m_listsInvalidatedAtDocument.begin(); it != end; ++it)
-        (*it)->invalidateCache();
-}
-
-void NodeListsNodeData::invalidateCachesThatDependOnAttributes()
-{
-    ClassNodeListCache::iterator classCacheEnd = m_classNodeListCache.end();
-    for (ClassNodeListCache::iterator it = m_classNodeListCache.begin(); it != classCacheEnd; ++it)
-        it->second->invalidateCache();
+    NodeListAtomicNameCacheMap::const_iterator atomicNameCacheEnd = m_atomicNameCaches.end();
+    for (NodeListAtomicNameCacheMap::const_iterator it = m_atomicNameCaches.begin(); it != atomicNameCacheEnd; ++it) {
+        if (!attrName || it->second->shouldInvalidateOnAttributeChange())
+            it->second->invalidateCache();
+    }
 
-    NameNodeListCache::iterator nameCacheEnd = m_nameNodeListCache.end();
-    for (NameNodeListCache::iterator it = m_nameNodeListCache.begin(); it != nameCacheEnd; ++it)
-        it->second->invalidateCache();
-    if (m_labelsNodeListCache)
-        m_labelsNodeListCache->invalidateCache();
+    NodeListNameCacheMap::const_iterator nameCacheEnd = m_nameCaches.end();
+    for (NodeListNameCacheMap::const_iterator it = m_nameCaches.begin(); it != nameCacheEnd; ++it) {
+        if (!attrName || it->second->shouldInvalidateOnAttributeChange())
+            it->second->invalidateCache();
+    }
 
-#if ENABLE(MICRODATA)
-    MicroDataItemListCache::iterator itemListCacheEnd = m_microDataItemListCache.end();
-    for (MicroDataItemListCache::iterator it = m_microDataItemListCache.begin(); it != itemListCacheEnd; ++it)
-        it->second->invalidateCache();
-#endif
+    if (!attrName)
+        return;
 
-    RadioNodeListCache::iterator radioNodeListCacheEnd = m_radioNodeListCache.end();
-    for (RadioNodeListCache::iterator it = m_radioNodeListCache.begin(); it != radioNodeListCacheEnd; ++it)
+    TagNodeListCacheNS::iterator tagCacheEnd = m_tagNodeListCacheNS.end();
+    for (TagNodeListCacheNS::iterator it = m_tagNodeListCacheNS.begin(); it != tagCacheEnd; ++it)
         it->second->invalidateCache();
 }
 
-bool NodeListsNodeData::isEmpty() const
-{
-    if (!m_listsInvalidatedAtDocument.isEmpty())
-        return false;
-
-    if (!m_tagNodeListCache.isEmpty())
-        return false;
-    if (!m_tagNodeListCacheNS.isEmpty())
-        return false;
-    if (!m_classNodeListCache.isEmpty())
-        return false;
-    if (!m_nameNodeListCache.isEmpty())
-        return false;
-#if ENABLE(MICRODATA)
-    if (!m_microDataItemListCache.isEmpty())
-        return false;
-#endif
-
-    if (m_labelsNodeListCache)
-        return false;
-
-    if (!m_radioNodeListCache.isEmpty())
-        return false;
-
-    return true;
-}
-
 void Node::getSubresourceURLs(ListHashSet<KURL>& urls) const
 {
     addSubresourceAttributeURLs(urls);
@@ -2890,31 +2768,6 @@ void NodeRareData::clearChildNodeListCache()
         m_childNodeList->invalidateCache();
 }
 
-PassRefPtr<RadioNodeList> Node::radioNodeList(const AtomicString& name)
-{
-    ASSERT(hasTagName(formTag) || hasTagName(fieldsetTag));
-
-    NodeListsNodeData* nodeLists = ensureRareData()->ensureNodeLists(this);
-
-    NodeListsNodeData::RadioNodeListCache::AddResult result = nodeLists->m_radioNodeListCache.add(name, 0);
-    if (!result.isNewEntry)
-        return PassRefPtr<RadioNodeList>(result.iterator->second);
-
-    RefPtr<RadioNodeList> list = RadioNodeList::create(toElement(this), name);
-    result.iterator->second = list.get();
-    return list.release();
-}
-
-void Node::removeCachedRadioNodeList(RadioNodeList* list, const AtomicString& name)
-{
-    ASSERT(rareData());
-    ASSERT(rareData()->nodeLists());
-
-    NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_radioNodeListCache.get(name));
-    data->m_radioNodeListCache.remove(name);
-}
-
 // It's important not to inline removedLastRef, because we don't want to inline the code to
 // delete a Node at each deref call site.
 void Node::removedLastRef()
@@ -2932,6 +2785,16 @@ void Node::removedLastRef()
     delete this;
 }
 
+void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+    TreeShared<Node, ContainerNode>::reportMemoryUsage(memoryObjectInfo);
+    ScriptWrappable::reportMemoryUsage(memoryObjectInfo);
+    memoryObjectInfo->reportPointer(m_document, MemoryInstrumentation::DOM);
+    memoryObjectInfo->reportInstrumentedPointer(m_next);
+    memoryObjectInfo->reportInstrumentedPointer(m_previous);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 265912d01..c9c2674d2 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -29,6 +29,7 @@
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "LayoutTypes.h"
+#include "MemoryInstrumentation.h"
 #include "RenderStyleConstants.h"
 #include "ScriptWrappable.h"
 #include "TreeShared.h"
@@ -69,6 +70,7 @@ class NSResolver;
 class NamedNodeMap;
 class NameNodeList;
 class NodeList;
+class NodeListsNodeData;
 class NodeRareData;
 class NodeRenderingContext;
 class PlatformKeyboardEvent;
@@ -558,23 +560,14 @@ public:
 
     void invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName&, Element* attributeOwnerElement);
     void invalidateNodeListsCacheAfterChildrenChanged();
-    void removeCachedClassNodeList(ClassNodeList*, const String&);
-
-    void removeCachedNameNodeList(NameNodeList*, const String&);
-    void removeCachedTagNodeList(TagNodeList*, const AtomicString&);
-    void removeCachedTagNodeList(TagNodeList*, const QualifiedName&);
-    void removeCachedLabelsNodeList(DynamicSubtreeNodeList*);
-
+    NodeListsNodeData* nodeLists();
     void removeCachedChildNodeList();
 
-    PassRefPtr<RadioNodeList> radioNodeList(const AtomicString&);
-    void removeCachedRadioNodeList(RadioNodeList*, const AtomicString&);
-    void resetCachedRadioNodeListRootNode();
-
     PassRefPtr<NodeList> getElementsByTagName(const AtomicString&);
     PassRefPtr<NodeList> getElementsByTagNameNS(const AtomicString& namespaceURI, const AtomicString& localName);
     PassRefPtr<NodeList> getElementsByName(const String& elementName);
     PassRefPtr<NodeList> getElementsByClassName(const String& classNames);
+    PassRefPtr<RadioNodeList> radioNodeList(const AtomicString&);
 
     PassRefPtr<Element> querySelector(const AtomicString& selectors, ExceptionCode&);
     PassRefPtr<NodeList> querySelectorAll(const AtomicString& selectors, ExceptionCode&);
@@ -656,6 +649,8 @@ public:
     bool hasScopedHTMLStyleChild() const;
     size_t numberOfScopedHTMLStyleChildren() const;
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 private:
     enum NodeFlags {
         IsTextFlag = 1,
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 4740d207e..b7f359e60 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -23,11 +23,9 @@
 #define NodeRareData_h
 
 #include "ChildNodeList.h"
-#include "ClassNodeList.h"
 #include "DOMSettableTokenList.h"
 #include "DynamicNodeList.h"
 #include "MutationObserverRegistration.h"
-#include "NameNodeList.h"
 #include "QualifiedName.h"
 #include "TagNodeList.h"
 #include "WebKitMutationObserver.h"
@@ -48,47 +46,134 @@ class LabelsNodeList;
 class RadioNodeList;
 class TreeScope;
 
-struct NodeListsNodeData {
+class NodeListsNodeData {
     WTF_MAKE_NONCOPYABLE(NodeListsNodeData); WTF_MAKE_FAST_ALLOCATED;
 public:
-    typedef HashSet<DynamicSubtreeNodeList*> NodeListSet;
-    NodeListSet m_listsInvalidatedAtDocument;
+    template <typename StringType>
+    struct NodeListCacheMapEntryHash {
+        static unsigned hash(const std::pair<unsigned char, StringType>& entry)
+        {
+            return DefaultHash<StringType>::Hash::hash(entry.second) + entry.first;
+        }
+        static bool equal(const std::pair<unsigned char, StringType>& a, const std::pair<unsigned char, StringType>& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = DefaultHash<StringType>::Hash::safeToCompareToEmptyOrDeleted;
+    };
+
+    typedef HashMap<std::pair<unsigned char, AtomicString>, DynamicSubtreeNodeList*, NodeListCacheMapEntryHash<AtomicString> > NodeListAtomicNameCacheMap;
+    typedef HashMap<std::pair<unsigned char, String>, DynamicSubtreeNodeList*, NodeListCacheMapEntryHash<String> > NodeListNameCacheMap;
+    typedef HashMap<QualifiedName, TagNodeList*> TagNodeListCacheNS;
+
+    template<typename T>
+    PassRefPtr<T> addCacheWithAtomicName(Node* node, DynamicNodeList::NodeListType listType, const AtomicString& name)
+    {
+        NodeListAtomicNameCacheMap::AddResult result = m_atomicNameCaches.add(namedNodeListKey(listType, name), 0);
+        if (!result.isNewEntry)
+            return static_cast<T*>(result.iterator->second);
 
-    typedef HashMap<String, ClassNodeList*> ClassNodeListCache;
-    ClassNodeListCache m_classNodeListCache;
+        RefPtr<T> list = T::create(node, name);
+        result.iterator->second = list.get();
+        return list.release();
+    }
 
-    typedef HashMap<String, NameNodeList*> NameNodeListCache;
-    NameNodeListCache m_nameNodeListCache;
- 
-    typedef HashMap<AtomicString, TagNodeList*> TagNodeListCache;
-    TagNodeListCache m_tagNodeListCache;
+    template<typename T>
+    PassRefPtr<T> addCacheWithName(Node* node, DynamicNodeList::NodeListType listType, const String& name)
+    {
+        NodeListNameCacheMap::AddResult result = m_nameCaches.add(namedNodeListKey(listType, name), 0);
+        if (!result.isNewEntry)
+            return static_cast<T*>(result.iterator->second);
 
-    typedef HashMap<RefPtr<QualifiedName::QualifiedNameImpl>, TagNodeList*> TagNodeListCacheNS;
-    TagNodeListCacheNS m_tagNodeListCacheNS;
+        RefPtr<T> list = T::create(node, name);
+        result.iterator->second = list.get();
+        return list.release();
+    }
 
-#if ENABLE(MICRODATA)
-    typedef HashMap<String, MicroDataItemList*> MicroDataItemListCache;
-    MicroDataItemListCache m_microDataItemListCache;
-#endif
+    PassRefPtr<TagNodeList> addCacheWithQualifiedName(Node* node, const AtomicString& namespaceURI, const AtomicString& localName)
+    {
+        QualifiedName name(nullAtom, localName, namespaceURI);
+        TagNodeListCacheNS::AddResult result = m_tagNodeListCacheNS.add(name, 0);
+        if (!result.isNewEntry)
+            return result.iterator->second;
+
+        RefPtr<TagNodeList> list = TagNodeList::create(node, namespaceURI, localName);
+        result.iterator->second = list.get();
+        return list.release();
+    }
 
-    LabelsNodeList* m_labelsNodeListCache;
+    void removeCacheWithAtomicName(DynamicSubtreeNodeList* list, DynamicNodeList::NodeListType listType, const AtomicString& name)
+    {
+        ASSERT_UNUSED(list, list == m_atomicNameCaches.get(namedNodeListKey(listType, name)));
+        m_atomicNameCaches.remove(namedNodeListKey(listType, name));
+    }
+
+    void removeCacheWithName(DynamicSubtreeNodeList* list, DynamicNodeList::NodeListType listType, const String& name)
+    {
+        ASSERT_UNUSED(list, list == m_nameCaches.get(namedNodeListKey(listType, name)));
+        m_nameCaches.remove(namedNodeListKey(listType, name));
+    }
 
-    typedef HashMap<String, RadioNodeList*> RadioNodeListCache;
-    RadioNodeListCache m_radioNodeListCache;
+    void removeCacheWithQualifiedName(DynamicSubtreeNodeList* list, const AtomicString& namespaceURI, const AtomicString& localName)
+    {
+        QualifiedName name(nullAtom, localName, namespaceURI);
+        ASSERT_UNUSED(list, list == m_tagNodeListCacheNS.get(name));
+        m_tagNodeListCacheNS.remove(name);
+    }
 
     static PassOwnPtr<NodeListsNodeData> create()
     {
         return adoptPtr(new NodeListsNodeData);
     }
 
-    void invalidateCaches();
-    void invalidateCachesForDocument();
-    void invalidateCachesThatDependOnAttributes();
+    void invalidateCaches(const QualifiedName* attrName = 0);
+    bool isEmpty() const
+    {
+        return m_atomicNameCaches.isEmpty() && m_nameCaches.isEmpty() && m_tagNodeListCacheNS.isEmpty();
+    }
 
-    bool isEmpty() const;
+    void adoptTreeScope(TreeScope* oldTreeScope, TreeScope* newTreeScope, Document* oldDocument, Document* newDocument)
+    {
+        invalidateCaches();
+
+        if (oldDocument != newDocument) {
+            NodeListAtomicNameCacheMap::const_iterator atomicNameCacheEnd = m_atomicNameCaches.end();
+            for (NodeListAtomicNameCacheMap::const_iterator it = m_atomicNameCaches.begin(); it != atomicNameCacheEnd; ++it) {
+                DynamicSubtreeNodeList* list = it->second;
+                if (list->isRootedAtDocument()) {
+                    oldDocument->unregisterDynamicSubtreeNodeList(list);
+                    newDocument->registerDynamicSubtreeNodeList(list);
+                }
+            }
+
+            NodeListNameCacheMap::const_iterator nameCacheEnd = m_nameCaches.end();
+            for (NodeListNameCacheMap::const_iterator it = m_nameCaches.begin(); it != nameCacheEnd; ++it) {
+                DynamicSubtreeNodeList* list = it->second;
+                if (list->isRootedAtDocument()) {
+                    oldDocument->unregisterDynamicSubtreeNodeList(list);
+                    newDocument->registerDynamicSubtreeNodeList(list);
+                }
+            }
+        }
+
+        if (oldTreeScope)
+            oldTreeScope->removeNodeListCache();
+        newTreeScope->addNodeListCache();
+    }
 
 private:
-    NodeListsNodeData() : m_labelsNodeListCache(0) {}
+    NodeListsNodeData() { }
+
+    std::pair<unsigned char, AtomicString> namedNodeListKey(DynamicNodeList::NodeListType listType, const AtomicString& name)
+    {
+        return std::pair<unsigned char, AtomicString>(listType, name);
+    }
+
+    std::pair<unsigned char, String> namedNodeListKey(DynamicNodeList::NodeListType listType, const String& name)
+    {
+        return std::pair<unsigned char, String>(listType, name);
+    }
+
+    NodeListAtomicNameCacheMap m_atomicNameCaches;
+    NodeListNameCacheMap m_nameCaches;
+    TagNodeListCacheNS m_tagNodeListCacheNS;
 };
 
 class NodeRareData {
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index b4d6d4686..b62ffe20e 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -52,11 +52,9 @@ static RenderObject* firstRendererOf(Node*);
 static RenderObject* lastRendererOf(Node*);
 
 NodeRenderingContext::NodeRenderingContext(Node* node)
-    : m_phase(AttachingNotInTree)
-    , m_node(node)
+    : m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
     , m_resetStyleInheritance(false)
-    , m_visualParentShadow(0)
     , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
@@ -66,71 +64,68 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
         return;
 
     if (parent->isShadowRoot() && toShadowRoot(parent)->isYoungest()) {
-        m_phase = AttachingShadowChild;
         m_parentNodeForRenderingAndStyle = toShadowRoot(parent)->host();
         m_resetStyleInheritance = toShadowRoot(parent)->resetStyleInheritance();
         return;
     }
 
     if (parent->isElementNode() || parent->isShadowRoot()) {
+        ElementShadow* parentShadow = 0;
+
         if (parent->isElementNode())
-            m_visualParentShadow = toElement(parent)->shadow();
+            parentShadow = toElement(parent)->shadow();
         else if (parent->isShadowRoot())
-            m_visualParentShadow = toShadowRoot(parent)->owner();
+            parentShadow = toShadowRoot(parent)->owner();
 
-        if (m_visualParentShadow) {
-            m_visualParentShadow->ensureDistribution();
+        if (parentShadow) {
+            parentShadow->ensureDistribution();
 
-            if ((m_insertionPoint = m_visualParentShadow->insertionPointFor(m_node))) {
-                if (m_insertionPoint->shadowRoot()->isUsedForRendering()) {
-                    m_phase = AttachingDistributed;
-                    NodeRenderingContext insertionPointContext(m_insertionPoint);
+            if (InsertionPoint* insertionPoint = parentShadow->insertionPointFor(m_node)) {
+                if (insertionPoint->shadowRoot()->isUsedForRendering()) {
+                    NodeRenderingContext insertionPointContext(insertionPoint);
                     m_parentNodeForRenderingAndStyle = insertionPointContext.parentNodeForRenderingAndStyle();
                     m_resetStyleInheritance = insertionPointContext.resetStyleInheritance();
+                    m_insertionPoint = insertionPoint;
                     return;
                 }
             }
 
-            m_phase = AttachingNotDistributed;
-            m_parentNodeForRenderingAndStyle = parent;
             return;
         }
 
-        if (isShadowBoundary(parent)) {
-            ShadowRoot* parentShadowRoot = parent->shadowRoot();
-            parentShadowRoot->owner()->ensureDistribution();
+        if (isLowerEncapsulationBoundary(parent)) {
+            ShadowRoot* parentScope = parent->shadowRoot();
+            parentScope->owner()->ensureDistribution();
 
-            if (!parentShadowRoot->isUsedForRendering()) {
-                m_phase = AttachingNotDistributed;
-                m_parentNodeForRenderingAndStyle = parent;
+            // The shadow tree isn't part of composed tree.
+            if (!parentScope->isUsedForRendering())
                 return;
-            }
 
+            // the parent insertion point doesn't need any fallback content.
             if (toInsertionPoint(parent)->hasDistribution())
-                m_phase = AttachingNotFallbacked;
-            else
-                m_phase = AttachingFallbacked;
+                return;
 
             if (toInsertionPoint(parent)->isActive()) {
+                // Uses m_node as a fallback node of the insertion point.
                 NodeRenderingContext parentContext(parent);
                 m_parentNodeForRenderingAndStyle = parentContext.parentNodeForRenderingAndStyle();
                 m_resetStyleInheritance = parentContext.resetStyleInheritance();
-            } else
-                m_parentNodeForRenderingAndStyle = parent;
+                return;
+            }
+
+            // The insertion point isn't active thus behaves as a plain old element.
+            m_parentNodeForRenderingAndStyle = parent;
             return;
         }
     }
 
-    m_phase = AttachingStraight;
     m_parentNodeForRenderingAndStyle = parent;
 }
 
 NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
-    : m_phase(Calculating)
-    , m_node(node)
+    : m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
     , m_resetStyleInheritance(false)
-    , m_visualParentShadow(0)
     , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
@@ -241,14 +236,13 @@ static inline RenderObject* lastRendererOf(Node* node)
 
 RenderObject* NodeRenderingContext::nextRenderer() const
 {
-    ASSERT(m_node->renderer() || m_phase != Calculating);
     if (RenderObject* renderer = m_node->renderer())
         return renderer->nextSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
-    if (m_phase == AttachingDistributed) {
+    if (m_insertionPoint) {
         if (RenderObject* found = nextRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).nextRenderer();
@@ -264,15 +258,13 @@ RenderObject* NodeRenderingContext::nextRenderer() const
 
 RenderObject* NodeRenderingContext::previousRenderer() const
 {
-    ASSERT(m_node->renderer() || m_phase != Calculating);
-
     if (RenderObject* renderer = m_node->renderer())
         return renderer->previousSibling();
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
-    if (m_phase == AttachingDistributed) {
+    if (m_insertionPoint) {
         if (RenderObject* found = previousRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).previousRenderer();
@@ -285,24 +277,17 @@ RenderObject* NodeRenderingContext::previousRenderer() const
 
 RenderObject* NodeRenderingContext::parentRenderer() const
 {
-    if (RenderObject* renderer = m_node->renderer()) {
-        ASSERT(m_phase == Calculating);
+    if (RenderObject* renderer = m_node->renderer())
         return renderer->parent();
-    }
-
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer;
 
-    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle ? m_parentNodeForRenderingAndStyle->renderer() : 0;
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
 {
-    ASSERT(m_phase != Calculating);
-    ASSERT(parentNodeForRenderingAndStyle());
-
-    if (m_phase == AttachingNotInTree || m_phase == AttachingNotDistributed || m_phase == AttachingNotFallbacked)
+    if (!m_parentNodeForRenderingAndStyle)
         return false;
     RenderObject* parentRenderer = this->parentRenderer();
     if (!parentRenderer)
@@ -340,6 +325,16 @@ void NodeRenderingContext::moveToFlowThreadIfNeeded()
     flowThreadController->registerNamedFlowContentNode(m_node, m_parentFlowRenderer);
 }
 
+bool NodeRenderingContext::isOnEncapsulationBoundary() const
+{
+    return isOnUpperEncapsulationBoundary() || isLowerEncapsulationBoundary(m_insertionPoint) || isLowerEncapsulationBoundary(m_node->parentNode());
+}
+
+bool NodeRenderingContext::isOnUpperEncapsulationBoundary() const
+{
+    return m_node->parentNode() && m_node->parentNode()->isShadowRoot();
+}
+
 NodeRendererFactory::NodeRendererFactory(Node* node)
     : m_context(node)
 {
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index 60792cb47..28f028fe9 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -68,22 +68,9 @@ public:
     void moveToFlowThreadIfNeeded();
 
 private:
-    enum AttachingPhase {
-        Calculating,
-        AttachingStraight,
-        AttachingNotInTree,
-        AttachingDistributed,
-        AttachingNotDistributed,
-        AttachingFallbacked,
-        AttachingNotFallbacked,
-        AttachingShadowChild,
-    };
-
-    AttachingPhase m_phase;
     Node* m_node;
     ContainerNode* m_parentNodeForRenderingAndStyle;
     bool m_resetStyleInheritance;
-    ElementShadow* m_visualParentShadow;
     InsertionPoint* m_insertionPoint;
     RefPtr<RenderStyle> m_style;
     RenderNamedFlowThread* m_parentFlowRenderer;
@@ -97,13 +84,11 @@ inline Node* NodeRenderingContext::node() const
 
 inline ContainerNode* NodeRenderingContext::parentNodeForRenderingAndStyle() const
 {
-    ASSERT(m_phase != Calculating);
     return m_parentNodeForRenderingAndStyle;
 }
 
 inline bool NodeRenderingContext::resetStyleInheritance() const
 {
-    ASSERT(m_phase != Calculating);
     return m_resetStyleInheritance;
 }
 
@@ -117,18 +102,6 @@ inline InsertionPoint* NodeRenderingContext::insertionPoint() const
     return m_insertionPoint;
 }
 
-inline bool NodeRenderingContext::isOnEncapsulationBoundary() const
-{
-    return (m_phase == AttachingDistributed
-            || m_phase == AttachingShadowChild
-            || m_phase == AttachingFallbacked);
-}
-
-inline bool NodeRenderingContext::isOnUpperEncapsulationBoundary() const
-{
-    return m_phase == AttachingShadowChild;
-}
-
 class NodeRendererFactory {
     WTF_MAKE_NONCOPYABLE(NodeRendererFactory);
     WTF_MAKE_FAST_ALLOCATED;
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index 636b2a515..1907b8774 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -21,6 +21,8 @@
 #ifndef QualifiedName_h
 #define QualifiedName_h
 
+#include "MemoryInstrumentation.h"
+
 #include <wtf/HashTraits.h>
 #include <wtf/RefCounted.h>
 #include <wtf/text/AtomicString.h>
@@ -48,6 +50,14 @@ public:
         const AtomicString m_namespace;
         mutable AtomicString m_localNameUpper;
 
+        void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+        {
+            memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+            memoryObjectInfo->reportObject(m_prefix);
+            memoryObjectInfo->reportObject(m_localName);
+            memoryObjectInfo->reportObject(m_namespace);
+            memoryObjectInfo->reportObject(m_localNameUpper);
+        }
     private:
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
             : m_prefix(prefix)
@@ -92,6 +102,11 @@ public:
     // Init routine for globals
     static void init();
     
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        memoryObjectInfo->reportInstrumentedPointer(m_impl);
+    }
 private:
     void init(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
     void ref() const { m_impl->ref(); }
diff --git a/Source/WebCore/dom/TagNodeList.cpp b/Source/WebCore/dom/TagNodeList.cpp
index 8c93d90b3..60e7b40e7 100644
--- a/Source/WebCore/dom/TagNodeList.cpp
+++ b/Source/WebCore/dom/TagNodeList.cpp
@@ -25,12 +25,13 @@
 #include "TagNodeList.h"
 
 #include "Element.h"
+#include "NodeRareData.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
 TagNodeList::TagNodeList(PassRefPtr<Node> rootNode, const AtomicString& namespaceURI, const AtomicString& localName)
-    : DynamicSubtreeNodeList(rootNode)
+    : DynamicSubtreeNodeList(rootNode, RootedAtNode, DoNotInvalidateOnAttributeChange)
     , m_namespaceURI(namespaceURI)
     , m_localName(localName)
 {
@@ -40,9 +41,9 @@ TagNodeList::TagNodeList(PassRefPtr<Node> rootNode, const AtomicString& namespac
 TagNodeList::~TagNodeList()
 {
     if (m_namespaceURI == starAtom)
-        node()->removeCachedTagNodeList(this, m_localName);
+        ownerNode()->nodeLists()->removeCacheWithAtomicName(this, DynamicNodeList::TagNodeListType, m_localName);
     else
-        node()->removeCachedTagNodeList(this, QualifiedName(nullAtom, m_localName, m_namespaceURI));
+        ownerNode()->nodeLists()->removeCacheWithQualifiedName(this, m_namespaceURI, m_localName);
 }
 
 bool TagNodeList::nodeMatches(Element* testNode) const
@@ -54,8 +55,8 @@ bool TagNodeList::nodeMatches(Element* testNode) const
     return m_namespaceURI == starAtom || m_namespaceURI == testNode->namespaceURI();
 }
 
-HTMLTagNodeList::HTMLTagNodeList(PassRefPtr<Node> rootNode, const AtomicString& namespaceURI, const AtomicString& localName)
-    : TagNodeList(rootNode, namespaceURI, localName)
+HTMLTagNodeList::HTMLTagNodeList(PassRefPtr<Node> rootNode, const AtomicString& localName)
+    : TagNodeList(rootNode, starAtom, localName)
     , m_loweredLocalName(localName.lower())
 {
 }
@@ -69,7 +70,8 @@ bool HTMLTagNodeList::nodeMatches(Element* testNode) const
             return false;
     }
 
-    return m_namespaceURI == starAtom || m_namespaceURI == testNode->namespaceURI();
+    ASSERT(m_namespaceURI == starAtom);
+    return true;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/TagNodeList.h b/Source/WebCore/dom/TagNodeList.h
index b8ccefe52..251a86d40 100644
--- a/Source/WebCore/dom/TagNodeList.h
+++ b/Source/WebCore/dom/TagNodeList.h
@@ -34,9 +34,15 @@ namespace WebCore {
     public:
         static PassRefPtr<TagNodeList> create(PassRefPtr<Node> rootNode, const AtomicString& namespaceURI, const AtomicString& localName)
         {
+            ASSERT(namespaceURI != starAtom);
             return adoptRef(new TagNodeList(rootNode, namespaceURI, localName));
         }
 
+        static PassRefPtr<TagNodeList> create(PassRefPtr<Node> rootNode, const AtomicString& localName)
+        {
+            return adoptRef(new TagNodeList(rootNode, starAtom, localName));
+        }
+
         virtual ~TagNodeList();
 
     protected:
@@ -50,13 +56,13 @@ namespace WebCore {
 
     class HTMLTagNodeList : public TagNodeList {
     public:
-        static PassRefPtr<TagNodeList> create(PassRefPtr<Node> rootNode, const AtomicString& namespaceURI, const AtomicString& localName)
+        static PassRefPtr<HTMLTagNodeList> create(PassRefPtr<Node> rootNode, const AtomicString& localName)
         {
-            return adoptRef(new HTMLTagNodeList(rootNode, namespaceURI, localName));
+            return adoptRef(new HTMLTagNodeList(rootNode, localName));
         }
 
     private:
-        HTMLTagNodeList(PassRefPtr<Node> rootNode, const AtomicString& namespaceURI, const AtomicString& localName);
+        HTMLTagNodeList(PassRefPtr<Node> rootNode, const AtomicString& localName);
 
         virtual bool nodeMatches(Element*) const;
 
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 9ec7d0bbd..a00aaeb53 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -218,7 +218,7 @@ bool Text::rendererIsNeeded(const NodeRenderingContext& context)
             return false;
         
         RenderObject* first = parent->firstChild();
-        while (first && first->isFloatingOrPositioned())
+        while (first && first->isFloatingOrOutOfFlowPositioned())
             first = first->nextSibling();
         RenderObject* next = context.nextRenderer();
         if (!first || next == first)
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index b546591f7..5642fcf8d 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "TreeScope.h"
 
+#include "ComposedShadowTreeWalker.h"
 #include "ContainerNode.h"
 #include "ContextFeatures.h"
 #include "DOMSelection.h"
@@ -38,6 +39,7 @@
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "InsertionPoint.h"
 #include "Page.h"
 #include "ShadowRoot.h"
 #include "TreeScopeAdopter.h"
@@ -224,17 +226,23 @@ Node* TreeScope::focusedNode()
         node = focusedFrameOwnerElement(document->page()->focusController()->focusedFrame(), document->frame());
     if (!node)
         return 0;
-
-    TreeScope* treeScope = node->treeScope();
-
-    while (treeScope != this && treeScope != document) {
-        node = toShadowRoot(treeScope->rootNode())->host();
-        treeScope = node->treeScope();
+    Vector<Node*> targetStack;
+    Node* last = 0;
+    for (ComposedShadowTreeParentWalker walker(node); walker.get(); walker.parentIncludingInsertionPointAndShadowRoot()) {
+        Node* node = walker.get();
+        if (targetStack.isEmpty())
+            targetStack.append(node);
+        else if (isInsertionPoint(node) && toInsertionPoint(node)->contains(last))
+            targetStack.append(targetStack.last());
+        if (node == rootNode())
+            return targetStack.last();
+        last = node;
+        if (node->isShadowRoot()) {
+            ASSERT(!targetStack.isEmpty());
+            targetStack.removeLast();
+        }
     }
-    if (this != treeScope)
-        return 0;
-
-    return node;
+    return 0;
 }
 
 static void listTreeScopes(Node* node, Vector<TreeScope*, 5>& treeScopes)
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index 2f104fa90..3db50e98c 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -53,12 +53,8 @@ void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
 
     for (Node* node = root; node; node = node->traverseNextNode(root)) {
         NodeRareData* rareData = node->setTreeScope(newDocument == m_newScope ? 0 : m_newScope);
-        if (rareData && rareData->nodeLists()) {
-            rareData->nodeLists()->invalidateCaches();
-            if (m_oldScope)
-                m_oldScope->removeNodeListCache();
-            m_newScope->addNodeListCache();
-        }
+        if (rareData && rareData->nodeLists())
+            rareData->nodeLists()->adoptTreeScope(m_oldScope, m_newScope, oldDocument, newDocument);
 
         if (willMoveToNewDocument)
             moveNodeToNewDocument(node, oldDocument, newDocument);
diff --git a/Source/WebCore/dom/ViewportArguments.h b/Source/WebCore/dom/ViewportArguments.h
index 9624e4ae3..707630592 100644
--- a/Source/WebCore/dom/ViewportArguments.h
+++ b/Source/WebCore/dom/ViewportArguments.h
@@ -107,6 +107,11 @@ struct ViewportArguments {
             && height == other.height
             && userScalable == other.userScalable;
     }
+
+    bool operator!=(const ViewportArguments& other) const
+    {
+        return !(*this == other);
+    }
 };
 
 ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport);
diff --git a/Source/WebCore/dom/WebKitMutationObserver.cpp b/Source/WebCore/dom/WebKitMutationObserver.cpp
index 8025b6e2a..6fe6aa778 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.cpp
+++ b/Source/WebCore/dom/WebKitMutationObserver.cpp
@@ -34,6 +34,7 @@
 
 #include "WebKitMutationObserver.h"
 
+#include "Dictionary.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "MutationCallback.h"
@@ -81,15 +82,41 @@ bool WebKitMutationObserver::validateOptions(MutationObserverOptions options)
         && ((options & CharacterData) || !(options & CharacterDataOldValue));
 }
 
-void WebKitMutationObserver::observe(Node* node, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter, ExceptionCode& ec)
+void WebKitMutationObserver::observe(Node* node, const Dictionary& optionsDictionary, ExceptionCode& ec)
 {
     if (!node) {
         ec = NOT_FOUND_ERR;
         return;
     }
 
+    if (optionsDictionary.isUndefinedOrNull()) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+
+    static const struct {
+        const char* name;
+        MutationObserverOptions value;
+    } booleanOptions[] = {
+        { "childList", WebKitMutationObserver::ChildList },
+        { "attributes", WebKitMutationObserver::Attributes },
+        { "characterData", WebKitMutationObserver::CharacterData },
+        { "subtree", WebKitMutationObserver::Subtree },
+        { "attributeOldValue", WebKitMutationObserver::AttributeOldValue },
+        { "characterDataOldValue", WebKitMutationObserver::CharacterDataOldValue }
+    };
+    MutationObserverOptions options = 0;
+    for (unsigned i = 0; i < sizeof(booleanOptions) / sizeof(booleanOptions[0]); ++i) {
+        bool value = false;
+        if (optionsDictionary.get(booleanOptions[i].name, value) && value)
+            options |= booleanOptions[i].value;
+    }
+
+    HashSet<AtomicString> attributeFilter;
+    if (optionsDictionary.get("attributeFilter", attributeFilter))
+        options |= WebKitMutationObserver::AttributeFilter;
+
     if (!validateOptions(options)) {
-        // FIXME: Revisit this once the spec specifies the exception type; SYNTAX_ERR may not be appropriate.
         ec = SYNTAX_ERR;
         return;
     }
diff --git a/Source/WebCore/dom/WebKitMutationObserver.h b/Source/WebCore/dom/WebKitMutationObserver.h
index 38af237e1..bf0964726 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.h
+++ b/Source/WebCore/dom/WebKitMutationObserver.h
@@ -43,6 +43,7 @@
 
 namespace WebCore {
 
+class Dictionary;
 class MutationCallback;
 class MutationObserverRegistration;
 class MutationRecord;
@@ -78,7 +79,7 @@ public:
 
     ~WebKitMutationObserver();
 
-    void observe(Node*, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter, ExceptionCode&);
+    void observe(Node*, const Dictionary&, ExceptionCode&);
     Vector<RefPtr<MutationRecord> > takeRecords();
     void disconnect();
     void observationStarted(MutationObserverRegistration*);
diff --git a/Source/WebCore/dom/WebKitMutationObserver.idl b/Source/WebCore/dom/WebKitMutationObserver.idl
index e535f45bf..c338be28d 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.idl
+++ b/Source/WebCore/dom/WebKitMutationObserver.idl
@@ -34,7 +34,7 @@ module core {
         CustomConstructor,
         ConstructorParameters=1
     ] WebKitMutationObserver {
-        [Custom] void observe(in Node target, in MutationObserverOptions options)
+        void observe(in Node target, in Dictionary options)
             raises(DOMException);
         sequence<MutationRecord> takeRecords();
         void disconnect();
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index 992db5026..1b20e6e42 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -833,6 +833,8 @@ PassRefPtr<Node> CompositeEditCommand::appendBlockPlaceholder(PassRefPtr<Element
 {
     if (!container)
         return 0;
+
+    document()->updateLayoutIgnorePendingStylesheets();
     
     // Should assert isBlockFlow || isInlineFlow when deletion improves. See 4244964.
     ASSERT(container->renderer());
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 5bb05e6a0..c0da24692 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -105,7 +105,7 @@ static bool isDeletableElement(const Node* node)
     if (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(iframeTag))
         return true;
 
-    if (renderer->isPositioned())
+    if (renderer->isOutOfFlowPositioned())
         return true;
 
     if (renderer->isRenderBlock() && !renderer->isTableCell()) {
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 39c9d3cea..85cab133b 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -2296,12 +2296,12 @@ PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
     return avoidIntersectionWithNode(selection.toNormalizedRange().get(), m_deleteButtonController->containerElement());
 }
 
-void Editor::revealSelectionAfterEditingOperation(const ScrollAlignment& alignment)
+void Editor::revealSelectionAfterEditingOperation(const ScrollAlignment& alignment, RevealExtentOption revealExtentOption)
 {
     if (m_ignoreCompositionSelectionChange)
         return;
 
-    m_frame->selection()->revealSelection(alignment);
+    m_frame->selection()->revealSelection(alignment, revealExtentOption);
 }
 
 void Editor::setIgnoreCompositionSelectionChange(bool ignore)
@@ -2311,7 +2311,7 @@ void Editor::setIgnoreCompositionSelectionChange(bool ignore)
 
     m_ignoreCompositionSelectionChange = ignore;
     if (!ignore)
-        revealSelectionAfterEditingOperation();
+        revealSelectionAfterEditingOperation(ScrollAlignment::alignToEdgeIfNeeded, RevealExtent);
 }
 
 PassRefPtr<Range> Editor::compositionRange() const
@@ -2347,6 +2347,19 @@ bool Editor::getCompositionSelection(unsigned& selectionStart, unsigned& selecti
     return true;
 }
 
+bool Editor::setSelectionOffsets(int selectionStart, int selectionEnd)
+{
+    Element* rootEditableElement = m_frame->selection()->rootEditableElement();
+    if (!rootEditableElement)
+        return false;
+
+    RefPtr<Range> range = TextIterator::rangeFromLocationAndLength(rootEditableElement, selectionStart, selectionEnd - selectionStart);
+    if (!range)
+        return false;
+
+    return m_frame->selection()->setSelectedRange(range.get(), VP_DEFAULT_AFFINITY, false);
+}
+
 void Editor::transpose()
 {
     if (!canEdit())
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index cb10bc5af..c55555599 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -295,6 +295,7 @@ public:
     void cancelComposition();
     PassRefPtr<Range> compositionRange() const;
     bool getCompositionSelection(unsigned& selectionStart, unsigned& selectionEnd) const;
+    bool setSelectionOffsets(int selectionStart, int selectionEnd);
 
     // getting international text input composition state (for use by InlineTextBox)
     Text* compositionNode() const { return m_compositionNode.get(); }
@@ -421,7 +422,8 @@ private:
     PassRefPtr<Clipboard> newGeneralClipboard(ClipboardAccessPolicy, Frame*);
     void pasteAsPlainTextWithPasteboard(Pasteboard*);
     void pasteWithPasteboard(Pasteboard*, bool allowPlainText);
-    void revealSelectionAfterEditingOperation(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded);
+
+    void revealSelectionAfterEditingOperation(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded, RevealExtentOption = DoNotRevealExtent);
     void markMisspellingsOrBadGrammar(const VisibleSelection&, bool checkSpelling, RefPtr<Range>& firstMisspellingRange);
     TextCheckingTypeMask resolveTextCheckingTypeMask(TextCheckingTypeMask);
 
diff --git a/Source/WebCore/editing/FrameSelection.cpp b/Source/WebCore/editing/FrameSelection.cpp
index 5b9ca286d..9ccaa962f 100644
--- a/Source/WebCore/editing/FrameSelection.cpp
+++ b/Source/WebCore/editing/FrameSelection.cpp
@@ -303,7 +303,7 @@ void FrameSelection::setSelection(const VisibleSelection& newSelection, SetSelec
         else
             alignment = (align == AlignCursorOnScrollAlways) ? ScrollAlignment::alignTopAlways : ScrollAlignment::alignToEdgeIfNeeded;
 
-        revealSelection(alignment, true);
+        revealSelection(alignment, RevealExtent);
     }
 
     notifyAccessibilityForSelectionChange();
@@ -1932,7 +1932,7 @@ HTMLFormElement* FrameSelection::currentForm() const
     return scanForForm(start);
 }
 
-void FrameSelection::revealSelection(const ScrollAlignment& alignment, bool revealExtent)
+void FrameSelection::revealSelection(const ScrollAlignment& alignment, RevealExtentOption revealExtentOption)
 {
     LayoutRect rect;
 
@@ -1943,7 +1943,7 @@ void FrameSelection::revealSelection(const ScrollAlignment& alignment, bool reve
         rect = absoluteCaretBounds();
         break;
     case VisibleSelection::RangeSelection:
-        rect = revealExtent ? VisiblePosition(extent()).absoluteCaretBounds() : enclosingIntRect(bounds(false));
+        rect = revealExtentOption == RevealExtent ? VisiblePosition(extent()).absoluteCaretBounds() : enclosingIntRect(bounds(false));
         break;
     }
 
diff --git a/Source/WebCore/editing/FrameSelection.h b/Source/WebCore/editing/FrameSelection.h
index 4d7f98775..11b6e4614 100644
--- a/Source/WebCore/editing/FrameSelection.h
+++ b/Source/WebCore/editing/FrameSelection.h
@@ -49,6 +49,11 @@ class VisiblePosition;
 
 enum EUserTriggered { NotUserTriggered = 0, UserTriggered = 1 };
 
+enum RevealExtentOption {
+    RevealExtent,
+    DoNotRevealExtent
+};
+
 class CaretBase {
     WTF_MAKE_NONCOPYABLE(CaretBase);
     WTF_MAKE_FAST_ALLOCATED;
@@ -130,6 +135,7 @@ public:
 
     Element* rootEditableElement() const { return m_selection.rootEditableElement(); }
     Element* rootEditableElementOrDocumentElement() const;
+    bool rendererIsEditable() const { return m_selection.rendererIsEditable(); }
     bool isContentEditable() const { return m_selection.isContentEditable(); }
     bool isContentRichlyEditable() const { return m_selection.isContentRichlyEditable(); }
      
@@ -246,7 +252,7 @@ public:
 
     HTMLFormElement* currentForm() const;
 
-    void revealSelection(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded, bool revealExtent = false);
+    void revealSelection(const ScrollAlignment& = ScrollAlignment::alignCenterIfNeeded, RevealExtentOption = DoNotRevealExtent);
     void setSelectionFromNone();
 
 private:
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index b17ae6b61..7ca3dbeea 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -775,7 +775,7 @@ static bool shouldEmitNewlinesBeforeAndAfterNode(Node* node)
             return true;
     }
     
-    return !r->isInline() && r->isRenderBlock() && !r->isFloatingOrPositioned() && !r->isBody();
+    return !r->isInline() && r->isRenderBlock() && !r->isFloatingOrOutOfFlowPositioned() && !r->isBody();
 }
 
 static bool shouldEmitNewlineAfterNode(Node* node)
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 481cd130a..8cd1df031 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -628,6 +628,11 @@ bool VisibleSelection::isContentEditable() const
     return isEditablePosition(start());
 }
 
+bool VisibleSelection::rendererIsEditable() const
+{
+    return isEditablePosition(start(), ContentIsEditable, DoNotUpdateStyle);
+}
+
 bool VisibleSelection::isContentRichlyEditable() const
 {
     return isRichlyEditablePosition(start());
diff --git a/Source/WebCore/editing/VisibleSelection.h b/Source/WebCore/editing/VisibleSelection.h
index 8c810da4d..2312769bb 100644
--- a/Source/WebCore/editing/VisibleSelection.h
+++ b/Source/WebCore/editing/VisibleSelection.h
@@ -28,6 +28,7 @@
 
 #include "TextGranularity.h"
 #include "VisiblePosition.h"
+#include "htmlediting.h"
 
 namespace WebCore {
 
@@ -99,6 +100,7 @@ public:
     
     Element* rootEditableElement() const;
     bool isContentEditable() const;
+    bool rendererIsEditable() const;
     bool isContentRichlyEditable() const;
     // Returns a shadow tree node for legacy shadow trees, a child of the
     // ShadowRoot node for new shadow trees, or 0 for non-shadow trees.
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index e180ccabd..7d8fc390d 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -145,12 +145,16 @@ Node* lowestEditableAncestor(Node* node)
     return lowestRoot;
 }
 
-bool isEditablePosition(const Position& p, EditableType editableType)
+bool isEditablePosition(const Position& p, EditableType editableType, EUpdateStyle updateStyle)
 {
     Node* node = p.deprecatedNode();
     if (!node)
         return false;
-        
+    if (updateStyle == UpdateStyle)
+        node->document()->updateLayoutIgnorePendingStylesheets();
+    else
+        ASSERT(updateStyle == DoNotUpdateStyle);
+
     if (node->renderer() && node->renderer()->isTable())
         node = node->parentNode();
     
@@ -255,11 +259,15 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
         return firstPositionInNode(highestRoot);
 
     Position p = position;
-    
-    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode())
-        if (shadowAncestor != p.deprecatedNode())
-            p = positionAfterNode(shadowAncestor);
-    
+
+    if (position.deprecatedNode()->treeScope() != highestRoot->treeScope()) {
+        Node* shadowAncestor = highestRoot->treeScope()->ancestorInThisScope(p.deprecatedNode());
+        if (!shadowAncestor)
+            return VisiblePosition();
+
+        p = positionAfterNode(shadowAncestor);
+    }
+
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.deprecatedNode()) ? positionInParentAfterNode(p.deprecatedNode()) : nextVisuallyDistinctCandidate(p);
     
@@ -277,9 +285,12 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
 
     Position p = position;
 
-    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode()) {
-        if (shadowAncestor != p.deprecatedNode())
-            p = firstPositionInOrBeforeNode(shadowAncestor);
+    if (position.deprecatedNode()->treeScope() != highestRoot->treeScope()) {
+        Node* shadowAncestor = highestRoot->treeScope()->ancestorInThisScope(p.deprecatedNode());
+        if (!shadowAncestor)
+            return VisiblePosition();
+
+        p = firstPositionInOrBeforeNode(shadowAncestor);
     }
     
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index a819c492c..29c9a7963 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -151,8 +151,9 @@ inline Position lastPositionInOrAfterNode(Node* node)
 int comparePositions(const Position&, const Position&);
 
 // boolean functions on Position
-    
-bool isEditablePosition(const Position&, EditableType = ContentIsEditable);
+
+enum EUpdateStyle { UpdateStyle, DoNotUpdateStyle };
+bool isEditablePosition(const Position&, EditableType = ContentIsEditable, EUpdateStyle = UpdateStyle);
 bool isRichlyEditablePosition(const Position&, EditableType = ContentIsEditable);
 bool isFirstVisiblePositionInSpecialElement(const Position&);
 bool isLastVisiblePositionInSpecialElement(const Position&);
diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
index 1900ad296..2812173b7 100644
--- a/Source/WebCore/html/BaseCheckableInputType.cpp
+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
@@ -50,7 +50,7 @@ FormControlState BaseCheckableInputType::saveFormControlState() const
 
 void BaseCheckableInputType::restoreFormControlState(const FormControlState& state)
 {
-    element()->setChecked(state.value() == "on");
+    element()->setChecked(state[0] == "on");
 }
 
 bool BaseCheckableInputType::appendFormData(FormDataList& encoding, bool) const
diff --git a/Source/WebCore/html/DOMTokenList.idl b/Source/WebCore/html/DOMTokenList.idl
index 55b636f7d..cf57e1aee 100644
--- a/Source/WebCore/html/DOMTokenList.idl
+++ b/Source/WebCore/html/DOMTokenList.idl
@@ -25,9 +25,8 @@
 module core {
 
     interface [
-        JSGenerateIsReachable=ImplElementRoot,
-        IndexedGetter,
-        V8CustomToJSObject
+        GenerateIsReachable=ImplElementRoot,
+        IndexedGetter
     ] DOMTokenList {
         readonly attribute unsigned long length;
         [TreatReturnedNullStringAs=Null] DOMString item(in unsigned long index);
diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
index f164511d8..f39733d15 100644
--- a/Source/WebCore/html/FileInputType.cpp
+++ b/Source/WebCore/html/FileInputType.cpp
@@ -105,31 +105,25 @@ FormControlState FileInputType::saveFormControlState() const
 {
     if (m_fileList->isEmpty())
         return FormControlState();
-    // FIXME: FormControlState should be capable to have multiple strings and we
-    // should stop the following ugly string concatenation.
-    StringBuilder result;
+    FormControlState state;
     unsigned numFiles = m_fileList->length();
     for (unsigned i = 0; i < numFiles; ++i) {
-        result.append(m_fileList->item(i)->path());
-        result.append('\1');
-        result.append(m_fileList->item(i)->name());
-        result.append('\0');
+        state.append(m_fileList->item(i)->path());
+        state.append(m_fileList->item(i)->name());
     }
-    return FormControlState(result.toString());
+    return state;
 }
 
 void FileInputType::restoreFormControlState(const FormControlState& state)
 {
+    if (state.valueSize() % 2)
+        return;
     Vector<FileChooserFileInfo> files;
-    Vector<String> paths;
-    state.value().split('\0', paths);
-    for (unsigned i = 0; i < paths.size(); ++i) {
-        Vector<String> pathAndName;
-        paths[i].split('\1', pathAndName);
-        if (pathAndName.size() > 1)
-            files.append(FileChooserFileInfo(pathAndName[0], pathAndName[1]));
+    for (size_t i = 0; i < state.valueSize(); i += 2) {
+        if (!state[i + 1].isEmpty())
+            files.append(FileChooserFileInfo(state[i], state[i + 1]));
         else
-            files.append(FileChooserFileInfo(paths[i]));
+            files.append(FileChooserFileInfo(state[i]));
     }
     filesChosen(files);
 }
diff --git a/Source/WebCore/html/FormController.cpp b/Source/WebCore/html/FormController.cpp
index 80d01f2ca..84f44ee94 100644
--- a/Source/WebCore/html/FormController.cpp
+++ b/Source/WebCore/html/FormController.cpp
@@ -22,11 +22,76 @@
 #include "FormController.h"
 
 #include "HTMLFormControlElementWithState.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+// ----------------------------------------------------------------------------
+
+// Serilized form of FormControlState:
+//
+// SerializedControlState ::= SkipState | RestoreState
+// SkipState ::= ''
+// RestoreState ::= (',' EscapedValue )+
+// EscapedValue ::= ('\\' | '\,' | [^\,])+
+
+String FormControlState::serialize() const
+{
+    ASSERT(!isFailure());
+    if (!m_values.size())
+        return emptyString();
+
+    size_t enoughSize = 0;
+    for (size_t i = 0; i < m_values.size(); ++i)
+        enoughSize += 1 + m_values[i].length() * 2;
+    StringBuilder builder;
+    builder.reserveCapacity(enoughSize);
+    for (size_t i = 0; i < m_values.size(); ++i) {
+        builder.append(',');
+        builder.appendEscaped(m_values[i], '\\', ',');
+    }
+    return builder.toString();
+}
+
+FormControlState FormControlState::deserialize(const String& escaped)
+{
+    if (!escaped.length())
+        return FormControlState();
+    if (escaped[0] != ',')
+        return FormControlState(TypeFailure);
+
+    size_t valueSize = 1;
+    for (unsigned i = 1; i < escaped.length(); ++i) {
+        if (escaped[i] == '\\') {
+            if (++i >= escaped.length())
+                return FormControlState(TypeFailure);
+        } else if (escaped[i] == ',')
+            valueSize++;
+    }
+
+    FormControlState state;
+    state.m_values.reserveCapacity(valueSize);
+    StringBuilder builder;
+    for (unsigned i = 1; i < escaped.length(); ++i) {
+        if (escaped[i] == '\\') {
+            if (++i >= escaped.length())
+                return FormControlState(TypeFailure);
+            builder.append(escaped[i]);
+        } else if (escaped[i] == ',') {
+            state.append(builder.toString());
+            builder.clear();
+        } else
+            builder.append(escaped[i]);
+    }
+    state.append(builder.toString());
+    return state;
+}
+
+// ----------------------------------------------------------------------------
+
+
 FormController::FormController()
 {
 }
@@ -35,22 +100,29 @@ FormController::~FormController()
 {
 }
 
+static String formStateSignature()
+{
+    // In the legacy version of serialized state, the first item was a name
+    // attribute value of a form control. The following string literal should
+    // contain some characters which are rarely used for name attribute values.
+    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 4 \n\r=&"));
+    return signature;
+}
+
 Vector<String> FormController::formElementsState() const
 {
     Vector<String> stateVector;
-    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3);
+    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3 + 1);
+    stateVector.append(formStateSignature());
     typedef FormElementListHashSet::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
     for (Iterator it = m_formElementsWithState.begin(); it != end; ++it) {
         HTMLFormControlElementWithState* elementWithState = *it;
         if (!elementWithState->shouldSaveAndRestoreFormControlState())
             continue;
-        FormControlState state = elementWithState->saveFormControlState();
-        if (!state.hasValue())
-            continue;
         stateVector.append(elementWithState->name().string());
         stateVector.append(elementWithState->formControlType().string());
-        stateVector.append(state.value());
+        stateVector.append(elementWithState->saveFormControlState().serialize());
     }
     return stateVector;
 }
@@ -62,31 +134,29 @@ static bool isNotFormControlTypeCharacter(UChar ch)
 
 void FormController::setStateForNewFormElements(const Vector<String>& stateVector)
 {
-    // Walk the state vector backwards so that the value to use for each
-    // name/type pair first is the one at the end of each individual vector
-    // in the FormElementStateMap. We're using them like stacks.
     typedef FormElementStateMap::iterator Iterator;
     m_formElementsWithState.clear();
 
-    if (stateVector.size() % 3)
+    if (stateVector.size() < 1 || stateVector[0] != formStateSignature())
         return;
-    for (size_t i = 0; i < stateVector.size(); i += 3) {
-        if (stateVector[i + 1].find(isNotFormControlTypeCharacter) != notFound)
-            return;
-    }
+    if ((stateVector.size() - 1) % 3)
+        return;
+
+    for (size_t i = 1; i < stateVector.size(); i += 3) {
+        AtomicString name = stateVector[i];
+        AtomicString type = stateVector[i + 1];
+        FormControlState state = FormControlState::deserialize(stateVector[i + 2]);
+        if (type.isEmpty() || type.impl()->find(isNotFormControlTypeCharacter) != notFound || state.isFailure())
+            break;
 
-    for (size_t i = stateVector.size() / 3 * 3; i; i -= 3) {
-        AtomicString name = stateVector[i - 3];
-        AtomicString type = stateVector[i - 2];
-        const String& value = stateVector[i - 1];
         FormElementKey key(name.impl(), type.impl());
         Iterator it = m_stateForNewFormElements.find(key);
         if (it != m_stateForNewFormElements.end())
-            it->second.append(value);
+            it->second.append(state);
         else {
-            Vector<String> valueList(1);
-            valueList[0] = value;
-            m_stateForNewFormElements.set(key, valueList);
+            Deque<FormControlState> stateList;
+            stateList.append(state);
+            m_stateForNewFormElements.set(key, stateList);
         }
     }
 }
@@ -103,10 +173,8 @@ FormControlState FormController::takeStateForFormElement(AtomicStringImpl* name,
     if (it == m_stateForNewFormElements.end())
         return FormControlState();
     ASSERT(it->second.size());
-    FormControlState state(it->second.last());
-    if (it->second.size() > 1)
-        it->second.removeLast();
-    else
+    FormControlState state = it->second.takeFirst();
+    if (!it->second.size())
         m_stateForNewFormElements.remove(it);
     return state;
 }
diff --git a/Source/WebCore/html/FormController.h b/Source/WebCore/html/FormController.h
index 0f2207adf..4de51f524 100644
--- a/Source/WebCore/html/FormController.h
+++ b/Source/WebCore/html/FormController.h
@@ -23,6 +23,7 @@
 #define FormController_h
 
 #include "CheckedRadioButtons.h"
+#include <wtf/Deque.h>
 #include <wtf/Forward.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/Vector.h>
@@ -76,26 +77,38 @@ struct FormElementKeyHashTraits : WTF::GenericHashTraits<FormElementKey> {
 class FormControlState {
 public:
     FormControlState() : m_type(TypeSkip) { }
-    explicit FormControlState(const String& value) : m_type(TypeRestore), m_value(value) { }
-    FormControlState(const FormControlState& another) : m_type(another.m_type), m_value(another.m_value) { }
+    explicit FormControlState(const String& value) : m_type(TypeRestore) { m_values.append(value); }
+    static FormControlState deserialize(const String&);
+    FormControlState(const FormControlState& another) : m_type(another.m_type), m_values(another.m_values) { }
     FormControlState& operator=(const FormControlState&);
 
-    bool hasValue() const { return m_type == TypeRestore; }
-    String value() const { return m_value; }
+    bool isFailure() const { return m_type == TypeFailure; }
+    size_t valueSize() const { return m_values.size(); }
+    const String& operator[](size_t i) const { return m_values[i]; }
+    void append(const String&);
+    String serialize() const;
 
 private:
-    enum Type { TypeSkip, TypeRestore };
+    enum Type { TypeSkip, TypeRestore, TypeFailure };
+    explicit FormControlState(Type type) : m_type(type) { }
+
     Type m_type;
-    String m_value;
+    Vector<String> m_values;
 };
 
 inline FormControlState& FormControlState::operator=(const FormControlState& another)
 {
     m_type = another.m_type;
-    m_value = another.m_value;
+    m_values = another.m_values;
     return *this;
 }
 
+inline void FormControlState::append(const String& value)
+{
+    m_type = TypeRestore;
+    m_values.append(value);
+}
+
 class FormController {
 public:
     static PassOwnPtr<FormController> create()
@@ -129,7 +142,7 @@ private:
     typedef ListHashSet<RefPtr<FormAssociatedElement>, 32> FormAssociatedElementListHashSet;
     FormAssociatedElementListHashSet m_formElementsWithFormAttribute;
 
-    typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
+    typedef HashMap<FormElementKey, Deque<FormControlState>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
     FormElementStateMap m_stateForNewFormElements;
     
 };
diff --git a/Source/WebCore/html/HTMLFormControlElementWithState.cpp b/Source/WebCore/html/HTMLFormControlElementWithState.cpp
index 4152224ee..a884ee1bd 100644
--- a/Source/WebCore/html/HTMLFormControlElementWithState.cpp
+++ b/Source/WebCore/html/HTMLFormControlElementWithState.cpp
@@ -80,7 +80,7 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     Document* doc = document();
     if (doc->formController()->hasStateForNewFormElements()) {
         FormControlState state = doc->formController()->takeStateForFormElement(name().impl(), type().impl());
-        if (state.hasValue())
+        if (state.valueSize() > 0)
             restoreFormControlState(state);
     }
 }
diff --git a/Source/WebCore/html/HTMLFormControlElementWithState.h b/Source/WebCore/html/HTMLFormControlElementWithState.h
index 0af98f8d8..f14d856a8 100644
--- a/Source/WebCore/html/HTMLFormControlElementWithState.h
+++ b/Source/WebCore/html/HTMLFormControlElementWithState.h
@@ -38,7 +38,7 @@ public:
 
     bool shouldSaveAndRestoreFormControlState() const;
     virtual FormControlState saveFormControlState() const;
-    // The specified FormControlState must have one string value.
+    // The specified FormControlState must have at least one string value.
     virtual void restoreFormControlState(const FormControlState&) { }
 
 protected:
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 4a8107ee5..6fcd158f0 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -1461,11 +1461,6 @@ bool HTMLInputElement::isSteppable() const
     return m_inputType->isSteppable();
 }
 
-void HTMLInputElement::stepUpFromRenderer(int n)
-{
-    m_inputType->stepUpFromRenderer(n);
-}
-
 #if ENABLE(INPUT_SPEECH)
 
 bool HTMLInputElement::isSpeechEnabled() const
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 3af2b3525..faeabffba 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -77,7 +77,6 @@ public:
     void stepDown(ExceptionCode& ec) { stepDown(1, ec); }
     // stepUp()/stepDown() for user-interaction.
     bool isSteppable() const;
-    void stepUpFromRenderer(int);
 
     bool isTextButton() const;
 
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index c4accadb2..bcc87fe0c 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -615,9 +615,9 @@ HTMLMediaElement::NetworkState HTMLMediaElement::networkState() const
     return m_networkState;
 }
 
-String HTMLMediaElement::canPlayType(const String& mimeType, const String& keySystem) const
+String HTMLMediaElement::canPlayType(const String& mimeType, const String& keySystem, const KURL& url) const
 {
-    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType), keySystem, this);
+    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType), keySystem, url, this);
     String canPlay;
 
     // 4.8.10.3
@@ -634,7 +634,7 @@ String HTMLMediaElement::canPlayType(const String& mimeType, const String& keySy
             break;
     }
     
-    LOG(Media, "HTMLMediaElement::canPlayType(%s, %s) -> %s", mimeType.utf8().data(), keySystem.utf8().data(), canPlay.utf8().data());
+    LOG(Media, "HTMLMediaElement::canPlayType(%s, %s, %s) -> %s", mimeType.utf8().data(), keySystem.utf8().data(), url.string().utf8().data(), canPlay.utf8().data());
 
     return canPlay;
 }
@@ -3174,7 +3174,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType* contentType, String* k
             if (shouldLog)
                 LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is '%s' - key system is '%s'", type.utf8().data(), system.utf8().data());
 #endif
-            if (!MediaPlayer::supportsType(ContentType(type), system, this))
+            if (!MediaPlayer::supportsType(ContentType(type), system, mediaURL, this))
                 goto check_again;
         }
 
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 1673e1535..4015a2f86 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -128,7 +128,7 @@ public:
 
     PassRefPtr<TimeRanges> buffered() const;
     void load(ExceptionCode&);
-    String canPlayType(const String& mimeType, const String& keySystem = String()) const;
+    String canPlayType(const String& mimeType, const String& keySystem = String(), const KURL& = KURL()) const;
 
 // ready state
     ReadyState readyState() const;
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index a5d8ad2bc..04227aec6 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -919,14 +919,31 @@ FormControlState HTMLSelectElement::saveFormControlState() const
 {
     const Vector<HTMLElement*>& items = listItems();
     size_t length = items.size();
-    StringBuilder builder;
-    builder.reserveCapacity(length);
+    FormControlState state;
     for (unsigned i = 0; i < length; ++i) {
-        HTMLElement* element = items[i];
-        bool selected = element->hasTagName(optionTag) && toHTMLOptionElement(element)->selected();
-        builder.append(selected ? 'X' : '.');
+        if (!items[i]->hasTagName(optionTag))
+            continue;
+        HTMLOptionElement* option = toHTMLOptionElement(items[i]);
+        if (!option->selected())
+            continue;
+        state.append(option->value());
+        if (!multiple())
+            break;
     }
-    return FormControlState(builder.toString());
+    return state;
+}
+
+size_t HTMLSelectElement::searchOptionsForValue(const String& value, size_t listIndexStart, size_t listIndexEnd) const
+{
+    const Vector<HTMLElement*>& items = listItems();
+    size_t loopEndIndex = std::min(items.size(), listIndexEnd);
+    for (size_t i = listIndexStart; i < loopEndIndex; ++i) {
+        if (!items[i]->hasLocalName(optionTag))
+            continue;
+        if (static_cast<HTMLOptionElement*>(items[i])->value() == value)
+            return i;
+    }
+    return notFound;
 }
 
 void HTMLSelectElement::restoreFormControlState(const FormControlState& state)
@@ -934,13 +951,32 @@ void HTMLSelectElement::restoreFormControlState(const FormControlState& state)
     recalcListItems();
 
     const Vector<HTMLElement*>& items = listItems();
-    size_t length = items.size();
+    size_t itemsSize = items.size();
+    if (!itemsSize)
+        return;
 
-    String mask = state.value();
-    for (size_t i = 0; i < length; ++i) {
-        HTMLElement* element = items[i];
-        if (element->hasTagName(optionTag))
-            toHTMLOptionElement(element)->setSelectedState(mask[i] == 'X');
+    for (size_t i = 0; i < itemsSize; ++i) {
+        if (!items[i]->hasLocalName(optionTag))
+            continue;
+        static_cast<HTMLOptionElement*>(items[i])->setSelectedState(false);
+    }
+
+    if (!multiple()) {
+        size_t foundIndex = searchOptionsForValue(state[0], 0, itemsSize);
+        if (foundIndex != notFound)
+            toHTMLOptionElement(items[foundIndex])->setSelectedState(true);
+    } else {
+        size_t startIndex = 0;
+        for (size_t i = 0; i < state.valueSize(); ++i) {
+            const String& value = state[i];
+            size_t foundIndex = searchOptionsForValue(value, startIndex, itemsSize);
+            if (foundIndex == notFound)
+                foundIndex = searchOptionsForValue(value, 0, startIndex);
+            if (foundIndex == notFound)
+                continue;
+            toHTMLOptionElement(items[foundIndex])->setSelectedState(true);
+            startIndex = foundIndex + 1;
+        }
     }
 
     setOptionsChangedOnRenderer();
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index e82b117f2..a2a2e805a 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -164,6 +164,7 @@ private:
     bool platformHandleKeydownEvent(KeyboardEvent*);
     void listBoxDefaultEventHandler(Event*);
     void setOptionsChangedOnRenderer();
+    size_t searchOptionsForValue(const String&, size_t listIndexStart, size_t listIndexEnd) const;
 
     enum SkipDirection {
         SkipBackwards = -1,
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index bf5125f8b..9f2301303 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -109,7 +109,7 @@ FormControlState HTMLTextAreaElement::saveFormControlState() const
 
 void HTMLTextAreaElement::restoreFormControlState(const FormControlState& state)
 {
-    setValue(state.value());
+    setValue(state[0]);
 }
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index 96d4ce001..049637c0e 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -60,7 +60,7 @@ FormControlState HiddenInputType::saveFormControlState() const
 
 void HiddenInputType::restoreFormControlState(const FormControlState& state)
 {
-    element()->setAttribute(valueAttr, state.value());
+    element()->setAttribute(valueAttr, state[0]);
 }
 
 bool HiddenInputType::supportsValidation() const
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 514119fea..30602a009 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -179,7 +179,7 @@ FormControlState InputType::saveFormControlState() const
 
 void InputType::restoreFormControlState(const FormControlState& state)
 {
-    element()->setValue(state.value());
+    element()->setValue(state[0]);
 }
 
 bool InputType::isFormDataAppendable() const
@@ -374,7 +374,7 @@ String InputType::validationMessage() const
     if (numericValue < stepRange.minimum())
         return validationMessageRangeUnderflowText(serialize(stepRange.minimum()));
 
-    if (numericValue < stepRange.maximum())
+    if (numericValue > stepRange.maximum())
         return validationMessageRangeOverflowText(serialize(stepRange.maximum()));
 
     if (stepRange.stepMismatch(numericValue)) {
diff --git a/Source/WebCore/html/LabelableElement.cpp b/Source/WebCore/html/LabelableElement.cpp
index e8247b9ba..1d59936f6 100644
--- a/Source/WebCore/html/LabelableElement.cpp
+++ b/Source/WebCore/html/LabelableElement.cpp
@@ -47,13 +47,7 @@ PassRefPtr<NodeList> LabelableElement::labels()
     if (!document())
         return 0;
 
-    NodeListsNodeData* nodeLists = Node::ensureRareData()->ensureNodeLists(this);
-    if (nodeLists->m_labelsNodeListCache)
-        return nodeLists->m_labelsNodeListCache;
-
-    RefPtr<LabelsNodeList> list = LabelsNodeList::create(this);
-    nodeLists->m_labelsNodeListCache = list.get();
-    return list.release();
+    return Node::ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<LabelsNodeList>(this, DynamicNodeList::LabelsNodeListType, starAtom);
 }
 
 } // namespace Webcore
diff --git a/Source/WebCore/html/LabelsNodeList.cpp b/Source/WebCore/html/LabelsNodeList.cpp
index fb3442be6..89f0baf7c 100644
--- a/Source/WebCore/html/LabelsNodeList.cpp
+++ b/Source/WebCore/html/LabelsNodeList.cpp
@@ -27,6 +27,7 @@
 #include "Element.h"
 #include "HTMLLabelElement.h"
 #include "HTMLNames.h"
+#include "NodeRareData.h"
 
 namespace WebCore {
 
@@ -34,20 +35,19 @@ using namespace HTMLNames;
 
 LabelsNodeList::LabelsNodeList(Node* forNode)
     : DynamicSubtreeNodeList(forNode, RootedAtDocument)
-    , m_forNode(forNode)
 {
-    m_forNode->document()->registerDynamicSubtreeNodeList(this);
+    document()->registerDynamicSubtreeNodeList(this);
 }
 
 LabelsNodeList::~LabelsNodeList()
 {
-    m_forNode->removeCachedLabelsNodeList(this);
-    m_forNode->document()->unregisterDynamicSubtreeNodeList(this);
+    ownerNode()->nodeLists()->removeCacheWithAtomicName(this, DynamicNodeList::LabelsNodeListType, starAtom);
+    document()->unregisterDynamicSubtreeNodeList(this);
 } 
     
 bool LabelsNodeList::nodeMatches(Element* testNode) const
 {
-    return testNode->hasTagName(labelTag) && static_cast<HTMLLabelElement*>(testNode)->control() == m_forNode;
+    return testNode->hasTagName(labelTag) && static_cast<HTMLLabelElement*>(testNode)->control() == ownerNode();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/LabelsNodeList.h b/Source/WebCore/html/LabelsNodeList.h
index b89b2085c..5879f9254 100644
--- a/Source/WebCore/html/LabelsNodeList.h
+++ b/Source/WebCore/html/LabelsNodeList.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class LabelsNodeList : public DynamicSubtreeNodeList {
 public:
-    static PassRefPtr<LabelsNodeList> create(Node* forNode)
+    static PassRefPtr<LabelsNodeList> create(Node* forNode, const AtomicString&)
     {
         return adoptRef(new LabelsNodeList(forNode));
     }
@@ -42,9 +42,6 @@ protected:
     LabelsNodeList(Node* forNode);
 
     virtual bool nodeMatches(Element*) const;
-
-private:
-    RefPtr<Node> m_forNode;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/RadioNodeList.cpp b/Source/WebCore/html/RadioNodeList.cpp
index 3c3a618ab..15efb5155 100644
--- a/Source/WebCore/html/RadioNodeList.cpp
+++ b/Source/WebCore/html/RadioNodeList.cpp
@@ -31,23 +31,23 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "NodeRareData.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-RadioNodeList::RadioNodeList(Element* baseElement, const AtomicString& name)
-    : DynamicSubtreeNodeList(baseElement, baseElement->hasTagName(formTag) ? RootedAtDocument : RootedAtNode)
+RadioNodeList::RadioNodeList(Node* rootNode, const AtomicString& name)
+    : DynamicSubtreeNodeList(rootNode, rootNode->hasTagName(formTag) ? RootedAtDocument : RootedAtNode)
     , m_name(name)
-    , m_baseElement(baseElement)
 {
-    m_baseElement->document()->registerDynamicSubtreeNodeList(this);
+    document()->registerDynamicSubtreeNodeList(this);
 }
 
 RadioNodeList::~RadioNodeList()
 {
-    m_baseElement->removeCachedRadioNodeList(this, m_name);
-    m_baseElement->document()->unregisterDynamicSubtreeNodeList(this);
+    ownerNode()->nodeLists()->removeCacheWithAtomicName(this, DynamicNodeList::RadioNodeListType, m_name);
+    document()->unregisterDynamicSubtreeNodeList(this);
 }
 
 static inline HTMLInputElement* toRadioButtonInputElement(Node* node)
@@ -86,13 +86,13 @@ void RadioNodeList::setValue(const String& value)
 bool RadioNodeList::checkElementMatchesRadioNodeListFilter(Element* testElement) const
 {
     ASSERT(testElement->hasTagName(objectTag) || testElement->isFormControlElement());
-    if (m_baseElement->hasTagName(formTag)) {
+    if (ownerNode()->hasTagName(formTag)) {
         HTMLFormElement* formElement = 0;
         if (testElement->hasTagName(objectTag))
             formElement = static_cast<HTMLObjectElement*>(testElement)->form();
         else
             formElement = static_cast<HTMLFormControlElement*>(testElement)->form();
-        if (!formElement || formElement != m_baseElement)
+        if (!formElement || formElement != ownerNode())
             return false;
     }
 
diff --git a/Source/WebCore/html/RadioNodeList.h b/Source/WebCore/html/RadioNodeList.h
index 46065b383..18eb288ad 100644
--- a/Source/WebCore/html/RadioNodeList.h
+++ b/Source/WebCore/html/RadioNodeList.h
@@ -36,9 +36,9 @@ namespace WebCore {
 
 class RadioNodeList : public DynamicSubtreeNodeList {
 public:
-    static PassRefPtr<RadioNodeList> create(Element* baseElement, const AtomicString& name)
+    static PassRefPtr<RadioNodeList> create(Node* rootNode, const AtomicString& name)
     {
-        return adoptRef(new RadioNodeList(baseElement, name));
+        return adoptRef(new RadioNodeList(rootNode, name));
     }
 
     ~RadioNodeList();
@@ -50,11 +50,10 @@ protected:
     virtual bool nodeMatches(Element*) const;
 
 private:
-    RadioNodeList(Element*, const AtomicString& name);
+    RadioNodeList(Node*, const AtomicString& name);
     bool checkElementMatchesRadioNodeListFilter(Element*) const;
 
     AtomicString m_name;
-    RefPtr<Element> m_baseElement;
 };
 
 } // namepsace
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index af53255bb..632816be7 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -63,6 +63,8 @@ TextFieldInputType::TextFieldInputType(HTMLInputElement* element)
 
 TextFieldInputType::~TextFieldInputType()
 {
+    if (m_innerSpinButton)
+        m_innerSpinButton->removeStepActionHandler();
 }
 
 bool TextFieldInputType::isKeyboardFocusable(KeyboardEvent*) const
@@ -152,14 +154,12 @@ void TextFieldInputType::handleKeydownEventForSpinButton(KeyboardEvent* event)
     if (element()->disabled() || element()->readOnly())
         return;
     const String& key = event->keyIdentifier();
-    int step = 0;
     if (key == "Up")
-        step = 1;
+        spinButtonStepUp();
     else if (key == "Down")
-        step = -1;
+        spinButtonStepDown();
     else
         return;
-    element()->stepUpFromRenderer(step);
     event->setDefaultHandled();
 }
 
@@ -167,14 +167,12 @@ void TextFieldInputType::handleWheelEventForSpinButton(WheelEvent* event)
 {
     if (element()->disabled() || element()->readOnly() || !element()->focused())
         return;
-    int step = 0;
     if (event->wheelDeltaY() > 0)
-        step = 1;
+        spinButtonStepUp();
     else if (event->wheelDeltaY() < 0)
-        step = -1;
+        spinButtonStepDown();
     else
         return;
-    element()->stepUpFromRenderer(step);
     event->setDefaultHandled();
 }
 
@@ -184,8 +182,10 @@ void TextFieldInputType::forwardEvent(Event* event)
         RenderTextControlSingleLine* renderTextControl = toRenderTextControlSingleLine(element()->renderer());
         if (event->type() == eventNames().blurEvent) {
             if (RenderBox* innerTextRenderer = innerTextElement()->renderBox()) {
-                if (RenderLayer* innerLayer = innerTextRenderer->layer())
-                    innerLayer->scrollToOffset(!renderTextControl->style()->isLeftToRightDirection() ? innerLayer->scrollWidth() : 0, 0, RenderLayer::ScrollOffsetClamped);
+                if (RenderLayer* innerLayer = innerTextRenderer->layer()) {
+                    IntSize scrollOffset(!renderTextControl->style()->isLeftToRightDirection() ? innerLayer->scrollWidth() : 0, 0);
+                    innerLayer->scrollToOffset(scrollOffset, RenderLayer::ScrollOffsetClamped);
+                }
             }
 
             renderTextControl->capsLockStateMayHaveChanged();
@@ -268,7 +268,7 @@ void TextFieldInputType::createShadowSubtree()
 #endif
 
     if (shouldHaveSpinButton) {
-        m_innerSpinButton = SpinButtonElement::create(document);
+        m_innerSpinButton = SpinButtonElement::create(document, *this);
         m_container->appendChild(m_innerSpinButton, ec);
     }
 
@@ -318,6 +318,8 @@ void TextFieldInputType::destroyShadowSubtree()
 #if ENABLE(INPUT_SPEECH)
     m_speechButton.clear();
 #endif
+    if (m_innerSpinButton)
+        m_innerSpinButton->removeStepActionHandler();
     m_innerSpinButton.clear();
     m_container.clear();
 }
@@ -438,4 +440,15 @@ bool TextFieldInputType::appendFormData(FormDataList& list, bool multipart) cons
     return true;
 }
 
+void TextFieldInputType::spinButtonStepDown()
+{
+    stepUpFromRenderer(-1);
+}
+
+void TextFieldInputType::spinButtonStepUp()
+{
+    stepUpFromRenderer(1);
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/TextFieldInputType.h b/Source/WebCore/html/TextFieldInputType.h
index b3629d0d3..4c7a9bac4 100644
--- a/Source/WebCore/html/TextFieldInputType.h
+++ b/Source/WebCore/html/TextFieldInputType.h
@@ -32,6 +32,7 @@
 #define TextFieldInputType_h
 
 #include "InputType.h"
+#include "TextControlInnerElements.h"
 
 namespace WebCore {
 
@@ -40,7 +41,7 @@ class SpinButtonElement;
 
 // The class represents types of which UI contain text fields.
 // It supports not only the types for BaseTextInputType but also type=number.
-class TextFieldInputType : public InputType {
+class TextFieldInputType : public InputType, private SpinButtonElement::StepActionHandler {
 protected:
     TextFieldInputType(HTMLInputElement*);
     virtual ~TextFieldInputType();
@@ -84,6 +85,10 @@ private:
     virtual bool appendFormData(FormDataList&, bool multipart) const OVERRIDE;
     virtual void attach() OVERRIDE;
 
+    // SpinButtonElement::StepActionHandler functions.
+    virtual void spinButtonStepDown() OVERRIDE;
+    virtual void spinButtonStepUp() OVERRIDE;
+
     RefPtr<HTMLElement> m_container;
     RefPtr<HTMLElement> m_innerBlock;
     RefPtr<HTMLElement> m_innerText;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 5ce428503..8f78500a1 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -3634,6 +3634,19 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
         ec = SECURITY_ERR;
         return;
     }
+
+    WebGLTexture* texture = validateTextureBinding("texImage2D", target, true);
+    // If possible, copy from the canvas element directly to the texture
+    // via the GPU, without a read-back to system memory.
+    if (GraphicsContext3D::TEXTURE_2D == target && texture && type == texture->getType(target, level)) {
+        ImageBuffer* buffer = canvas->buffer();
+        if (buffer && buffer->copyToPlatformTexture(*m_context.get(), texture->object(), internalformat, m_unpackPremultiplyAlpha, m_unpackFlipY)) {
+            texture->setLevelInfo(target, level, internalformat, canvas->width(), canvas->height(), type);
+            cleanupAfterGraphicsCall(false);
+            return;
+        }
+    }
+
     RefPtr<ImageData> imageData = canvas->getImageData();
     if (imageData)
         texImage2D(target, level, internalformat, format, type, imageData.get(), ec);
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index 2f491e2d9..2d829f658 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -60,11 +60,6 @@ public:
     {
         return adoptRef(new HTMLDocumentParser(document, reportErrors));
     }
-    static PassRefPtr<HTMLDocumentParser> create(DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission permission)
-    {
-        return adoptRef(new HTMLDocumentParser(fragment, contextElement, permission));
-    }
-
     virtual ~HTMLDocumentParser();
 
     // Exposed for HTMLParserScheduler
@@ -95,6 +90,11 @@ protected:
     HTMLTreeBuilder* treeBuilder() const { return m_treeBuilder.get(); }
 
 private:
+    static PassRefPtr<HTMLDocumentParser> create(DocumentFragment* fragment, Element* contextElement, FragmentScriptingPermission permission)
+    {
+        return adoptRef(new HTMLDocumentParser(fragment, contextElement, permission));
+    }
+
     // DocumentParser
     virtual void detach();
     virtual bool hasInsertionPoint();
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 759d23b1f..56b765896 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -56,8 +56,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static const int uninitializedLineNumberValue = -1;
-
 static TextPosition uninitializedPositionValue1()
 {
     return TextPosition(OrdinalNumber::fromOneBasedInt(-1), OrdinalNumber::first());
diff --git a/Source/WebCore/html/shadow/CalendarPickerElement.cpp b/Source/WebCore/html/shadow/CalendarPickerElement.cpp
index 5358ccaf7..fe1f64e13 100644
--- a/Source/WebCore/html/shadow/CalendarPickerElement.cpp
+++ b/Source/WebCore/html/shadow/CalendarPickerElement.cpp
@@ -151,12 +151,7 @@ static void addJavaScriptString(const String& str, DocumentWriter& writer)
 {
     addLiteral("\"", writer);
     StringBuilder builder;
-    builder.reserveCapacity(str.length());
-    for (unsigned i = 0; i < str.length(); ++i) {
-        if (str[i] == '\\' || str[i] == '"')
-            builder.append('\\');
-        builder.append(str[i]);
-    }
+    builder.appendEscaped(str, '\\', '"');
     addString(builder.toString(), writer);
     addLiteral("\"", writer);
 }
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
index 98ca15486..6237de2e6 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.h
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -34,6 +34,7 @@
 #include "ContentDistributor.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "ShadowRoot.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -57,7 +58,7 @@ public:
     virtual bool isInsertionPoint() const OVERRIDE { return true; }
 
     size_t indexOf(Node* node) const { return m_distribution.find(node); }
-    bool contains(const Node* node) const { return m_distribution.contains(const_cast<Node*>(node)); }
+    bool contains(const Node* node) const { return m_distribution.contains(const_cast<Node*>(node)) || (node->isShadowRoot() && toShadowRoot(node)->assignedTo() == this); }
     size_t size() const { return m_distribution.size(); }
     Node* at(size_t index)  const { return m_distribution.at(index).get(); }
     Node* first() const { return m_distribution.isEmpty() ? 0 : m_distribution.first().get(); }
@@ -79,7 +80,7 @@ private:
 inline bool isInsertionPoint(const Node* node)
 {
     if (!node)
-        return true;
+        return false;
 
     if (node->isHTMLElement() && toHTMLElement(node)->isInsertionPoint())
         return true;
@@ -104,7 +105,7 @@ inline bool isActiveInsertionPoint(const Node* node)
     return isInsertionPoint(node) && toInsertionPoint(node)->isActive();
 }
 
-inline bool isShadowBoundary(Node* node)
+inline bool isLowerEncapsulationBoundary(Node* node)
 {
     if (!isInsertionPoint(node))
         return false;
diff --git a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
index f4ce3d617..9edbd8ad3 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
@@ -74,9 +74,7 @@ MediaControlRootElementChromium::MediaControlRootElementChromium(Document* docum
     , m_timeline(0)
     , m_panelMuteButton(0)
     , m_volumeSlider(0)
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
     , m_fullscreenButton(0)
-#endif
     , m_panel(0)
     , m_enclosure(0)
 #if ENABLE(VIDEO_TRACK)
@@ -146,13 +144,11 @@ PassRefPtr<MediaControlRootElementChromium> MediaControlRootElementChromium::cre
     if (ec)
         return 0;
 
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
     RefPtr<MediaControlFullscreenButtonElement> fullscreenButton = MediaControlFullscreenButtonElement::create(document, controls.get());
     controls->m_fullscreenButton = fullscreenButton.get();
     panel->appendChild(fullscreenButton.release(), ec, true);
     if (ec)
         return 0;
-#endif
 
     controls->m_panel = panel.get();
     enclosure->appendChild(panel.release(), ec, true);
@@ -185,10 +181,8 @@ void MediaControlRootElementChromium::setMediaController(MediaControllerInterfac
         m_panelMuteButton->setMediaController(controller);
     if (m_volumeSlider)
         m_volumeSlider->setMediaController(controller);
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
     if (m_fullscreenButton)
         m_fullscreenButton->setMediaController(controller);
-#endif
     if (m_panel)
         m_panel->setMediaController(controller);
     if (m_enclosure)
@@ -242,12 +236,19 @@ void MediaControlRootElementChromium::reset()
 
     m_panelMuteButton->show();
 
-    if (m_volumeSlider)
-        m_volumeSlider->setVolume(m_mediaController->volume());
+    if (m_volumeSlider) {
+        if (!m_mediaController->hasAudio())
+            m_volumeSlider->hide();
+        else {
+            m_volumeSlider->show();
+            m_volumeSlider->setVolume(m_mediaController->volume());
+        }
+    }
 
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
-    m_fullscreenButton->show();
-#endif
+    if (m_mediaController->supportsFullscreen())
+        m_fullscreenButton->show();
+    else
+        m_fullscreenButton->hide();
     makeOpaque();
 }
 
@@ -309,12 +310,9 @@ void MediaControlRootElementChromium::reportedError()
     if (!page)
         return;
 
-    m_timeline->hide();
     m_panelMuteButton->hide();
     m_volumeSlider->hide();
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
     m_fullscreenButton->hide();
-#endif
 }
 
 void MediaControlRootElementChromium::updateStatusDisplay()
diff --git a/Source/WebCore/html/shadow/MediaControlRootElementChromium.h b/Source/WebCore/html/shadow/MediaControlRootElementChromium.h
index f10b728e8..f86bc615a 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElementChromium.h
+++ b/Source/WebCore/html/shadow/MediaControlRootElementChromium.h
@@ -140,12 +140,9 @@ private:
     MediaControlCurrentTimeDisplayElement* m_currentTimeDisplay;
     MediaControlTimeRemainingDisplayElement* m_durationDisplay;
     MediaControlTimelineElement* m_timeline;
-    MediaControlTimelineContainerElement* m_timelineContainer;
     MediaControlPanelMuteButtonElement* m_panelMuteButton;
     MediaControlVolumeSliderElement* m_volumeSlider;
-#if ENABLE(FULLSCREEN_MEDIA_CONTROLS)
     MediaControlFullscreenButtonElement* m_fullscreenButton;
-#endif
     MediaControlPanelElement* m_panel;
     MediaControlChromiumEnclosureElement* m_enclosure;
 #if ENABLE(VIDEO_TRACK)
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 5d26841c2..c04fb55f8 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -234,8 +234,9 @@ void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
 
 // ----------------------------
 
-inline SpinButtonElement::SpinButtonElement(Document* document)
+inline SpinButtonElement::SpinButtonElement(Document* document, StepActionHandler& stepActionHandler)
     : HTMLDivElement(divTag, document)
+    , m_stepActionHandler(&stepActionHandler)
     , m_capturing(false)
     , m_upDownState(Indeterminate)
     , m_pressStartingState(Indeterminate)
@@ -243,9 +244,9 @@ inline SpinButtonElement::SpinButtonElement(Document* document)
 {
 }
 
-PassRefPtr<SpinButtonElement> SpinButtonElement::create(Document* document)
+PassRefPtr<SpinButtonElement> SpinButtonElement::create(Document* document, StepActionHandler& stepActionHandler)
 {
-    return adoptRef(new SpinButtonElement(document));
+    return adoptRef(new SpinButtonElement(document, stepActionHandler));
 }
 
 const AtomicString& SpinButtonElement::shadowPseudoId() const
@@ -294,7 +295,7 @@ void SpinButtonElement::defaultEventHandler(Event* event)
             input->select();
             if (renderer()) {
                 if (m_upDownState != Indeterminate) {
-                    input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
+                    doStepAction(m_upDownState == Up ? 1 : -1);
                     if (renderer())
                         startRepeatingTimer();
                 }
@@ -325,6 +326,17 @@ void SpinButtonElement::defaultEventHandler(Event* event)
         HTMLDivElement::defaultEventHandler(event);
 }
 
+void SpinButtonElement::doStepAction(int amount)
+{
+    if (!m_stepActionHandler)
+        return;
+
+    if (amount > 0)
+        m_stepActionHandler->spinButtonStepUp();
+    else if (amount < 0)
+        m_stepActionHandler->spinButtonStepDown();
+}
+
 void SpinButtonElement::releaseCapture()
 {
     stopRepeatingTimer();
@@ -360,7 +372,7 @@ void SpinButtonElement::step(int amount)
     if (m_upDownState != m_pressStartingState)
         return;
 #endif
-    input->stepUpFromRenderer(amount);
+    doStepAction(amount);
 }
     
 void SpinButtonElement::repeatingTimerFired(Timer<SpinButtonElement>*)
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index c2280f1e8..6f1a9993a 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -96,14 +96,25 @@ public:
         Up,
     };
 
-    static PassRefPtr<SpinButtonElement> create(Document*);
+    class StepActionHandler {
+    public:
+        virtual ~StepActionHandler() { }
+        virtual void spinButtonStepDown() = 0;
+        virtual void spinButtonStepUp() = 0;
+    };
+
+    // The owner of SpinButtonElement must call removeStepActionHandler
+    // because SpinButtonElement can be outlive StepActionHandler
+    // implementation, e.g. during event handling.
+    static PassRefPtr<SpinButtonElement> create(Document*, StepActionHandler&);
     UpDownState upDownState() const { return m_upDownState; }
     virtual void releaseCapture();
+    void removeStepActionHandler() { m_stepActionHandler = 0; }
 
     void step(int amount);
     
 private:
-    SpinButtonElement(Document*);
+    SpinButtonElement(Document*, StepActionHandler&);
 
     virtual const AtomicString& shadowPseudoId() const;
     virtual void detach();
@@ -111,12 +122,14 @@ private:
     virtual bool isEnabledFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isEnabledFormControl(); }
     virtual bool isReadOnlyFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isReadOnlyFormControl(); }
     virtual void defaultEventHandler(Event*);
+    void doStepAction(int);
     void startRepeatingTimer();
     void stopRepeatingTimer();
     void repeatingTimerFired(Timer<SpinButtonElement>*);
     virtual void setHovered(bool = true);
     virtual bool isMouseFocusable() const { return false; }
 
+    StepActionHandler* m_stepActionHandler;
     bool m_capturing;
     UpDownState m_upDownState;
     UpDownState m_pressStartingState;
diff --git a/Source/WebCore/html/track/TextTrackList.idl b/Source/WebCore/html/track/TextTrackList.idl
index 3f6efac0c..ad4e8621c 100644
--- a/Source/WebCore/html/track/TextTrackList.idl
+++ b/Source/WebCore/html/track/TextTrackList.idl
@@ -28,11 +28,11 @@ module html {
     interface [
         Conditional=VIDEO_TRACK,
         V8EnabledAtRuntime=webkitVideoTrack,
-        V8CustomToJSObject,
         IndexedGetter,
         EventTarget,
         JSCustomMarkFunction,
-        JSCustomIsReachable
+        JSCustomIsReachable,
+        V8GenerateIsReachable=ImplOwnerRoot
     ] TextTrackList {
         readonly attribute unsigned long length;
         TextTrack item(in unsigned long index);
diff --git a/Source/WebCore/inspector/DOMWrapperVisitor.h b/Source/WebCore/inspector/BindingVisitors.h
index 4bf246f35..7530c9247 100644
--- a/Source/WebCore/inspector/DOMWrapperVisitor.h
+++ b/Source/WebCore/inspector/BindingVisitors.h
@@ -26,21 +26,40 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DOMWrapperVisitor_h
-#define DOMWrapperVisitor_h
+#ifndef BindingVisitors_h
+#define BindingVisitors_h
+
+namespace WTF {
+class ArrayBufferView;
+class StringImpl;
+}
 
 namespace WebCore {
 
 class Node;
 
-class DOMWrapperVisitor {
+class NodeWrapperVisitor {
 public:
     virtual void visitNode(Node*) = 0;
-    virtual void visitJSExternalString(StringImpl*) = 0;
 protected:
-    virtual ~DOMWrapperVisitor() { }
+    virtual ~NodeWrapperVisitor() { }
+};
+
+class ExternalStringVisitor {
+public:
+    virtual void visitJSExternalString(WTF::StringImpl*) = 0;
+protected:
+    virtual ~ExternalStringVisitor() { }
+};
+
+
+class ExternalArrayVisitor {
+public:
+    virtual void visitJSExternalArray(WTF::ArrayBufferView*) = 0;
+protected:
+    virtual ~ExternalArrayVisitor() { }
 };
 
 } // namespace WebCore
 
-#endif // DOMWrapperVisitor_h
+#endif // BindingVisitors_h
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 054f28a5c..aa9ada2a8 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -35,6 +35,7 @@
 #include "InjectedScript.h"
 
 #include "InjectedScriptHost.h"
+#include "InjectedScriptModule.h"
 #include "InspectorValues.h"
 #include "Node.h"
 #include "PlatformString.h"
@@ -50,11 +51,12 @@ using WebCore::TypeBuilder::Runtime::RemoteObject;
 namespace WebCore {
 
 InjectedScript::InjectedScript()
+    : InjectedScriptBase("InjectedScript")
 {
 }
 
 InjectedScript::InjectedScript(ScriptObject injectedScriptObject, InspectedStateAccessCheck accessCheck)
-    : InjectedScriptBase(injectedScriptObject, accessCheck)
+    : InjectedScriptBase("InjectedScript", injectedScriptObject, accessCheck)
 {
 }
 
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 34df82c0a..dbb1a22bd 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -42,6 +42,7 @@
 
 namespace WebCore {
 
+class InjectedScriptModule;
 class Node;
 class SerializedScriptValue;
 
@@ -94,6 +95,7 @@ public:
     void releaseObjectGroup(const String&);
 
 private:
+    friend class InjectedScriptModule;
     friend InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState*);
     InjectedScript(ScriptObject, InspectedStateAccessCheck);
 
diff --git a/Source/WebCore/inspector/InjectedScriptBase.cpp b/Source/WebCore/inspector/InjectedScriptBase.cpp
index ce878ab17..fe0b42812 100644
--- a/Source/WebCore/inspector/InjectedScriptBase.cpp
+++ b/Source/WebCore/inspector/InjectedScriptBase.cpp
@@ -43,17 +43,25 @@ using WebCore::TypeBuilder::Runtime::RemoteObject;
 
 namespace WebCore {
 
-InjectedScriptBase::InjectedScriptBase()
-    : m_inspectedStateAccessCheck(0)
+InjectedScriptBase::InjectedScriptBase(const String& name)
+    : m_name(name)
+    , m_inspectedStateAccessCheck(0)
 {
 }
 
-InjectedScriptBase::InjectedScriptBase(ScriptObject injectedScriptObject, InspectedStateAccessCheck accessCheck)
-    : m_injectedScriptObject(injectedScriptObject)
+InjectedScriptBase::InjectedScriptBase(const String& name, ScriptObject injectedScriptObject, InspectedStateAccessCheck accessCheck)
+    : m_name(name)
+    , m_injectedScriptObject(injectedScriptObject)
     , m_inspectedStateAccessCheck(accessCheck)
 {
 }
 
+void InjectedScriptBase::initialize(ScriptObject injectedScriptObject, InspectedStateAccessCheck accessCheck)
+{
+    m_injectedScriptObject = injectedScriptObject;
+    m_inspectedStateAccessCheck = accessCheck;
+}
+
 bool InjectedScriptBase::canAccessInspectedWindow() const
 {
     return m_inspectedStateAccessCheck(m_injectedScriptObject.scriptState());
@@ -67,7 +75,7 @@ const ScriptObject& InjectedScriptBase::injectedScriptObject() const
 ScriptValue InjectedScriptBase::callFunctionWithEvalEnabled(ScriptFunctionCall& function, bool& hadException) const
 {
     ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextFromScriptState(m_injectedScriptObject.scriptState());
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willCallFunction(scriptExecutionContext, "InjectedScript", 1);
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willCallFunction(scriptExecutionContext, name(), 1);
 
     ScriptState* scriptState = m_injectedScriptObject.scriptState();
     bool evalIsDisabled = false;
diff --git a/Source/WebCore/inspector/InjectedScriptBase.h b/Source/WebCore/inspector/InjectedScriptBase.h
index 38d545ef9..0407f897e 100644
--- a/Source/WebCore/inspector/InjectedScriptBase.h
+++ b/Source/WebCore/inspector/InjectedScriptBase.h
@@ -49,14 +49,16 @@ class InjectedScriptBase {
 public:
     virtual ~InjectedScriptBase() { }
 
+    const String& name() const { return m_name; }
     bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
 
 protected:
     typedef bool (*InspectedStateAccessCheck)(ScriptState*);
-    InjectedScriptBase();
-    InjectedScriptBase(ScriptObject, InspectedStateAccessCheck);
+    InjectedScriptBase(const String& name);
+    InjectedScriptBase(const String& name, ScriptObject, InspectedStateAccessCheck);
 
+    void initialize(ScriptObject, InspectedStateAccessCheck);
     bool canAccessInspectedWindow() const;
     const ScriptObject& injectedScriptObject() const;
     ScriptValue callFunctionWithEvalEnabled(ScriptFunctionCall&, bool& hadException) const;
@@ -64,6 +66,7 @@ protected:
     void makeEvalCall(ErrorString*, ScriptFunctionCall&, RefPtr<TypeBuilder::Runtime::RemoteObject>* result, TypeBuilder::OptOutput<bool>* wasThrown);
 
 private:
+    String m_name;
     ScriptObject m_injectedScriptObject;
     InspectedStateAccessCheck m_inspectedStateAccessCheck;
 };
diff --git a/Source/WebCore/inspector/InjectedScriptManager.cpp b/Source/WebCore/inspector/InjectedScriptManager.cpp
index e8c64fb8d..52ec7490a 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.cpp
+++ b/Source/WebCore/inspector/InjectedScriptManager.cpp
@@ -37,9 +37,6 @@
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
 #include "InjectedScriptSource.h"
-#if ENABLE(WEBGL)
-#include "InjectedWebGLScriptSource.h"
-#endif
 #include "InspectorValues.h"
 #include "ScriptObject.h"
 #include <wtf/PassOwnPtr.h>
@@ -190,19 +187,6 @@ InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* inspectedSc
     return result;
 }
 
-#if ENABLE(WEBGL)
-ScriptObject InjectedScriptManager::wrapWebGLRenderingContextForInstrumentation(const ScriptObject&)
-{
-    // FIXME(88973): Inject via this.injectScript()
-    return ScriptObject();
-}
-
-String InjectedScriptManager::injectedWebGLScriptSource()
-{
-    return String(reinterpret_cast<const char*>(InjectedWebGLScriptSource_js), sizeof(InjectedWebGLScriptSource_js));
-}
-#endif
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InjectedScriptManager.h b/Source/WebCore/inspector/InjectedScriptManager.h
index acb966655..43590d129 100644
--- a/Source/WebCore/inspector/InjectedScriptManager.h
+++ b/Source/WebCore/inspector/InjectedScriptManager.h
@@ -64,21 +64,15 @@ public:
     void discardInjectedScriptsFor(DOMWindow*);
     void releaseObjectGroup(const String& objectGroup);
 
-#if ENABLE(WEBGL)
-    ScriptObject wrapWebGLRenderingContextForInstrumentation(const ScriptObject&);
-#endif
+    typedef bool (*InspectedStateAccessCheck)(ScriptState*);
+    InspectedStateAccessCheck inspectedStateAccessCheck() const { return m_inspectedStateAccessCheck; }
 
 private:
-    typedef bool (*InspectedStateAccessCheck)(ScriptState*);
     explicit InjectedScriptManager(InspectedStateAccessCheck);
 
     String injectedScriptSource();
     ScriptObject createInjectedScript(const String& source, ScriptState*, int id);
 
-#if ENABLE(WEBGL)
-    String injectedWebGLScriptSource();
-#endif
-
     static bool canAccessInspectedWindow(ScriptState*);
     static bool canAccessInspectedWorkerContext(ScriptState*);
 
diff --git a/Source/WebCore/inspector/InjectedScriptModule.cpp b/Source/WebCore/inspector/InjectedScriptModule.cpp
new file mode 100644
index 000000000..14d29a2ab
--- /dev/null
+++ b/Source/WebCore/inspector/InjectedScriptModule.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InjectedScriptModule.h"
+
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+InjectedScriptModule::InjectedScriptModule(const String& name)
+    : InjectedScriptBase(name)
+{
+}
+
+void InjectedScriptModule::ensureInjected(InjectedScriptManager* injectedScriptManager, ScriptState* scriptState)
+{
+    InjectedScript injectedScript = injectedScriptManager->injectedScriptFor(scriptState);
+    ASSERT(!injectedScript.hasNoValue());
+    if (injectedScript.hasNoValue())
+        return;
+
+    // FIXME: Make the InjectedScript a module itself.
+    ScriptFunctionCall function(injectedScript.injectedScriptObject(), "module");
+    function.appendArgument(name());
+    bool hadException = false;
+    ScriptValue resultValue = injectedScript.callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
+    if (hadException || resultValue.hasNoValue() || !resultValue.isObject()) {
+        ScriptFunctionCall function(injectedScript.injectedScriptObject(), "injectModule");
+        function.appendArgument(name());
+        function.appendArgument(source());
+        resultValue = injectedScript.callFunctionWithEvalEnabled(function, hadException);
+        if (hadException || resultValue.hasNoValue() || !resultValue.isObject()) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+
+    ScriptObject moduleObject(scriptState, resultValue);
+    initialize(moduleObject, injectedScriptManager->inspectedStateAccessCheck());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/v8/custom/V8TextTrackListCustom.cpp b/Source/WebCore/inspector/InjectedScriptModule.h
index 7f7f10ff6..fbfbaa01d 100644
--- a/Source/WebCore/bindings/v8/custom/V8TextTrackListCustom.cpp
+++ b/Source/WebCore/inspector/InjectedScriptModule.h
@@ -28,30 +28,33 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "V8TextTrackList.h"
+#ifndef InjectedScriptModule_h
+#define InjectedScriptModule_h
 
-#include "TextTrackList.h"
-#include "V8Binding.h"
-#include "V8DOMWrapper.h"
-#include "V8HTMLMediaElement.h"
+#include "InjectedScriptBase.h"
+#include "PlatformString.h"
+#include "ScriptState.h"
 
 namespace WebCore {
 
-v8::Handle<v8::Value> toV8(TextTrackList* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8TextTrackList::wrap(impl, isolate);
-
-    // Add a hidden reference from the media element to the text track list.
-    Node* element = impl->owner();
-    if (!wrapper.IsEmpty() && element) {
-        v8::Handle<v8::Value> elementValue = toV8(element, isolate);
-        if (!elementValue.IsEmpty() && elementValue->IsObject())
-            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::textTracks(), wrapper);
-    }
-    return wrapper;
-}
+class InjectedScriptManager;
+
+#if ENABLE(INSPECTOR)
+
+class InjectedScriptModule : public InjectedScriptBase {
+public:
+    virtual String source() const = 0;
+
+protected:
+    // Do not expose constructor in the child classes as well. Instead provide
+    // a static factory method that would create a new instance of the class
+    // and call its ensureInjected() method immediately.
+    InjectedScriptModule(const String& name);
+    void ensureInjected(InjectedScriptManager*, ScriptState*);
+};
+
+#endif
 
 } // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index ae4c978cf..79e6562ae 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -40,6 +40,7 @@ var InjectedScript = function()
     this._idToWrappedObject = {};
     this._idToObjectGroupName = {};
     this._objectGroups = {};
+    this._modules = {};
 }
 
 InjectedScript.primitiveTypes = {
@@ -411,6 +412,19 @@ InjectedScript.prototype = {
         return object;
     },
 
+    module: function(name)
+    {
+        return this._modules[name];
+    },
+ 
+    injectModule: function(name, source)
+    {
+        delete this._modules[name];
+        var module = eval("(" + source + ")");
+        this._modules[name] = module;
+        return module;
+    },
+
     _isDefined: function(object)
     {
         return object || this._isHTMLAllCollection(object);
diff --git a/Source/WebCore/inspector/InjectedScriptWebGLModule.cpp b/Source/WebCore/inspector/InjectedScriptWebGLModule.cpp
new file mode 100644
index 000000000..73790dd2f
--- /dev/null
+++ b/Source/WebCore/inspector/InjectedScriptWebGLModule.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INSPECTOR) && ENABLE(WEBGL)
+
+#include "InjectedScriptWebGLModule.h"
+
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "InjectedScriptWebGLModuleSource.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+InjectedScriptWebGLModule::InjectedScriptWebGLModule()
+    : InjectedScriptModule("InjectedScriptWebGLModule")
+{
+}
+
+InjectedScriptWebGLModule InjectedScriptWebGLModule::moduleForState(InjectedScriptManager* injectedScriptManager, ScriptState* scriptState)
+{
+    InjectedScriptWebGLModule result;
+    result.ensureInjected(injectedScriptManager, scriptState);
+    return result;
+}
+
+String InjectedScriptWebGLModule::source() const
+{
+    return String(reinterpret_cast<const char*>(InjectedScriptWebGLModuleSource_js), sizeof(InjectedScriptWebGLModuleSource_js));
+}
+
+ScriptObject InjectedScriptWebGLModule::wrapWebGLContext(const ScriptObject& glContext)
+{
+    ScriptFunctionCall function(injectedScriptObject(), "wrapWebGLContext");
+    function.appendArgument(glContext);
+    bool hadException = false;
+    ScriptValue resultValue = callFunctionWithEvalEnabled(function, hadException);
+    if (hadException || resultValue.hasNoValue() || !resultValue.isObject()) {
+        ASSERT_NOT_REACHED();
+        return ScriptObject();
+    }
+    return ScriptObject(glContext.scriptState(), resultValue);
+}
+
+void InjectedScriptWebGLModule::captureFrame(ErrorString* errorString, const String& contextId)
+{
+    ScriptFunctionCall function(injectedScriptObject(), "captureFrame");
+    function.appendArgument(contextId);
+    bool hadException = false;
+    callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
+    if (hadException)
+        *errorString = "Internal error";
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR) && ENABLE(WEBGL)
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp b/Source/WebCore/inspector/InjectedScriptWebGLModule.h
index 6dd8ecfcf..50c9e5266 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
+++ b/Source/WebCore/inspector/InjectedScriptWebGLModule.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,29 +28,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "V8DOMTokenList.h"
+#ifndef InjectedScriptWebGLModule_h
+#define InjectedScriptWebGLModule_h
 
-#include "DOMTokenList.h"
-#include "V8Binding.h"
-#include "V8DOMWrapper.h"
-#include "V8Element.h"
+#include "InjectedScriptModule.h"
+#include "PlatformString.h"
+#include "ScriptState.h"
 
 namespace WebCore {
 
-v8::Handle<v8::Value> toV8(DOMTokenList* impl, v8::Isolate* isolate)
-{
-    if (!impl)
-        return v8NullWithCheck(isolate);
-    v8::Handle<v8::Object> wrapper = V8DOMTokenList::wrap(impl, isolate);
-    // Add a hidden reference from the element to the DOMTokenList.
-    Element* element = impl->element();
-    if (!wrapper.IsEmpty() && element) {
-        v8::Handle<v8::Value> elementValue = toV8(element, isolate);
-        if (!elementValue.IsEmpty() && elementValue->IsObject())
-            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domTokenList(), wrapper);
-    }
-    return wrapper;
-}
+class InjectedScriptManager;
+class ScriptObject;
+
+#if ENABLE(INSPECTOR) && ENABLE(WEBGL)
+
+class InjectedScriptWebGLModule : public InjectedScriptModule {
+public:
+    virtual String source() const;
+
+    static InjectedScriptWebGLModule moduleForState(InjectedScriptManager*, ScriptState*);
+
+    ScriptObject wrapWebGLContext(const ScriptObject& glContext);
+    void captureFrame(ErrorString*, const String& contextId);
+
+private:
+    InjectedScriptWebGLModule();
+};
+
+#endif
 
 } // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/inspector/InjectedWebGLScriptSource.js b/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js
index 4484b698c..4484b698c 100644
--- a/Source/WebCore/inspector/InjectedWebGLScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 7a780c86a..880633e1d 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -92,7 +92,7 @@
                 "id": "MemoryBlock",
                 "type": "object",
                 "properties": [
-                    { "name": "size", "type": "integer", "optional": true, "description": "Size of the block in bytes if available" },
+                    { "name": "size", "type": "number", "optional": true, "description": "Size of the block in bytes if available" },
                     { "name": "name", "type": "string", "description": "Unique name used to identify the component that allocated this block" },
                     { "name": "children", "type": "array", "optional": true, "items": { "$ref": "MemoryBlock" }}
                 ]
@@ -471,7 +471,7 @@
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation.", "hidden": true },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
-                    { "name": "contextId", "type": "integer", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
+                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
                     { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." }
                 ],
                 "returns": [
@@ -617,7 +617,7 @@
                 "name": "addInspectedHeapObject",
                 "parameters": [
                     { "name": "heapObjectId", "type": "integer" }
-		]
+                ]
             }
         ],
         "events": [
@@ -1405,6 +1405,11 @@
         "hidden": true,
         "types": [
             {
+                "id": "RequestId",
+                "type": "integer",
+                "description": "Request Identifier to glue a request and its completion event."
+            },
+            {
                 "id": "Entry",
                 "type": "object",
                 "properties": [
@@ -1427,41 +1432,45 @@
                 "description": "Disables events from backend."
             },
             {
-                "name": "getFileSystemRoot",
+                "name": "requestFileSystemRoot",
                 "parameters": [
-                    { "name": "requestId", "type": "integer", "description": "Request Identifier of the command. The backend should pass back this value on corresponding gotFileSystemRoot event." },
                     { "name": "origin", "type": "string", "description": "Security origin of requesting FileSystem. One of frames in current page needs to have this security origin." },
                     { "name": "type", "type": "string", "enum": ["temporary", "persistent"], "description": "FileSystem type of requesting FileSystem." }
                 ],
-                "description": "Returns root directory of the FileSystem if exists."
+                "returns": [
+                    { "name": "requestId", "$ref": "RequestId", "description": "Request identifier. Corresponding fileSystemRootReceived event should have same requestId with this." }
+                ],
+                "description": "Returns root directory of the FileSystem as fileSystemRootReceived event, if exists."
             },
             {
-                "name": "readDirectory",
+                "name": "requestDirectoryContent",
                 "parameters": [
-                    { "name": "requestId", "type": "integer", "description": "Request Identifier of the command. The backend should pass back this value on corresponding didReadDirectory event." },
                     { "name": "url", "type": "string", "description": "URL of the directory that the frontend is requesting to read from." }
                 ],
-                "description": "Requests to read the directory content. Result should return on didReadDirectory event with request id."
+                "returns": [
+                    { "name": "requestId", "$ref": "RequestId", "description": "Request identifier. Corresponding directoryContentReceived event should have same requestId with this." }
+                ],
+                "description": "Returns content of the directory as directoryContentReceived event."
             }
         ],
         "events": [
             {
-                "name": "gotFileSystemRoot",
+                "name": "fileSystemRootReceived",
                 "parameters": [
-                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was passed to corresponding getFileSystemRoot command." },
+                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was returned by corresponding requestFileSystemRoot command." },
                     { "name": "errorCode", "type": "integer", "description": "0, if no error. Otherwise, errorCode is set to FileError::ErrorCode value." },
                     { "name": "root", "$ref": "FileSystem.Entry", "optional": true, "description": "Contains root of the requested FileSystem if the command completed successfully." }
                 ],
-                "description": "Completion event of getFileSystemRoot command."
+                "description": "Completion event of requestFileSystemRoot command."
             },
             {
-                "name": "didReadDirectory",
+                "name": "directoryContentReceived",
                 "parameters": [
-                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was passed to corresponding readDirectory request." },
+                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was returned by corresponding requestDirectoryContent command." },
                     { "name": "errorCode", "type": "integer", "description": "0, if no error. Otherwise, errorCode is set to FileError::ErrorCode value." },
                     { "name": "entries", "type": "array", "items": { "$ref": "FileSystem.Entry" }, "optional": true, "description": "Contains all entries on directory if the command completed successfully." }
                 ],
-                "description": "Completion event of readDirectory command."
+                "description": "Completion event of requestDirectoryContent command."
             }
         ]
     },
@@ -2368,6 +2377,14 @@
                 "description": "Tells whether enabling debugger causes scripts recompilation."
             },
             {
+                "name": "supportsSeparateScriptCompilationAndExecution",
+                "returns": [
+                    { "name": "result", "type": "boolean", "description": "True if debugger supports separate script compilation and execution." }
+                ],
+                "hidden": true,
+                "description": "Tells whether debugger supports separate script compilation and execution."
+            },
+            {
                 "name": "enable",
                 "description": "Enables debugger for the given page. Clients should not assume that the debugging has been enabled until the result for this command is received."
             },
@@ -2531,6 +2548,34 @@
                     { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." }
                 ],
                 "description": "Evaluates expression on a given call frame."
+            },
+            {
+                "name": "compileScript",
+                "hidden": true,
+                "parameters": [
+                    { "name": "expression", "type": "string", "description": "Expression to compile." },
+                    { "name": "sourceURL", "type": "string", "description": "Source url to be set for the script." }
+                ],
+                "returns": [
+                    { "name": "scriptId", "$ref": "ScriptId", "optional": true, "description": "Id of the script." },
+                    { "name": "syntaxErrorMessage", "type": "string", "optional": true, "description": "Syntax error message if compilation failed." }
+                ],
+                "description": "Compiles expression."
+            },
+            {
+                "name": "runScript",
+                "hidden": true,
+                "parameters": [
+                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform script run. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page." },
+                    { "name": "scriptId", "$ref": "ScriptId", "description": "Id of the script to run." },
+                    { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
+                    { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether script run should stop on exceptions and mute console. Overrides setPauseOnException state." }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Run result." },
+                    { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the script run." }
+                ],
+                "description": "Runs script with given id in a given context."
             }
         ],
         "events": [
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 9dac2fea4..095e1cc51 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -121,7 +121,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     m_resourceAgent = resourceAgentPtr.get();
     m_agents.append(resourceAgentPtr.release());
 
-    OwnPtr<InspectorRuntimeAgent> runtimeAgentPtr(PageRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), page, pageAgent));
+    OwnPtr<InspectorRuntimeAgent> runtimeAgentPtr(PageRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), page, pageAgent, m_inspectorAgent));
     InspectorRuntimeAgent* runtimeAgent = runtimeAgentPtr.get();
     m_agents.append(runtimeAgentPtr.release());
 
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 54ea53d55..a1ff91c6d 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -47,6 +47,7 @@
 
 using WebCore::TypeBuilder::Array;
 using WebCore::TypeBuilder::Debugger::FunctionDetails;
+using WebCore::TypeBuilder::Debugger::ScriptId;
 using WebCore::TypeBuilder::Runtime::RemoteObject;
 
 namespace WebCore {
@@ -97,6 +98,7 @@ void InspectorDebuggerAgent::disable()
 
     stopListeningScriptDebugServer();
     scriptDebugServer().clearBreakpoints();
+    scriptDebugServer().clearCompiledScripts();
     clear();
 
     if (m_listener)
@@ -118,6 +120,11 @@ void InspectorDebuggerAgent::canSetScriptSource(ErrorString*, bool* result)
     *result = scriptDebugServer().canSetScriptSource();
 }
 
+void InspectorDebuggerAgent::supportsSeparateScriptCompilationAndExecution(ErrorString*, bool* result)
+{
+    *result = scriptDebugServer().supportsSeparateScriptCompilationAndExecution();
+}
+
 void InspectorDebuggerAgent::enable(ErrorString*)
 {
     if (enabled())
@@ -509,6 +516,60 @@ void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const
     }
 }
 
+void InspectorDebuggerAgent::compileScript(ErrorString* errorString, const String& expression, const String& sourceURL, TypeBuilder::OptOutput<ScriptId>* scriptId, TypeBuilder::OptOutput<String>* syntaxErrorMessage)
+{
+    InjectedScript injectedScript = injectedScriptForEval(errorString, 0);
+    if (injectedScript.hasNoValue()) {
+        *errorString = "Inspected frame has gone";
+        return;
+    }
+
+    String scriptIdValue;
+    String exceptionMessage;
+    scriptDebugServer().compileScript(injectedScript.scriptState(), expression, sourceURL, &scriptIdValue, &exceptionMessage);
+    if (!scriptIdValue && !exceptionMessage) {
+        *errorString = "Script compilation failed";
+        return;
+    }
+    *syntaxErrorMessage = exceptionMessage;
+    *scriptId = scriptIdValue;
+}
+
+void InspectorDebuggerAgent::runScript(ErrorString* errorString, const int* executionContextId, const ScriptId& scriptId, const String* const objectGroup, const bool* const doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+{
+    InjectedScript injectedScript = injectedScriptForEval(errorString, executionContextId);
+    if (injectedScript.hasNoValue()) {
+        *errorString = "Inspected frame has gone";
+        return;
+    }
+
+    ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = scriptDebugServer().pauseOnExceptionsState();
+    if (doNotPauseOnExceptionsAndMuteConsole && *doNotPauseOnExceptionsAndMuteConsole) {
+        if (previousPauseOnExceptionsState != ScriptDebugServer::DontPauseOnExceptions)
+            scriptDebugServer().setPauseOnExceptionsState(ScriptDebugServer::DontPauseOnExceptions);
+        muteConsole();
+    }
+
+    ScriptValue value;
+    bool wasThrownValue;
+    String exceptionMessage;
+    scriptDebugServer().runScript(injectedScript.scriptState(), scriptId, &value, &wasThrownValue, &exceptionMessage);
+    *wasThrown = wasThrownValue;
+    if (value.hasNoValue()) {
+        *errorString = "Script execution failed";
+        return;
+    }
+    result = injectedScript.wrapObject(value, objectGroup ? *objectGroup : "");
+    if (wasThrownValue)
+        result->setDescription(exceptionMessage);
+
+    if (doNotPauseOnExceptionsAndMuteConsole && *doNotPauseOnExceptionsAndMuteConsole) {
+        unmuteConsole();
+        if (scriptDebugServer().pauseOnExceptionsState() != previousPauseOnExceptionsState)
+            scriptDebugServer().setPauseOnExceptionsState(previousPauseOnExceptionsState);
+    }
+}
+
 PassRefPtr<Array<TypeBuilder::Debugger::CallFrame> > InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index ddb10f8c4..a97d04a13 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -67,6 +67,7 @@ public:
 
     virtual void causesRecompilation(ErrorString*, bool*);
     virtual void canSetScriptSource(ErrorString*, bool*);
+    virtual void supportsSeparateScriptCompilationAndExecution(ErrorString*, bool*);
 
     virtual void enable(ErrorString*);
     virtual void disable(ErrorString*);
@@ -109,6 +110,8 @@ public:
                              const bool* returnByValue,
                              RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                              TypeBuilder::OptOutput<bool>* wasThrown);
+    void compileScript(ErrorString*, const String& expression, const String& sourceURL, TypeBuilder::OptOutput<TypeBuilder::Debugger::ScriptId>*, TypeBuilder::OptOutput<String>* syntaxErrorMessage);
+    void runScript(ErrorString*, const int* executionContextId, const TypeBuilder::Debugger::ScriptId&, const String* objectGroup, const bool* doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown);
 
     class Listener {
     public:
@@ -127,6 +130,8 @@ protected:
     virtual void stopListeningScriptDebugServer() = 0;
     virtual void muteConsole() = 0;
     virtual void unmuteConsole() = 0;
+    InjectedScriptManager* injectedScriptManager() { return m_injectedScriptManager; }
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId) = 0;
 
 private:
     void enable();
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp b/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
index 85e4105a3..72a2788c6 100644
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
+++ b/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
@@ -96,6 +96,40 @@ typedef InspectorFileSystemAgent::FrontendProvider FrontendProvider;
 
 namespace {
 
+template<typename BaseCallback, typename Handler, typename Argument>
+class CallbackDispatcher : public BaseCallback {
+public:
+    typedef bool (Handler::*HandlingMethod)(Argument*);
+
+    static PassRefPtr<CallbackDispatcher> create(PassRefPtr<Handler> handler, HandlingMethod handlingMethod)
+    {
+        return adoptRef(new CallbackDispatcher(handler, handlingMethod));
+    }
+
+    virtual bool handleEvent(Argument* argument) OVERRIDE
+    {
+        return (m_handler.get()->*m_handlingMethod)(argument);
+    }
+
+private:
+    CallbackDispatcher(PassRefPtr<Handler> handler, HandlingMethod handlingMethod)
+        : m_handler(handler)
+        , m_handlingMethod(handlingMethod) { }
+
+    RefPtr<Handler> m_handler;
+    HandlingMethod m_handlingMethod;
+};
+
+template<typename BaseCallback>
+class CallbackDispatcherFactory {
+public:
+    template<typename Handler, typename Argument>
+    static PassRefPtr<CallbackDispatcher<BaseCallback, Handler, Argument> > create(Handler* handler, bool (Handler::*handlingMethod)(Argument*))
+    {
+        return CallbackDispatcher<BaseCallback, Handler, Argument>::create(PassRefPtr<Handler>(handler), handlingMethod);
+    }
+};
+
 class GetFileSystemRootTask : public RefCounted<GetFileSystemRootTask> {
     WTF_MAKE_NONCOPYABLE(GetFileSystemRootTask);
 public:
@@ -107,16 +141,14 @@ public:
     void start(ScriptExecutionContext*);
 
 private:
-    class ErrorCallback;
-    class GetEntryCallback;
-
-    void gotEntry(Entry*);
+    bool didHitError(FileError*);
+    bool gotEntry(Entry*);
 
     void reportResult(FileError::ErrorCode errorCode, PassRefPtr<TypeBuilder::FileSystem::Entry> entry)
     {
         if (!m_frontendProvider || !m_frontendProvider->frontend())
             return;
-        m_frontendProvider->frontend()->gotFileSystemRoot(m_requestId, static_cast<int>(errorCode), entry);
+        m_frontendProvider->frontend()->fileSystemRootReceived(m_requestId, static_cast<int>(errorCode), entry);
         m_frontendProvider = 0;
     }
 
@@ -130,45 +162,11 @@ private:
     String m_type;
 };
 
-class GetFileSystemRootTask::ErrorCallback : public WebCore::ErrorCallback {
-    WTF_MAKE_NONCOPYABLE(ErrorCallback);
-public:
-    static PassRefPtr<GetFileSystemRootTask::ErrorCallback> create(PassRefPtr<GetFileSystemRootTask> getFileSystemRootTask)
-    {
-        return adoptRef(new GetFileSystemRootTask::ErrorCallback(getFileSystemRootTask));
-    }
-
-    virtual bool handleEvent(FileError* error) OVERRIDE
-    {
-        m_getFileSystemRootTask->reportResult(error->code(), 0);
-        return true;
-    }
-
-private:
-    ErrorCallback(PassRefPtr<GetFileSystemRootTask> getFileSystemRootTask)
-        : m_getFileSystemRootTask(getFileSystemRootTask) { }
-    RefPtr<GetFileSystemRootTask> m_getFileSystemRootTask;
-};
-
-class GetFileSystemRootTask::GetEntryCallback : public WebCore::EntryCallback {
-    WTF_MAKE_NONCOPYABLE(GetEntryCallback);
-public:
-    static PassRefPtr<GetFileSystemRootTask::GetEntryCallback> create(PassRefPtr<GetFileSystemRootTask> getFileSystemRootTask)
-    {
-        return adoptRef(new GetFileSystemRootTask::GetEntryCallback(getFileSystemRootTask));
-    }
-
-    virtual bool handleEvent(Entry* entry) OVERRIDE
-    {
-        m_getFileSystemRootTask->gotEntry(entry);
-        return true;
-    }
-
-private:
-    GetEntryCallback(PassRefPtr<GetFileSystemRootTask> getFileSystemRootTask)
-        : m_getFileSystemRootTask(getFileSystemRootTask) { }
-    RefPtr<GetFileSystemRootTask> m_getFileSystemRootTask;
-};
+bool GetFileSystemRootTask::didHitError(FileError* error)
+{
+    reportResult(error->code(), 0);
+    return true;
+}
 
 void GetFileSystemRootTask::start(ScriptExecutionContext* scriptExecutionContext)
 {
@@ -182,17 +180,18 @@ void GetFileSystemRootTask::start(ScriptExecutionContext* scriptExecutionContext
         return;
     }
 
-    RefPtr<EntryCallback> successCallback = GetFileSystemRootTask::GetEntryCallback::create(this);
-    RefPtr<ErrorCallback> errorCallback = GetFileSystemRootTask::ErrorCallback::create(this);
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &GetFileSystemRootTask::gotEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &GetFileSystemRootTask::didHitError);
     OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, "/");
 
     LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
 }
 
-void GetFileSystemRootTask::gotEntry(Entry* entry)
+bool GetFileSystemRootTask::gotEntry(Entry* entry)
 {
     RefPtr<TypeBuilder::FileSystem::Entry> result(TypeBuilder::FileSystem::Entry::create().setUrl(entry->toURL()).setName("/").setIsDirectory(true));
     reportResult(static_cast<FileError::ErrorCode>(0), result);
+    return true;
 }
 
 class ReadDirectoryTask : public RefCounted<ReadDirectoryTask> {
@@ -211,18 +210,20 @@ public:
     void start(ScriptExecutionContext*);
 
 private:
-    class ErrorCallback;
-    class GetEntryCallback;
-    class ReadDirectoryEntriesCallback;
+    bool didHitError(FileError* error)
+    {
+        reportResult(error->code(), 0);
+        return true;
+    }
 
-    void gotEntry(Entry*);
-    void didReadDirectoryEntries(EntryArray*);
+    bool gotEntry(Entry*);
+    bool didReadDirectoryEntries(EntryArray*);
 
     void reportResult(FileError::ErrorCode errorCode, PassRefPtr<Array<TypeBuilder::FileSystem::Entry> > entries)
     {
         if (!m_frontendProvider || !m_frontendProvider->frontend())
             return;
-        m_frontendProvider->frontend()->didReadDirectory(m_requestId, static_cast<int>(errorCode), entries);
+        m_frontendProvider->frontend()->directoryContentReceived(m_requestId, static_cast<int>(errorCode), entries);
         m_frontendProvider = 0;
     }
 
@@ -240,68 +241,6 @@ private:
     RefPtr<DirectoryReader> m_directoryReader;
 };
 
-class ReadDirectoryTask::ErrorCallback : public WebCore::ErrorCallback {
-    WTF_MAKE_NONCOPYABLE(ErrorCallback);
-public:
-    static PassRefPtr<ReadDirectoryTask::ErrorCallback> create(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-    {
-        return adoptRef(new ReadDirectoryTask::ErrorCallback(readDirectoryTask));
-    }
-
-    virtual bool handleEvent(FileError* error) OVERRIDE
-    {
-        if (m_readDirectoryTask)
-            m_readDirectoryTask->reportResult(error->code(), 0);
-        return true;
-    }
-
-private:
-    ErrorCallback(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-        : m_readDirectoryTask(readDirectoryTask) { }
-    RefPtr<ReadDirectoryTask> m_readDirectoryTask;
-};
-
-class ReadDirectoryTask::GetEntryCallback : public EntryCallback {
-    WTF_MAKE_NONCOPYABLE(GetEntryCallback);
-public:
-    static PassRefPtr<ReadDirectoryTask::GetEntryCallback> create(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-    {
-        return adoptRef(new ReadDirectoryTask::GetEntryCallback(readDirectoryTask));
-    }
-
-    virtual bool handleEvent(Entry* fileSystem) OVERRIDE
-    {
-        m_readDirectoryTask->gotEntry(fileSystem);
-        return true;
-    }
-
-private:
-    GetEntryCallback(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-        : m_readDirectoryTask(readDirectoryTask) { }
-    RefPtr<ReadDirectoryTask> m_readDirectoryTask;
-};
-
-class ReadDirectoryTask::ReadDirectoryEntriesCallback : public EntriesCallback {
-    WTF_MAKE_NONCOPYABLE(ReadDirectoryEntriesCallback);
-public:
-    static PassRefPtr<ReadDirectoryTask::ReadDirectoryEntriesCallback> create(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-    {
-        return adoptRef(new ReadDirectoryTask::ReadDirectoryEntriesCallback(readDirectoryTask));
-    }
-
-    virtual bool handleEvent(EntryArray* entries) OVERRIDE
-    {
-        ASSERT(entries);
-        m_readDirectoryTask->didReadDirectoryEntries(entries);
-        return true;
-    }
-
-private:
-    ReadDirectoryEntriesCallback(PassRefPtr<ReadDirectoryTask> readDirectoryTask)
-        : m_readDirectoryTask(readDirectoryTask) { }
-    RefPtr<ReadDirectoryTask> m_readDirectoryTask;
-};
-
 void ReadDirectoryTask::start(ScriptExecutionContext* scriptExecutionContext)
 {
     ASSERT(scriptExecutionContext);
@@ -313,23 +252,24 @@ void ReadDirectoryTask::start(ScriptExecutionContext* scriptExecutionContext)
         return;
     }
 
-    RefPtr<EntryCallback> successCallback = ReadDirectoryTask::GetEntryCallback::create(this);
-    RefPtr<ErrorCallback> errorCallback = ReadDirectoryTask::ErrorCallback::create(this);
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &ReadDirectoryTask::gotEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &ReadDirectoryTask::didHitError);
     OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, path);
 
     LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
 }
 
-void ReadDirectoryTask::gotEntry(Entry* entry)
+bool ReadDirectoryTask::gotEntry(Entry* entry)
 {
     if (!entry->isDirectory()) {
         reportResult(FileError::TYPE_MISMATCH_ERR, 0);
-        return;
+        return true;
     }
 
     m_directoryReader = static_cast<DirectoryEntry*>(entry)->createReader();
     m_entries = Array<TypeBuilder::FileSystem::Entry>::create();
     readDirectoryEntries();
+    return true;
 }
 
 void ReadDirectoryTask::readDirectoryEntries()
@@ -339,16 +279,16 @@ void ReadDirectoryTask::readDirectoryEntries()
         return;
     }
 
-    RefPtr<EntriesCallback> successCallback = ReadDirectoryTask::ReadDirectoryEntriesCallback::create(this);
-    RefPtr<ErrorCallback> errorCallback = ReadDirectoryTask::ErrorCallback::create(this);
+    RefPtr<EntriesCallback> successCallback = CallbackDispatcherFactory<EntriesCallback>::create(this, &ReadDirectoryTask::didReadDirectoryEntries);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &ReadDirectoryTask::didHitError);
     m_directoryReader->readEntries(successCallback, errorCallback);
 }
 
-void ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
+bool ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
 {
     if (!entries->length()) {
         reportResult(static_cast<FileError::ErrorCode>(0), m_entries);
-        return;
+        return true;
     }
 
     for (unsigned i = 0; i < entries->length(); ++i) {
@@ -375,6 +315,7 @@ void ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
         m_entries->addItem(entryForFrontend);
     }
     readDirectoryEntries();
+    return true;
 }
 
 }
@@ -408,28 +349,31 @@ void InspectorFileSystemAgent::disable(ErrorString*)
     m_state->setBoolean(FileSystemAgentState::fileSystemAgentEnabled, m_enabled);
 }
 
-void InspectorFileSystemAgent::getFileSystemRoot(ErrorString*, int requestId, const String& origin, const String& type)
+void InspectorFileSystemAgent::requestFileSystemRoot(ErrorString* error, const String& origin, const String& type, int* requestId)
 {
     if (!m_enabled || !m_frontendProvider)
         return;
     ASSERT(m_frontendProvider->frontend());
 
+    *requestId = m_nextRequestId++;
     if (ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextForOrigin(SecurityOrigin::createFromString(origin).get()))
-        GetFileSystemRootTask::create(m_frontendProvider, requestId, type)->start(scriptExecutionContext);
+        GetFileSystemRootTask::create(m_frontendProvider, *requestId, type)->start(scriptExecutionContext);
     else
-        m_frontendProvider->frontend()->gotFileSystemRoot(requestId, static_cast<int>(FileError::ABORT_ERR), 0);
+        m_frontendProvider->frontend()->fileSystemRootReceived(*requestId, static_cast<int>(FileError::ABORT_ERR), 0);
 }
 
-void InspectorFileSystemAgent::readDirectory(ErrorString*, int requestId, const String& url)
+void InspectorFileSystemAgent::requestDirectoryContent(ErrorString*, const String& url, int* requestId)
 {
     if (!m_enabled || !m_frontendProvider)
         return;
     ASSERT(m_frontendProvider->frontend());
 
+    *requestId = m_nextRequestId++;
+
     if (ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextForOrigin(SecurityOrigin::createFromString(url).get()))
-        ReadDirectoryTask::create(m_frontendProvider, requestId, url)->start(scriptExecutionContext);
+        ReadDirectoryTask::create(m_frontendProvider, *requestId, url)->start(scriptExecutionContext);
     else
-        m_frontendProvider->frontend()->didReadDirectory(requestId, static_cast<int>(FileError::ABORT_ERR), 0);
+        m_frontendProvider->frontend()->directoryContentReceived(*requestId, static_cast<int>(FileError::ABORT_ERR), 0);
 }
 
 void InspectorFileSystemAgent::setFrontend(InspectorFrontend* frontend)
@@ -457,6 +401,7 @@ InspectorFileSystemAgent::InspectorFileSystemAgent(InstrumentingAgents* instrume
     : InspectorBaseAgent<InspectorFileSystemAgent>("FileSystem", instrumentingAgents, state)
     , m_pageAgent(pageAgent)
     , m_enabled(false)
+    , m_nextRequestId(1)
 {
     ASSERT(instrumentingAgents);
     ASSERT(state);
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.h b/Source/WebCore/inspector/InspectorFileSystemAgent.h
index 7f44ac0e8..59a16e907 100644
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.h
+++ b/Source/WebCore/inspector/InspectorFileSystemAgent.h
@@ -59,8 +59,8 @@ public:
     virtual void enable(ErrorString*) OVERRIDE;
     virtual void disable(ErrorString*) OVERRIDE;
 
-    virtual void getFileSystemRoot(ErrorString*, int requestId, const String& origin, const String& type) OVERRIDE;
-    virtual void readDirectory(ErrorString*, int requestId, const String& url) OVERRIDE;
+    virtual void requestFileSystemRoot(ErrorString*, const String& origin, const String& type, int* requestId) OVERRIDE;
+    virtual void requestDirectoryContent(ErrorString*, const String& url, int* requestId) OVERRIDE;
 
     virtual void setFrontend(InspectorFrontend*) OVERRIDE;
     virtual void clearFrontend() OVERRIDE;
@@ -73,6 +73,7 @@ private:
     InspectorPageAgent* m_pageAgent;
     RefPtr<FrontendProvider> m_frontendProvider;
     bool m_enabled;
+    int m_nextRequestId;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index 83f0f2d7b..d4ede21a7 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -43,11 +43,13 @@
 #include "IDBCallbacks.h"
 #include "IDBCursor.h"
 #include "IDBDatabaseBackendInterface.h"
+#include "IDBDatabaseCallbacks.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBIndexBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBKeyRange.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
 #include "IDBTransaction.h"
@@ -115,6 +117,21 @@ public:
     virtual void onBlocked() { }
 };
 
+class InspectorIDBDatabaseCallbacks : public IDBDatabaseCallbacks {
+public:
+    static PassRefPtr<InspectorIDBDatabaseCallbacks> create()
+    {
+        return adoptRef(new InspectorIDBDatabaseCallbacks());
+    }
+
+    virtual ~InspectorIDBDatabaseCallbacks() { }
+
+    virtual void onVersionChange(const String& version) { }
+private:
+    InspectorIDBDatabaseCallbacks() { }
+};
+
+
 class InspectorIDBTransactionCallback : public IDBTransactionCallbacks {
 public:
     static PassRefPtr<InspectorIDBTransactionCallback> create()
@@ -172,6 +189,28 @@ public:
     virtual void execute(PassRefPtr<IDBDatabaseBackendInterface>) = 0;
 };
 
+class DatabaseConnection {
+public:
+    DatabaseConnection()
+        : m_idbDatabaseCallbacks(InspectorIDBDatabaseCallbacks::create()) { }
+
+    void connect(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    {
+        m_idbDatabase = idbDatabase;
+        m_idbDatabase->registerFrontendCallbacks(m_idbDatabaseCallbacks);
+    }
+
+    ~DatabaseConnection()
+    {
+        if (m_idbDatabase)
+            m_idbDatabase->close(m_idbDatabaseCallbacks);
+    }
+
+private:
+    RefPtr<IDBDatabaseBackendInterface> m_idbDatabase;
+    RefPtr<IDBDatabaseCallbacks> m_idbDatabaseCallbacks;
+};
+
 class OpenDatabaseCallback : public InspectorIDBCallback {
 public:
     static PassRefPtr<OpenDatabaseCallback> create(ExecutableWithDatabase* executableWithDatabase)
@@ -181,8 +220,9 @@ public:
 
     virtual ~OpenDatabaseCallback() { }
 
-    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface> prpDatabase)
     {
+        RefPtr<IDBDatabaseBackendInterface> idbDatabase = prpDatabase;
         m_executableWithDatabase->execute(idbDatabase);
     }
 
@@ -263,47 +303,42 @@ public:
 
     virtual ~DatabaseLoaderCallback() { }
 
-    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> prpDatabase)
     {
+        RefPtr<IDBDatabaseBackendInterface> idbDatabase = prpDatabase;
+        m_connection.connect(idbDatabase);
         if (!m_frontendProvider->frontend())
             return;
 
+        const IDBDatabaseMetadata databaseMetadata = idbDatabase->metadata();
+
         RefPtr<TypeBuilder::Array<TypeBuilder::IndexedDB::ObjectStore> > objectStores = TypeBuilder::Array<TypeBuilder::IndexedDB::ObjectStore>::create();
 
-        RefPtr<DOMStringList> objectStoreNamesList = idbDatabase->objectStoreNames();
-        for (size_t i = 0; i < objectStoreNamesList->length(); ++i) {
-            String objectStoreName = objectStoreNamesList->item(i);
-            RefPtr<IDBTransactionBackendInterface> idbTransaction = transactionForDatabase(idbDatabase.get(), objectStoreName);
-            if (!idbTransaction)
-                continue;
-            RefPtr<IDBObjectStoreBackendInterface> idbObjectStore = objectStoreForTransaction(idbTransaction.get(), objectStoreName);
-            if (!idbObjectStore)
-                continue;
+        for (IDBDatabaseMetadata::ObjectStoreMap::const_iterator it = databaseMetadata.objectStores.begin(); it != databaseMetadata.objectStores.end(); ++it) {
+            const IDBObjectStoreMetadata& objectStoreMetadata = it->second;
 
             RefPtr<TypeBuilder::Array<TypeBuilder::IndexedDB::ObjectStoreIndex> > indexes = TypeBuilder::Array<TypeBuilder::IndexedDB::ObjectStoreIndex>::create();
-            RefPtr<DOMStringList> indexNamesList = idbObjectStore->indexNames();
-            for (size_t j = 0; j < indexNamesList->length(); ++j) {
-                RefPtr<IDBIndexBackendInterface> idbIndex = indexForObjectStore(idbObjectStore.get(), indexNamesList->item(j));
-                if (!idbIndex)
-                    continue;
+
+            for (IDBObjectStoreMetadata::IndexMap::const_iterator it = objectStoreMetadata.indexes.begin(); it != objectStoreMetadata.indexes.end(); ++it) {
+                const IDBIndexMetadata& indexMetadata = it->second;
 
                 RefPtr<ObjectStoreIndex> objectStoreIndex = ObjectStoreIndex::create()
-                    .setName(idbIndex->name())
-                    .setKeyPath(keyPathFromIDBKeyPath(idbIndex->keyPath()))
-                    .setUnique(idbIndex->unique())
-                    .setMultiEntry(idbIndex->multiEntry());
+                    .setName(indexMetadata.name)
+                    .setKeyPath(keyPathFromIDBKeyPath(indexMetadata.keyPath))
+                    .setUnique(indexMetadata.unique)
+                    .setMultiEntry(indexMetadata.multiEntry);
                 indexes->addItem(objectStoreIndex);
             }
-
+            // FIXME: add objectStoreMetadata.autoIncrement property http://webkit.org/b/89701
             RefPtr<ObjectStore> objectStore = ObjectStore::create()
-                .setName(idbObjectStore->name())
-                .setKeyPath(keyPathFromIDBKeyPath(idbObjectStore->keyPath()))
+                .setName(objectStoreMetadata.name)
+                .setKeyPath(keyPathFromIDBKeyPath(objectStoreMetadata.keyPath))
                 .setIndexes(indexes);
             objectStores->addItem(objectStore);
         }
         RefPtr<DatabaseWithObjectStores> result = DatabaseWithObjectStores::create()
-            .setName(idbDatabase->name())
-            .setVersion(idbDatabase->version())
+            .setName(databaseMetadata.name)
+            .setVersion(databaseMetadata.version)
             .setObjectStores(objectStores);
 
         m_frontendProvider->frontend()->databaseLoaded(m_requestId, result);
@@ -315,6 +350,7 @@ private:
         , m_requestId(requestId) { }
     RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
     int m_requestId;
+    DatabaseConnection m_connection;
 };
 
 static PassRefPtr<IDBKey> idbKeyFromInspectorObject(InspectorObject* key)
@@ -430,6 +466,8 @@ static PassRefPtr<Key> keyFromIDBKey(IDBKey* idbKey)
     return key.release();
 }
 
+class DataLoaderCallback;
+
 class OpenCursorCallback : public InspectorIDBCallback {
 public:
     enum CursorType {
@@ -437,9 +475,9 @@ public:
         IndexDataCursor
     };
 
-    static PassRefPtr<OpenCursorCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+    static PassRefPtr<OpenCursorCallback> create(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<DataLoaderCallback> dataLoaderCallback, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
     {
-        return adoptRef(new OpenCursorCallback(frontendProvider, injectedScript, idbTransaction, cursorType, requestId, skipCount, pageSize));
+        return adoptRef(new OpenCursorCallback(frontendProvider, injectedScript, dataLoaderCallback, idbTransaction, cursorType, requestId, skipCount, pageSize));
     }
 
     virtual ~OpenCursorCallback() { }
@@ -491,6 +529,7 @@ public:
 
     void end(bool hasMore)
     {
+        m_dataLoaderCallback.clear();
         if (!m_frontendProvider->frontend())
             return;
 
@@ -509,9 +548,10 @@ public:
     }
 
 private:
-    OpenCursorCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
+    OpenCursorCallback(PassRefPtr<InspectorIndexedDBAgent::FrontendProvider> frontendProvider, InjectedScript injectedScript, PassRefPtr<DataLoaderCallback> dataLoaderCallback, PassRefPtr<IDBTransactionBackendInterface> idbTransaction, CursorType cursorType, int requestId, int skipCount, unsigned pageSize)
         : m_frontendProvider(frontendProvider)
         , m_injectedScript(injectedScript)
+        , m_dataLoaderCallback(dataLoaderCallback)
         , m_idbTransaction(idbTransaction)
         , m_cursorType(cursorType)
         , m_requestId(requestId)
@@ -523,6 +563,7 @@ private:
     }
     RefPtr<InspectorIndexedDBAgent::FrontendProvider> m_frontendProvider;
     InjectedScript m_injectedScript;
+    RefPtr<DataLoaderCallback> m_dataLoaderCallback;
     RefPtr<IDBTransactionBackendInterface> m_idbTransaction;
     CursorType m_cursorType;
     int m_requestId;
@@ -541,8 +582,10 @@ public:
 
     virtual ~DataLoaderCallback() { }
 
-    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> idbDatabase)
+    virtual void execute(PassRefPtr<IDBDatabaseBackendInterface> prpDatabase)
     {
+        RefPtr<IDBDatabaseBackendInterface> idbDatabase = prpDatabase;
+        m_connection.connect(idbDatabase);
         if (!m_frontendProvider->frontend())
             return;
 
@@ -558,12 +601,12 @@ public:
             if (!idbIndex)
                 return;
 
-            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::IndexDataCursor, m_requestId, m_skipCount, m_pageSize);
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, this, idbTransaction.get(), OpenCursorCallback::IndexDataCursor, m_requestId, m_skipCount, m_pageSize);
 
             ExceptionCode ec = 0;
             idbIndex->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
         } else {
-            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, idbTransaction.get(), OpenCursorCallback::ObjectStoreDataCursor, m_requestId, m_skipCount, m_pageSize);
+            RefPtr<OpenCursorCallback> openCursorCallback = OpenCursorCallback::create(m_frontendProvider, m_injectedScript, this, idbTransaction.get(), OpenCursorCallback::ObjectStoreDataCursor, m_requestId, m_skipCount, m_pageSize);
 
             ExceptionCode ec = 0;
             idbObjectStore->openCursor(m_idbKeyRange, IDBCursor::NEXT, openCursorCallback, idbTransaction.get(), ec);
@@ -588,6 +631,7 @@ private:
     RefPtr<IDBKeyRange> m_idbKeyRange;
     int m_skipCount;
     unsigned m_pageSize;
+    DatabaseConnection m_connection;
 };
 
 } // namespace
diff --git a/Source/WebCore/inspector/InspectorMemoryAgent.cpp b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
index 752f72857..b05f622d0 100644
--- a/Source/WebCore/inspector/InspectorMemoryAgent.cpp
+++ b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
@@ -34,8 +34,8 @@
 
 #include "InspectorMemoryAgent.h"
 
+#include "BindingVisitors.h"
 #include "CharacterData.h"
-#include "DOMWrapperVisitor.h"
 #include "Document.h"
 #include "EventListenerMap.h"
 #include "Frame.h"
@@ -44,12 +44,15 @@
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "MemoryCache.h"
+#include "MemoryInstrumentation.h"
 #include "MemoryUsageSupport.h"
 #include "Node.h"
 #include "Page.h"
 #include "ScriptGCEvent.h"
 #include "ScriptProfiler.h"
 #include "StyledElement.h"
+#include <wtf/ArrayBuffer.h>
+#include <wtf/ArrayBufferView.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -66,6 +69,9 @@ namespace WebCore {
 namespace MemoryBlockName {
 static const char jsHeapAllocated[] = "JSHeapAllocated";
 static const char jsHeapUsed[] = "JSHeapUsed";
+static const char jsExternalResources[] = "JSExternalResources";
+static const char jsExternalArrays[] = "JSExternalArrays";
+static const char jsExternalStrings[] = "JSExternalStrings";
 static const char inspectorData[] = "InspectorData";
 static const char memoryCache[] = "MemoryCache";
 static const char processPrivateMemory[] = "ProcessPrivateMemory";
@@ -77,6 +83,11 @@ static const char cachedXslStyleSheets[] = "CachedXslStyleSheets";
 static const char cachedFonts[] = "CachedFonts";
 static const char renderTreeUsed[] = "RenderTreeUsed";
 static const char renderTreeAllocated[] = "RenderTreeAllocated";
+
+static const char dom[] = "DOM";
+static const char domTreeOther[] = "DOMTreeOther";
+static const char domTreeDOM[] = "DOMTreeDOM";
+static const char domTreeCSS[] = "DOMTreeCSS";
 }
 
 namespace {
@@ -88,9 +99,9 @@ String nodeName(Node* node)
     return node->nodeName().lower();
 }
 
-int stringSize(StringImpl* string)
+size_t stringSize(StringImpl* string)
 {
-    int size = string->length();
+    size_t size = string->length();
     if (!string->is8Bit())
         size *= 2;
     return size + sizeof(*string);
@@ -177,10 +188,6 @@ private:
         collectListenersInfo(node);
     }
 
-    void collectCharacterData(Node*)
-    {
-    }
-
     void collectNodeNameInfo(Node* node)
     {
         String name = nodeName(node);
@@ -216,7 +223,7 @@ private:
     CharacterDataStatistics& m_characterDataStatistics;
 };
 
-class CounterVisitor : public DOMWrapperVisitor {
+class CounterVisitor : public NodeWrapperVisitor, public ExternalStringVisitor {
 public:
     CounterVisitor(Page* page)
         : m_page(page)
@@ -306,6 +313,34 @@ private:
     int m_sharedStringSize;
 };
 
+class ExternalResourceVisitor : public ExternalStringVisitor, public ExternalArrayVisitor {
+public:
+    ExternalResourceVisitor()
+        : m_jsExternalStringSize(0)
+        , m_externalArraySize(0)
+    { }
+
+    size_t externalStringSize() const { return m_jsExternalStringSize; }
+    size_t externalArraySize() const { return m_externalArraySize; }
+
+private:
+    virtual void visitJSExternalArray(ArrayBufferView* bufferView)
+    {
+        ArrayBuffer* buffer = bufferView->buffer().get();
+        if (m_arrayBuffers.add(buffer).isNewEntry)
+            m_externalArraySize += buffer->byteLength();
+    }
+    virtual void visitJSExternalString(StringImpl* string)
+    {
+        int size = stringSize(string);
+        m_jsExternalStringSize += size;
+    }
+
+    size_t m_jsExternalStringSize;
+    size_t m_externalArraySize;
+    HashSet<ArrayBuffer*> m_arrayBuffers;
+};
+
 } // namespace
 
 InspectorMemoryAgent::~InspectorMemoryAgent()
@@ -315,7 +350,7 @@ InspectorMemoryAgent::~InspectorMemoryAgent()
 void InspectorMemoryAgent::getDOMNodeCount(ErrorString*, RefPtr<TypeBuilder::Array<TypeBuilder::Memory::DOMGroup> >& domGroups, RefPtr<TypeBuilder::Memory::StringStatistics>& strings)
 {
     CounterVisitor counterVisitor(m_page);
-    ScriptProfiler::visitJSDOMWrappers(&counterVisitor);
+    ScriptProfiler::visitNodeWrappers(&counterVisitor);
 
     // Make sure all documents reachable from the main frame are accounted.
     for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
@@ -323,7 +358,7 @@ void InspectorMemoryAgent::getDOMNodeCount(ErrorString*, RefPtr<TypeBuilder::Arr
             counterVisitor.visitNode(doc);
     }
 
-    ScriptProfiler::visitExternalJSStrings(&counterVisitor);
+    ScriptProfiler::visitExternalStrings(&counterVisitor);
 
     domGroups = counterVisitor.domGroups();
     strings = counterVisitor.strings();
@@ -337,11 +372,11 @@ static PassRefPtr<InspectorMemoryBlock> jsHeapInfo()
     ScriptGCEvent::getHeapSize(usedJSHeapSize, totalJSHeapSize, jsHeapSizeLimit);
 
     RefPtr<InspectorMemoryBlock> jsHeapAllocated = InspectorMemoryBlock::create().setName(MemoryBlockName::jsHeapAllocated);
-    jsHeapAllocated->setSize(static_cast<int>(totalJSHeapSize));
+    jsHeapAllocated->setSize(totalJSHeapSize);
 
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
     RefPtr<InspectorMemoryBlock> jsHeapUsed = InspectorMemoryBlock::create().setName(MemoryBlockName::jsHeapUsed);
-    jsHeapUsed->setSize(static_cast<int>(usedJSHeapSize));
+    jsHeapUsed->setSize(usedJSHeapSize);
     children->addItem(jsHeapUsed);
 
     jsHeapAllocated->setChildren(children);
@@ -352,7 +387,7 @@ static PassRefPtr<InspectorMemoryBlock> inspectorData()
 {
     size_t dataSize = ScriptProfiler::profilerSnapshotsSize();
     RefPtr<InspectorMemoryBlock> inspectorData = InspectorMemoryBlock::create().setName(MemoryBlockName::inspectorData);
-    inspectorData->setSize(static_cast<int>(dataSize));
+    inspectorData->setSize(dataSize);
     return inspectorData.release();
 }
 
@@ -361,24 +396,102 @@ static PassRefPtr<InspectorMemoryBlock> renderTreeInfo(Page* page)
     ArenaSize arenaSize = page->renderTreeSize();
 
     RefPtr<InspectorMemoryBlock> renderTreeAllocated = InspectorMemoryBlock::create().setName(MemoryBlockName::renderTreeAllocated);
-    renderTreeAllocated->setSize(static_cast<int>(arenaSize.allocated));
+    renderTreeAllocated->setSize(arenaSize.allocated);
 
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
     RefPtr<InspectorMemoryBlock> renderTreeUsed = InspectorMemoryBlock::create().setName(MemoryBlockName::renderTreeUsed);
-    renderTreeUsed->setSize(static_cast<int>(arenaSize.treeSize));
+    renderTreeUsed->setSize(arenaSize.treeSize);
     children->addItem(renderTreeUsed);
 
     renderTreeAllocated->setChildren(children);
     return renderTreeAllocated.release();
 }
 
-static void addMemoryBlockFor(TypeBuilder::Array<InspectorMemoryBlock>* array, const MemoryCache::TypeStatistic& statistic, const char* name)
+static void addMemoryBlockFor(TypeBuilder::Array<InspectorMemoryBlock>* array, size_t size, const char* name)
 {
     RefPtr<InspectorMemoryBlock> result = InspectorMemoryBlock::create().setName(name);
-    result->setSize(statistic.size);
+    result->setSize(size);
     array->addItem(result);
 }
 
+namespace {
+
+class MemoryInstrumentationImpl : public MemoryInstrumentation {
+public:
+    MemoryInstrumentationImpl()
+    {
+        for (int i = 0; i < LastTypeEntry; ++i)
+            m_totalSizes[i] = 0;
+    }
+
+    PassRefPtr<InspectorMemoryBlock> dumpStatistics()
+    {
+        size_t totalSize = 0;
+        for (int i = Other; i < LastTypeEntry; ++i)
+            totalSize += m_totalSizes[i];
+
+        RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > domChildren = TypeBuilder::Array<InspectorMemoryBlock>::create();
+        addMemoryBlockFor(domChildren.get(), m_totalSizes[Other], MemoryBlockName::domTreeOther);
+        addMemoryBlockFor(domChildren.get(), m_totalSizes[DOM], MemoryBlockName::domTreeDOM);
+        addMemoryBlockFor(domChildren.get(), m_totalSizes[CSS], MemoryBlockName::domTreeCSS);
+
+        RefPtr<InspectorMemoryBlock> dom = InspectorMemoryBlock::create().setName(MemoryBlockName::dom);
+        dom->setSize(totalSize);
+        dom->setChildren(domChildren.release());
+        return dom.release();
+    }
+
+private:
+    virtual void countObjectSize(ObjectType objectType, size_t size)
+    {
+        ASSERT(objectType >= 0 && objectType < LastTypeEntry);
+        m_totalSizes[objectType] += size;
+    }
+
+    virtual bool visited(const void* object)
+    {
+        return !m_visitedObjects.add(object).isNewEntry;
+    }
+    size_t m_totalSizes[LastTypeEntry];
+    typedef HashSet<const void*> VisitedObjects;
+    VisitedObjects m_visitedObjects;
+};
+
+class DOMTreesIterator : public NodeWrapperVisitor {
+public:
+    explicit DOMTreesIterator(Page* page) : m_page(page) { }
+
+    virtual void visitNode(Node* node)
+    {
+        if (node->document() && node->document()->frame() && m_page != node->document()->frame()->page())
+            return;
+
+        m_domMemoryUsage.reportInstrumentedPointer(node);
+    }
+
+    PassRefPtr<InspectorMemoryBlock> dumpStatistics() { return m_domMemoryUsage.dumpStatistics(); }
+
+private:
+    Page* m_page;
+    MemoryInstrumentationImpl m_domMemoryUsage;
+};
+
+}
+
+static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page)
+{
+    DOMTreesIterator domTreesIterator(page);
+    ScriptProfiler::visitNodeWrappers(&domTreesIterator);
+
+    // Make sure all documents reachable from the main frame are accounted.
+    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (Document* doc = frame->document())
+            domTreesIterator.visitNode(doc);
+    }
+
+    return domTreesIterator.dumpStatistics();
+}
+
 static PassRefPtr<InspectorMemoryBlock> memoryCacheInfo()
 {
     MemoryCache::Statistics stats = memoryCache()->getStatistics();
@@ -391,28 +504,51 @@ static PassRefPtr<InspectorMemoryBlock> memoryCacheInfo()
     memoryCacheStats->setSize(totalSize);
 
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
-    addMemoryBlockFor(children.get(), stats.images, MemoryBlockName::cachedImages);
-    addMemoryBlockFor(children.get(), stats.cssStyleSheets, MemoryBlockName::cachedCssStyleSheets);
-    addMemoryBlockFor(children.get(), stats.scripts, MemoryBlockName::cachedScripts);
-    addMemoryBlockFor(children.get(), stats.xslStyleSheets, MemoryBlockName::cachedXslStyleSheets);
-    addMemoryBlockFor(children.get(), stats.fonts, MemoryBlockName::cachedFonts);
-    memoryCacheStats->setChildren(children);
+    addMemoryBlockFor(children.get(), stats.images.size, MemoryBlockName::cachedImages);
+    addMemoryBlockFor(children.get(), stats.cssStyleSheets.size, MemoryBlockName::cachedCssStyleSheets);
+    addMemoryBlockFor(children.get(), stats.scripts.size, MemoryBlockName::cachedScripts);
+    addMemoryBlockFor(children.get(), stats.xslStyleSheets.size, MemoryBlockName::cachedXslStyleSheets);
+    addMemoryBlockFor(children.get(), stats.fonts.size, MemoryBlockName::cachedFonts);
+    memoryCacheStats->setChildren(children.get());
     return memoryCacheStats.release();
 }
 
+static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo()
+{
+    ExternalResourceVisitor visitor;
+    ScriptProfiler::visitExternalStrings(&visitor);
+    ScriptProfiler::visitExternalArrays(&visitor);
+
+    RefPtr<InspectorMemoryBlock> externalResourcesStats = InspectorMemoryBlock::create().setName(MemoryBlockName::jsExternalResources);
+    externalResourcesStats->setSize(visitor.externalStringSize() + visitor.externalArraySize());
+    RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
+
+    RefPtr<InspectorMemoryBlock> externalStringStats = InspectorMemoryBlock::create().setName(MemoryBlockName::jsExternalStrings);
+    externalStringStats->setSize(visitor.externalStringSize());
+    children->addItem(externalStringStats);
+
+    RefPtr<InspectorMemoryBlock> externalArrayStats = InspectorMemoryBlock::create().setName(MemoryBlockName::jsExternalArrays);
+    externalArrayStats->setSize(visitor.externalArraySize());
+    children->addItem(externalArrayStats);
+
+    return externalResourcesStats.release();
+}
+
 void InspectorMemoryAgent::getProcessMemoryDistribution(ErrorString*, RefPtr<InspectorMemoryBlock>& processMemory)
 {
     size_t privateBytes = 0;
     size_t sharedBytes = 0;
     MemoryUsageSupport::processMemorySizesInBytes(&privateBytes, &sharedBytes);
     processMemory = InspectorMemoryBlock::create().setName(MemoryBlockName::processPrivateMemory);
-    processMemory->setSize(static_cast<int>(privateBytes));
+    processMemory->setSize(privateBytes);
 
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
     children->addItem(jsHeapInfo());
+    children->addItem(jsExternalResourcesInfo());
     children->addItem(inspectorData());
     children->addItem(memoryCacheInfo());
     children->addItem(renderTreeInfo(m_page)); // TODO: collect for all pages?
+    children->addItem(domTreeInfo(m_page)); // TODO: collect for all pages?
     processMemory->setChildren(children);
 }
 
diff --git a/Source/WebCore/inspector/InspectorState.cpp b/Source/WebCore/inspector/InspectorState.cpp
index 7e02eb7a2..70a243984 100644
--- a/Source/WebCore/inspector/InspectorState.cpp
+++ b/Source/WebCore/inspector/InspectorState.cpp
@@ -65,7 +65,7 @@ void InspectorState::unmute()
 
 void InspectorState::updateCookie()
 {
-    if (m_client && !m_isOnMute)
+    if (m_client && !m_isOnMute && m_client->supportsInspectorStateUpdates())
         m_client->updateInspectorStateCookie(m_properties->toJSONString());
 }
 
diff --git a/Source/WebCore/inspector/InspectorStateClient.h b/Source/WebCore/inspector/InspectorStateClient.h
index 214c70785..7d6f55cf2 100644
--- a/Source/WebCore/inspector/InspectorStateClient.h
+++ b/Source/WebCore/inspector/InspectorStateClient.h
@@ -37,6 +37,7 @@ public:
     // Navigation can cause some WebKit implementations to change the view / page / inspector controller instance.
     // However, there are some inspector controller states that should survive navigation (such as tracking resources
     // or recording timeline) and worker restart. Following callbacks allow embedders to track these states.
+    virtual bool supportsInspectorStateUpdates() const { return false; }
     virtual void updateInspectorStateCookie(const String&) { };
 };
 
diff --git a/Source/WebCore/inspector/InspectorWebGLAgent.cpp b/Source/WebCore/inspector/InspectorWebGLAgent.cpp
index e8c457b96..4dc4d35cf 100644
--- a/Source/WebCore/inspector/InspectorWebGLAgent.cpp
+++ b/Source/WebCore/inspector/InspectorWebGLAgent.cpp
@@ -35,6 +35,7 @@
 #include "InspectorWebGLAgent.h"
 
 #include "InjectedScriptManager.h"
+#include "InjectedScriptWebGLModule.h" 
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -96,7 +97,16 @@ void InspectorWebGLAgent::disable(ErrorString*)
 
 ScriptObject InspectorWebGLAgent::wrapWebGLRenderingContextForInstrumentation(const ScriptObject& glContext)
 {
-    return m_injectedScriptManager->wrapWebGLRenderingContextForInstrumentation(glContext);
+    if (glContext.hasNoValue()) {
+        ASSERT_NOT_REACHED();
+        return ScriptObject();
+    }
+    InjectedScriptWebGLModule module = InjectedScriptWebGLModule::moduleForState(m_injectedScriptManager, glContext.scriptState());
+    if (module.hasNoValue()) {
+        ASSERT_NOT_REACHED();
+        return ScriptObject();
+    }
+    return module.wrapWebGLContext(glContext);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.cpp b/Source/WebCore/inspector/PageDebuggerAgent.cpp
index ba9a7e460..a586edf3f 100644
--- a/Source/WebCore/inspector/PageDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/PageDebuggerAgent.cpp
@@ -35,6 +35,7 @@
 #include "PageDebuggerAgent.h"
 
 #include "Console.h"
+#include "Page.h"
 #include "PageScriptDebugServer.h"
 
 namespace WebCore {
@@ -79,6 +80,19 @@ void PageDebuggerAgent::unmuteConsole()
     Console::unmute();
 }
 
+InjectedScript PageDebuggerAgent::injectedScriptForEval(ErrorString* errorString, const int* executionContextId)
+{
+    if (!executionContextId) {
+        ScriptState* scriptState = mainWorldScriptState(m_inspectedPage->mainFrame());
+        return injectedScriptManager()->injectedScriptFor(scriptState);
+    }
+    InjectedScript injectedScript = injectedScriptManager()->injectedScriptForId(*executionContextId);
+    if (injectedScript.hasNoValue())
+        *errorString = "Execution context with given id not found.";
+    return injectedScript;
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.h b/Source/WebCore/inspector/PageDebuggerAgent.h
index 727524819..9dbd513f9 100644
--- a/Source/WebCore/inspector/PageDebuggerAgent.h
+++ b/Source/WebCore/inspector/PageDebuggerAgent.h
@@ -54,6 +54,8 @@ private:
     virtual void muteConsole();
     virtual void unmuteConsole();
 
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
+
     PageDebuggerAgent(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptManager*);
     Page* const m_inspectedPage;
 };
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.cpp b/Source/WebCore/inspector/PageRuntimeAgent.cpp
index b2962bd83..35d56f5c9 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/PageRuntimeAgent.cpp
@@ -38,6 +38,7 @@
 #include "Document.h"
 #include "InjectedScript.h"
 #include "InjectedScriptManager.h"
+#include "InspectorAgent.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -52,10 +53,11 @@ namespace PageRuntimeAgentState {
 static const char reportExecutionContextCreation[] = "reportExecutionContextCreation";
 };
 
-PageRuntimeAgent::PageRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent)
+PageRuntimeAgent::PageRuntimeAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent, InspectorAgent* inspectorAgent)
     : InspectorRuntimeAgent(instrumentingAgents, state, injectedScriptManager)
     , m_inspectedPage(page)
     , m_pageAgent(pageAgent)
+    , m_inspectorAgent(inspectorAgent)
     , m_frontend(0)
 {
 }
@@ -81,8 +83,13 @@ void PageRuntimeAgent::restore()
 {
     if (!m_state->getBoolean(PageRuntimeAgentState::reportExecutionContextCreation))
         return;
-    String error;
-    setReportExecutionContextCreation(&error, true);
+    // Only report existing contexts if the page did commit load, otherwise we may
+    // unintentionally initialize contexts in the frames which may trigger some listeners
+    // that are expected to be triggered only after the load is committed, see http://crbug.com/131623
+    if (m_inspectorAgent->didCommitLoadFired()) {
+        String error;
+        setReportExecutionContextCreation(&error, true);
+    }
 }
 
 void PageRuntimeAgent::setReportExecutionContextCreation(ErrorString*, bool enable)
diff --git a/Source/WebCore/inspector/PageRuntimeAgent.h b/Source/WebCore/inspector/PageRuntimeAgent.h
index 483217f44..9c92d807a 100644
--- a/Source/WebCore/inspector/PageRuntimeAgent.h
+++ b/Source/WebCore/inspector/PageRuntimeAgent.h
@@ -40,15 +40,16 @@
 
 namespace WebCore {
 
+class InspectorAgent;
 class InspectorPageAgent;
 class Page;
 class SecurityOrigin;
 
 class PageRuntimeAgent : public InspectorRuntimeAgent {
 public:
-    static PassOwnPtr<PageRuntimeAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent)
+    static PassOwnPtr<PageRuntimeAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InjectedScriptManager* injectedScriptManager, Page* page, InspectorPageAgent* pageAgent, InspectorAgent* inspectorAgent)
     {
-        return adoptPtr(new PageRuntimeAgent(instrumentingAgents, state, injectedScriptManager, page, pageAgent));
+        return adoptPtr(new PageRuntimeAgent(instrumentingAgents, state, injectedScriptManager, page, pageAgent, inspectorAgent));
     }
     virtual ~PageRuntimeAgent();
     virtual void setFrontend(InspectorFrontend*);
@@ -60,7 +61,7 @@ public:
     void didCreateIsolatedContext(Frame*, ScriptState*, SecurityOrigin*);
 
 private:
-    PageRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, Page*, InspectorPageAgent*);
+    PageRuntimeAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*, Page*, InspectorPageAgent*, InspectorAgent*);
 
     virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
@@ -69,6 +70,7 @@ private:
 
     Page* m_inspectedPage;
     InspectorPageAgent* m_pageAgent;
+    InspectorAgent* m_inspectorAgent;
     InspectorFrontend::Runtime* m_frontend;
 };
 
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
index d80b9c711..c75af4a6e 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -124,6 +124,16 @@ WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
     return m_scriptDebugServer;
 }
 
+InjectedScript WorkerDebuggerAgent::injectedScriptForEval(ErrorString* error, const int* executionContextId)
+{
+    if (executionContextId) {
+        *error = "Execution context id is not supported for workers as there is only one execution context.";
+        return InjectedScript();
+    }
+    ScriptState* scriptState = scriptStateFromWorkerContext(m_inspectedWorkerContext);
+    return injectedScriptManager()->injectedScriptFor(scriptState);
+}
+
 void WorkerDebuggerAgent::muteConsole()
 {
     // We don't need to mute console for workers.
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.h b/Source/WebCore/inspector/WorkerDebuggerAgent.h
index 7ae68aa84..20c509b14 100644
--- a/Source/WebCore/inspector/WorkerDebuggerAgent.h
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.h
@@ -56,6 +56,7 @@ private:
     virtual void startListeningScriptDebugServer();
     virtual void stopListeningScriptDebugServer();
     virtual WorkerScriptDebugServer& scriptDebugServer();
+    virtual InjectedScript injectedScriptForEval(ErrorString*, const int* executionContextId);
     virtual void muteConsole();
     virtual void unmuteConsole();
 
diff --git a/Source/WebCore/inspector/WorkerInspectorController.cpp b/Source/WebCore/inspector/WorkerInspectorController.cpp
index 4d16eb630..7d7aa9b89 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.cpp
+++ b/Source/WebCore/inspector/WorkerInspectorController.cpp
@@ -77,6 +77,7 @@ public:
     virtual ~WorkerStateClient() { }
 
 private:
+    virtual bool supportsInspectorStateUpdates() const { return true; }
     virtual void updateInspectorStateCookie(const String& cookie)
     {
         m_workerContext->thread()->workerReportingProxy().updateInspectorStateCookie(cookie);
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index 9bddf5af6..6ab3ec862 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -32,7 +32,6 @@ WebInspector.CallStackSidebarPane = function()
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Call Stack"));
     this._model = WebInspector.debuggerModel;
 
-    this.bodyElement.addEventListener("contextmenu", this._contextMenu.bind(this), true);
     this.bodyElement.addEventListener("keydown", this._keyDown.bind(this), true);
     this.bodyElement.tabIndex = 0;
 }
@@ -53,7 +52,7 @@ WebInspector.CallStackSidebarPane.prototype = {
 
         for (var i = 0; i < callFrames.length; ++i) {
             var callFrame = callFrames[i];
-            var placard = new WebInspector.CallStackSidebarPane.Placard(callFrame);
+            var placard = new WebInspector.CallStackSidebarPane.Placard(callFrame, this);
             placard.element.addEventListener("click", this._placardSelected.bind(this, placard), false);
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
@@ -108,16 +107,6 @@ WebInspector.CallStackSidebarPane.prototype = {
         this._model.setSelectedCallFrame(placard._callFrame);
     },
 
-    _contextMenu: function(event)
-    {
-        if (!this.placards.length)
-            return;
-
-        var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Copy Stack Trace"), this._copyStackTrace.bind(this));
-        contextMenu.show(event);
-    },
-
     _copyStackTrace: function()
     {
         var text = "";
@@ -175,18 +164,39 @@ WebInspector.CallStackSidebarPane.prototype.__proto__ = WebInspector.SidebarPane
  * @constructor
  * @extends {WebInspector.Placard}
  * @param {WebInspector.DebuggerModel.CallFrame} callFrame
+ * @param {WebInspector.CallStackSidebarPane} pane
  */
-WebInspector.CallStackSidebarPane.Placard = function(callFrame)
+WebInspector.CallStackSidebarPane.Placard = function(callFrame, pane)
 {
     WebInspector.Placard.call(this, callFrame.functionName || WebInspector.UIString("(anonymous function)"), "");
     callFrame.createLiveLocation(this._update.bind(this));
+    this.element.addEventListener("contextmenu", this._placardContextMenu.bind(this), true);
     this._callFrame = callFrame;
+    this._pane = pane;
 }
 
 WebInspector.CallStackSidebarPane.Placard.prototype = {
     _update: function(uiLocation)
     {
         this.subtitle = WebInspector.displayNameForURL(uiLocation.uiSourceCode.url) + ":" + (uiLocation.lineNumber + 1);
+    },
+
+    _placardContextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+
+        if (WebInspector.debuggerModel.canSetScriptSource()) {
+            contextMenu.appendItem(WebInspector.UIString("Restart Frame"), this._restartFrame.bind(this));
+            contextMenu.appendSeparator();
+        }
+        contextMenu.appendItem(WebInspector.UIString("Copy Stack Trace"), this._pane._copyStackTrace.bind(this._pane));
+
+        contextMenu.show(event);
+    },
+
+    _restartFrame: function()
+    {
+        this._callFrame.restart(undefined);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ContextMenu.js b/Source/WebCore/inspector/front-end/ContextMenu.js
index bd5560c8d..6821c4a9a 100644
--- a/Source/WebCore/inspector/front-end/ContextMenu.js
+++ b/Source/WebCore/inspector/front-end/ContextMenu.js
@@ -91,7 +91,7 @@ WebInspector.ContextSubMenuItem.prototype = {
     appendItem: function(label, handler, disabled)
     {
         var item = new WebInspector.ContextMenuItem(this._contextMenu, "item", label, disabled);
-        this._items.push(item);
+        this._pushItem(item);
         this._contextMenu._setHandler(item.id(), handler);
         return item;
     },
@@ -99,7 +99,7 @@ WebInspector.ContextSubMenuItem.prototype = {
     appendSubMenuItem: function(label, disabled)
     {
         var item = new WebInspector.ContextSubMenuItem(this._contextMenu, label, disabled);
-        this._items.push(item);
+        this._pushItem(item);
         return item;
     },
 
@@ -109,21 +109,24 @@ WebInspector.ContextSubMenuItem.prototype = {
     appendCheckboxItem: function(label, handler, checked, disabled)
     {
         var item = new WebInspector.ContextMenuItem(this._contextMenu, "checkbox", label, disabled, checked);
-        this._items.push(item);
+        this._pushItem(item);
         this._contextMenu._setHandler(item.id(), handler);
         return item;
     },
 
     appendSeparator: function()
     {
-        // No separator dupes allowed.
-        if (this._items.length === 0)
-            return null;
-        if (this._items[this._items.length - 1].type() === "separator")
-            return null;
-        var item = new WebInspector.ContextMenuItem(this._contextMenu, "separator");
+        if (this._items.length)
+            this._pendingSeparator = true;
+    },
+
+    _pushItem: function(item)
+    {
+        if (this._pendingSeparator) {
+            this._items.push(new WebInspector.ContextMenuItem(this._contextMenu, "separator"));
+            delete this._pendingSeparator;
+        }
         this._items.push(item);
-        return item;
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 2f0f7bc2d..23470a443 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -541,6 +541,24 @@ WebInspector.DebuggerModel.prototype = {
         if (!script)
             return null;
         return script.rawLocationToUILocation(rawLocation.lineNumber, rawLocation.columnNumber);
+    },
+
+    /**
+     * Handles notification from JavaScript VM about updated stack (liveedit or frame restart action).
+     * @this {WebInspector.DebuggerModel}
+     * @param {Array.<DebuggerAgent.CallFrame>=} newCallFrames
+     * @param {Object=} details
+     */
+    callStackModified: function(newCallFrames, details)
+    {
+        // FIXME: declare this property in protocol and in JavaScript.
+        if (details && details["stack_update_needs_step_in"])
+            DebuggerAgent.stepInto();
+        else {
+            if (newCallFrames && newCallFrames.length)
+                this._pausedScript(newCallFrames, this._debuggerPausedDetails.reason, this._debuggerPausedDetails.auxData);
+
+        }
     }
 }
 
@@ -710,6 +728,27 @@ WebInspector.DebuggerModel.CallFrame.prototype = {
     },
 
     /**
+     * @param {function(?Protocol.Error=)=} callback
+     */
+    restart: function(callback)
+    {
+        /**
+         * @this {WebInspector.DebuggerModel.CallFrame}
+         * @param {?Protocol.Error} error
+         * @param {Array.<DebuggerAgent.CallFrame>=} callFrames
+         * @param {Object=} details
+         */
+        function protocolCallback(error, callFrames, details)
+        {
+            if (!error)
+                WebInspector.debuggerModel.callStackModified(callFrames, details);
+            if (callback)
+                callback(error);
+        }
+        DebuggerAgent.restartFrame(this._payload.callFrameId, protocolCallback);
+    },
+
+    /**
      * @param {function(WebInspector.UILocation):(boolean|undefined)} updateDelegate
      */
     createLiveLocation: function(updateDelegate)
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 283d61a24..233c54e15 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -449,19 +449,21 @@ WebInspector.ElementsTreeOutline.prototype = {
         if (!treeElement)
             return false;
 
-        var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
+        var isTag = treeElement.representedObject.nodeType() === Node.ELEMENT_NODE;
         var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
+        if (textNode && textNode.hasStyleClass("bogus"))
+            textNode = null;
         var commentNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-comment");
         var populated = WebInspector.populateHrefContextMenu(contextMenu, this.selectedDOMNode(), event);
-        if (tag && treeElement._populateTagContextMenu) {
+        if (textNode && treeElement._populateTextContextMenu) {
             if (populated)
                 contextMenu.appendSeparator();
-            treeElement._populateTagContextMenu(contextMenu, event);
+            treeElement._populateTextContextMenu(contextMenu, textNode);
             populated = true;
-        } else if (textNode && treeElement._populateTextContextMenu) {
+        } else if (isTag && treeElement._populateTagContextMenu) {
             if (populated)
                 contextMenu.appendSeparator();
-            treeElement._populateTextContextMenu(contextMenu, textNode);
+            treeElement._populateTagContextMenu(contextMenu, event);
             populated = true;
         } else if (commentNode && treeElement._populateNodeContextMenu) {
             if (populated)
@@ -1468,7 +1470,8 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         delete this.selectionElement;
-        this.updateSelection();
+        if (this.selected)
+            this.updateSelection();
         this._preventFollowingLinksOnDoubleClick();
         this._highlightSearchResults();
     },
@@ -1561,7 +1564,7 @@ WebInspector.ElementsTreeElement.prototype = {
 
                 if (!this.expanded && (!showInlineText && (this.treeOutline.isXMLMimeType || !WebInspector.ElementsTreeElement.ForbiddenClosingTagElements[tagName]))) {
                     if (this.hasChildren) {
-                        var textNodeElement = info.titleDOM.createChild("span", "webkit-html-text-node");
+                        var textNodeElement = info.titleDOM.createChild("span", "webkit-html-text-node bogus");
                         textNodeElement.textContent = "\u2026";
                         info.titleDOM.appendChild(document.createTextNode("\u200B"));
                     }
@@ -1843,6 +1846,9 @@ WebInspector.ElementsTreeUpdater.prototype = {
         }
 
         var updatedParentTreeElements = [];
+        var treeOutlineContainerElement = this._treeOutline.element.parentNode;
+        var originalScrollTop = treeOutlineContainerElement ? treeOutlineContainerElement.scrollTop : 0;
+        this._treeOutline.element.addStyleClass("hidden");
 
         for (var i = 0; i < this._recentlyModifiedNodes.length; ++i) {
             var parent = this._recentlyModifiedNodes[i].parent;
@@ -1850,6 +1856,7 @@ WebInspector.ElementsTreeUpdater.prototype = {
             if (parent === this._treeOutline._rootDOMNode) {
                 // Document's children have changed, perform total update.
                 this._treeOutline.update();
+                this._treeOutline.element.removeStyleClass("hidden");
                 return;
             }
 
@@ -1876,6 +1883,9 @@ WebInspector.ElementsTreeUpdater.prototype = {
         for (var i = 0; i < updatedParentTreeElements.length; ++i)
             delete updatedParentTreeElements[i].alreadyUpdatedChildren;
 
+        this._treeOutline.element.removeStyleClass("hidden");
+        if (originalScrollTop)
+            treeOutlineContainerElement.scrollTop = originalScrollTop;
         this._recentlyModifiedNodes = [];
     },
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index d1c281cd8..551e39437 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -147,25 +147,25 @@ WebInspector.ExtensionPanel.prototype = {
 
     searchCanceled: function(startingNewSearch)
     {
-        WebInspector.extensionServer.notifySearchAction(this._id, WebInspector.extensionAPI.panels.SearchAction.CancelSearch);
+        WebInspector.extensionServer.notifySearchAction(this.name, WebInspector.extensionAPI.panels.SearchAction.CancelSearch);
         WebInspector.Panel.prototype.searchCanceled.apply(this, arguments);
     },
 
     performSearch: function(query)
     {
-        WebInspector.extensionServer.notifySearchAction(this._id, WebInspector.extensionAPI.panels.SearchAction.PerformSearch, query);
+        WebInspector.extensionServer.notifySearchAction(this.name, WebInspector.extensionAPI.panels.SearchAction.PerformSearch, query);
         WebInspector.Panel.prototype.performSearch.apply(this, arguments);
     },
 
     jumpToNextSearchResult: function()
     {
-        WebInspector.extensionServer.notifySearchAction(this._id, WebInspector.extensionAPI.panels.SearchAction.NextSearchResult);
+        WebInspector.extensionServer.notifySearchAction(this.name, WebInspector.extensionAPI.panels.SearchAction.NextSearchResult);
         WebInspector.Panel.prototype.jumpToNextSearchResult.call(this);
     },
 
     jumpToPreviousSearchResult: function()
     {
-        WebInspector.extensionServer.notifySearchAction(this._id, WebInspector.extensionAPI.panels.SearchAction.PreviousSearchResult);
+        WebInspector.extensionServer.notifySearchAction(this.name, WebInspector.extensionAPI.panels.SearchAction.PreviousSearchResult);
         WebInspector.Panel.prototype.jumpToPreviousSearchResult.call(this);
     },
 
diff --git a/Source/WebCore/inspector/front-end/FileSystemModel.js b/Source/WebCore/inspector/front-end/FileSystemModel.js
index f2ef69ec2..661e915ff 100644
--- a/Source/WebCore/inspector/front-end/FileSystemModel.js
+++ b/Source/WebCore/inspector/front-end/FileSystemModel.js
@@ -148,7 +148,7 @@ WebInspector.FileSystemModel.prototype = {
 
         var types = ["persistent", "temporary"];
         for (var i = 0; i < types.length; ++i)
-            this._agentWrapper.getFileSystemRoot(origin, types[i], this._gotFileSystem.bind(this, origin, types[i], this._fileSystemsForOrigin[origin]));
+            this._agentWrapper.requestFileSystemRoot(origin, types[i], this._fileSystemRootReceived.bind(this, origin, types[i], this._fileSystemsForOrigin[origin]));
     },
 
     /**
@@ -195,13 +195,46 @@ WebInspector.FileSystemModel.prototype = {
      * @param {number} errorCode
      * @param {FileSystemAgent.Entry=} backendRootEntry
      */
-    _gotFileSystem: function(origin, type, store, errorCode, backendRootEntry)
+    _fileSystemRootReceived: function(origin, type, store, errorCode, backendRootEntry)
     {
         if (errorCode === 0 && backendRootEntry && this._fileSystemsForOrigin[origin] === store) {
             var fileSystem = new WebInspector.FileSystemModel.FileSystem(this, origin, type, backendRootEntry);
             store[type] = fileSystem;
             this._fileSystemAdded(fileSystem);
         }
+    },
+
+    /**
+     * @param {WebInspector.FileSystemModel.Directory} directory
+     * @param {function(number, Array.<WebInspector.FileSystemModel.Entry>=)} callback
+     */
+    requestDirectoryContent: function(directory, callback)
+    {
+        this._agentWrapper.requestDirectoryContent(directory.url, this._directoryContentReceived.bind(this, directory, callback));
+    },
+
+    /**
+     * @param {WebInspector.FileSystemModel.Directory} parentDirectory
+     * @param {function(number, Array.<WebInspector.FileSystemModel.Entry>=)} callback
+     * @param {number} errorCode
+     * @param {Array.<FileSystemAgent.Entry>=} backendEntries
+     */
+    _directoryContentReceived: function(parentDirectory, callback, errorCode, backendEntries)
+    {
+        if (errorCode !== 0) {
+            callback(errorCode, null);
+            return;
+        }
+
+        var entries = [];
+        for (var i = 0; i < backendEntries.length; ++i) {
+            if (backendEntries[i].isDirectory)
+                entries.push(new WebInspector.FileSystemModel.Directory(this, parentDirectory.fileSystem, backendEntries[i]));
+            else
+                entries.push(new WebInspector.FileSystemModel.File(this, parentDirectory.fileSystem, backendEntries[i]));
+        }
+
+        callback(errorCode, entries);
     }
 }
 
@@ -223,9 +256,14 @@ WebInspector.FileSystemModel.FileSystem = function(fileSystemModel, origin, type
 {
     this.origin = origin;
     this.type = type;
+
+    this.root = new WebInspector.FileSystemModel.Directory(fileSystemModel, this, backendRootEntry);
 }
 
 WebInspector.FileSystemModel.FileSystem.prototype = {
+    /**
+     * @type {string}
+     */
     get name()
     {
         return "filesystem:" + this.origin + "/" + this.type;
@@ -234,37 +272,149 @@ WebInspector.FileSystemModel.FileSystem.prototype = {
 
 /**
  * @constructor
+ * @param {WebInspector.FileSystemModel} fileSystemModel
+ * @param {WebInspector.FileSystemModel.FileSystem} fileSystem
+ * @param {FileSystemAgent.Entry} backendEntry
  */
-WebInspector.FileSystemRequestManager = function()
+WebInspector.FileSystemModel.Entry = function(fileSystemModel, fileSystem, backendEntry)
 {
-    this._pendingGetFileSystemRootRequests = {};
-    this._pendingReadDirectoryRequests = {};
+    this._fileSystemModel = fileSystemModel;
+    this._fileSystem = fileSystem;
 
-    InspectorBackend.registerFileSystemDispatcher(new WebInspector.FileSystemDispatcher(this));
-    FileSystemAgent.enable();
+    this._url = backendEntry.url;
+    this._name = backendEntry.name;
+    this._isDirectory = backendEntry.isDirectory;
 }
 
-WebInspector.FileSystemRequestManager.nextRequestId = 1;
+WebInspector.FileSystemModel.Entry.prototype = {
+    /**
+     * @type {WebInspector.FileSystemModel}
+     */
+    get fileSystemModel()
+    {
+        return this._fileSystemModel;
+    },
+
+    /**
+     * @type {WebInspector.FileSystemModel.FileSystem}
+     */
+    get fileSystem()
+    {
+        return this._fileSystem;
+    },
+
+    /**
+     * @type {string}
+     */
+    get url()
+    {
+        return this._url;
+    },
 
-WebInspector.FileSystemRequestManager.prototype = {
     /**
-     * @return {number}
+     * @type {string}
      */
-    _requestId: function()
+    get name()
     {
-        return WebInspector.FileSystemRequestManager.nextRequestId++;
+        return this._name;
     },
 
     /**
+     * @type {boolean}
+     */
+    get isDirectory()
+    {
+        return this._isDirectory;
+    }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.FileSystemModel.Entry}
+ * @param {WebInspector.FileSystemModel} fileSystemModel
+ * @param {WebInspector.FileSystemModel.FileSystem} fileSystem
+ * @param {FileSystemAgent.Entry} backendEntry
+ */
+WebInspector.FileSystemModel.Directory = function(fileSystemModel, fileSystem, backendEntry)
+{
+    WebInspector.FileSystemModel.Entry.call(this, fileSystemModel, fileSystem, backendEntry);
+}
+
+WebInspector.FileSystemModel.Directory.prototype = {
+    /**
+     * @param {function(number, Array.<WebInspector.FileSystemModel.Directory>)} callback
+     */
+    requestDirectoryContent: function(callback)
+    {
+        this.fileSystemModel.requestDirectoryContent(this, callback);
+    }
+}
+
+WebInspector.FileSystemModel.Directory.prototype.__proto__ = WebInspector.FileSystemModel.Entry.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.FileSystemModel.Entry}
+ * @param {WebInspector.FileSystemModel} fileSystemModel
+ * @param {WebInspector.FileSystemModel.FileSystem} fileSystem
+ * @param {FileSystemAgent.Entry} backendEntry
+ */
+WebInspector.FileSystemModel.File = function(fileSystemModel, fileSystem, backendEntry)
+{
+    WebInspector.FileSystemModel.Entry.call(this, fileSystemModel, fileSystem, backendEntry);
+
+    this._mimeType = backendEntry.mimeType;
+    this._resourceType = WebInspector.resourceTypes[backendEntry.resourceType];
+}
+
+WebInspector.FileSystemModel.File.prototype = {
+    /**
+     * @type {string}
+     */
+    get mimeType()
+    {
+        return this._mimeType;
+    },
+
+    /**
+     * @type {WebInspector.ResourceType}
+     */
+    get resourceType()
+    {
+        return this._resourceType;
+    }
+}
+
+WebInspector.FileSystemModel.File.prototype.__proto__ = WebInspector.FileSystemModel.Entry.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.FileSystemRequestManager = function()
+{
+    this._pendingFileSystemRootRequests = {};
+    this._pendingDirectoryContentRequests = {};
+
+    InspectorBackend.registerFileSystemDispatcher(new WebInspector.FileSystemDispatcher(this));
+    FileSystemAgent.enable();
+}
+
+WebInspector.FileSystemRequestManager.prototype = {
+    /**
      * @param {string} origin
      * @param {string} type
      * @param {function(number, FileSystemAgent.Entry)} callback
      */
-    getFileSystemRoot: function(origin, type, callback)
+    requestFileSystemRoot: function(origin, type, callback)
     {
-        var requestId = this._requestId();
-        this._pendingGetFileSystemRootRequests[requestId] = callback;
-        FileSystemAgent.getFileSystemRoot(requestId, origin, type);
+        var store = this._pendingFileSystemRootRequests;
+        FileSystemAgent.requestFileSystemRoot(origin, type, requestAccepted);
+
+        function requestAccepted(error, requestId)
+        {
+            if (!error)
+                store[requestId] = callback;
+        }
     },
 
     /**
@@ -272,12 +422,12 @@ WebInspector.FileSystemRequestManager.prototype = {
      * @param {number} errorCode
      * @param {FileSystemAgent.Entry=} backendRootEntry
      */
-    _gotFileSystemRoot: function(requestId, errorCode, backendRootEntry)
+    _fileSystemRootReceived: function(requestId, errorCode, backendRootEntry)
     {
-        var callback = this._pendingGetFileSystemRootRequests[requestId];
+        var callback = this._pendingFileSystemRootRequests[requestId];
         if (!callback)
             return;
-        delete this._pendingGetFileSystemRootRequests[requestId];
+        delete this._pendingFileSystemRootRequests[requestId];
         callback(errorCode, backendRootEntry);
     },
 
@@ -285,11 +435,16 @@ WebInspector.FileSystemRequestManager.prototype = {
      * @param {string} url
      * @param {function(number, Array.<FileSystemAgent.Entry>=)} callback
      */
-    readDirectory: function(url, callback)
+    requestDirectoryContent: function(url, callback)
     {
-        var requestId = this.requestId();
-        this._pendingReadDirectoryRequests[requestId] = callback;
-        FileSystemAgent.readDirectory(requestId, url);
+        var store = this._pendingDirectoryContentRequests;
+        FileSystemAgent.requestDirectoryContent(url, requestAccepted);
+
+        function requestAccepted(error, requestId)
+        {
+            if (!error)
+                store[requestId] = callback;
+        }
     },
 
     /**
@@ -297,12 +452,12 @@ WebInspector.FileSystemRequestManager.prototype = {
      * @param {number} errorCode
      * @param {Array.<FileSystemAgent.Entry>=} backendEntries
      */
-    _didReadDirectory: function(requestId, errorCode, backendEntries)
+    _directoryContentReceived: function(requestId, errorCode, backendEntries)
     {
-        var callback = /** @type {function(number, Array.<FileSystemAgent.Entry>=)} */ this._pendingReadDirectoryRequests[requestId];
+        var callback = /** @type {function(number, Array.<FileSystemAgent.Entry>=)} */ this._pendingDirectoryContentRequests[requestId];
         if (!callback)
             return;
-        delete this._pendingReadDirectoryRequests[requestId];
+        delete this._pendingDirectoryContentRequests[requestId];
         callback(errorCode, backendEntries);
     }
 }
@@ -323,9 +478,9 @@ WebInspector.FileSystemDispatcher.prototype = {
      * @param {number} errorCode
      * @param {FileSystemAgent.Entry=} backendRootEntry
      */
-    gotFileSystemRoot: function(requestId, errorCode, backendRootEntry)
+    fileSystemRootReceived: function(requestId, errorCode, backendRootEntry)
     {
-        this._agentWrapper._gotFileSystemRoot(requestId, errorCode, backendRootEntry);
+        this._agentWrapper._fileSystemRootReceived(requestId, errorCode, backendRootEntry);
     },
 
     /**
@@ -333,8 +488,8 @@ WebInspector.FileSystemDispatcher.prototype = {
      * @param {number} errorCode
      * @param {Array.<FileSystemAgent.Entry>=} backendEntries
      */
-    didReadDirectory: function(requestId, errorCode, backendEntries)
+    directoryContentReceived: function(requestId, errorCode, backendEntries)
     {
-        this._agentWrapper._didReadDirectory(requestId, errorCode, backendEntries);
+        this._agentWrapper._directoryContentReceived(requestId, errorCode, backendEntries);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
index cba65462a..e123b8fa5 100644
--- a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
+++ b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
@@ -218,6 +218,9 @@ WebInspector.MemoryBlockViewProperties._initialize = function()
     addBlock("hsl(  0,  0%,  80%)", "Other", "Other");
     addBlock("hsl( 90, 60%,  80%)", "JSHeapAllocated", "JavaScript heap");
     addBlock("hsl( 90, 80%,  80%)", "JSHeapUsed", "Used JavaScript heap");
+    addBlock("hsl( 90, 30%,  80%)", "JSExternalResources", "JavaScript external resources");
+    addBlock("hsl( 90, 40%,  80%)", "JSExternalArrays", "JavaScript external arrays");
+    addBlock("hsl( 90, 50%,  80%)", "JSExternalStrings", "JavaScript external strings");
     addBlock("hsl(210, 60%,  80%)", "InspectorData", "Inspector data");
     addBlock("hsl( 30, 60%,  80%)", "MemoryCache", "Memory cache resources");
     addBlock("hsl( 60, 60%,  80%)", "RenderTreeAllocated", "Render tree");
@@ -365,3 +368,123 @@ WebInspector.NativeMemoryPieChart.prototype = {
 }
 
 WebInspector.NativeMemoryPieChart.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ */
+WebInspector.NativeMemoryBarChart = function()
+{
+    WebInspector.View.call(this);
+    this.registerRequiredCSS("nativeMemoryProfiler.css");
+    this._memorySnapshot = null;
+    this.element = document.createElement("div");
+    this._table = this.element.createChild("table");
+    this._divs = {};
+    var row = this._table.insertRow();
+    this._totalDiv = row.insertCell().createChild("div");
+    this._totalDiv.addStyleClass("memory-bar-chart-total");
+    row.insertCell();
+}
+
+WebInspector.NativeMemoryBarChart.prototype = {
+    _updateStats: function()
+    {
+        function didReceiveMemorySnapshot(error, memoryBlock)
+        {
+            if (memoryBlock.size && memoryBlock.children) {
+                var knownSize = 0;
+                for (var i = 0; i < memoryBlock.children.length; i++) {
+                    var size = memoryBlock.children[i].size;
+                    if (size)
+                        knownSize += size;
+                }
+                var otherSize = memoryBlock.size - knownSize;
+
+                if (otherSize) {
+                    memoryBlock.children.push({
+                        name: "Other",
+                        size: otherSize
+                    });
+                }
+            }
+            this._memorySnapshot = memoryBlock;
+            this._updateView();
+        }
+        MemoryAgent.getProcessMemoryDistribution(didReceiveMemorySnapshot.bind(this));
+    },
+
+    /**
+     * @override
+     */
+    willHide: function()
+    {
+        clearInterval(this._timerId);
+    },
+
+    /**
+     * @override
+     */
+    wasShown: function()
+    {
+        this._timerId = setInterval(this._updateStats.bind(this), 200);
+    },
+
+    _updateView: function()
+    {
+        var memoryBlock = this._memorySnapshot;
+        if (!memoryBlock)
+            return;
+
+        var MB = 1024 * 1024;
+        var maxSize = 100 * MB;
+        for (var i = 0; i < memoryBlock.children.length; ++i)
+            maxSize = Math.max(maxSize, memoryBlock.children[i].size);
+        var maxBarLength = 500;
+        var barLengthSizeRatio = maxBarLength / maxSize;
+
+        for (var i = memoryBlock.children.length - 1; i >= 0 ; --i) {
+            var child = memoryBlock.children[i];
+            var name = child.name;
+            var divs = this._divs[name];
+            if (!divs) {
+                var row = this._table.insertRow();
+                var nameDiv = row.insertCell(-1).createChild("div");
+                var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(child);
+                var title = viewProperties._description;
+                nameDiv.textContent = title;
+                nameDiv.addStyleClass("memory-bar-chart-name");
+                var barCell = row.insertCell(-1);
+                barDiv = barCell.createChild("div");
+                barDiv.addStyleClass("memory-bar-chart-bar");
+                var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(child);
+                barDiv.style.backgroundColor = viewProperties._fillStyle;
+                var unusedDiv = barDiv.createChild("div");
+                unusedDiv.addStyleClass("memory-bar-chart-unused");
+                var percentDiv = barDiv.createChild("div");
+                percentDiv.addStyleClass("memory-bar-chart-percent");
+                var sizeDiv = barCell.createChild("div");
+                sizeDiv.addStyleClass("memory-bar-chart-size");
+                divs = this._divs[name] = { barDiv: barDiv, unusedDiv: unusedDiv, percentDiv: percentDiv, sizeDiv: sizeDiv };
+            }
+            var unusedSize = 0;
+            if (!!child.children) {
+                unusedSize = child.size;
+                for (var j = 0; j < child.children.length; ++j)
+                    unusedSize -= child.children[j].size;
+            }
+            var unusedLength = unusedSize * barLengthSizeRatio;
+            var barLength = child.size * barLengthSizeRatio;
+
+            divs.barDiv.style.width = barLength + "px";
+            divs.unusedDiv.style.width = unusedLength + "px";
+            divs.percentDiv.textContent = barLength > 20 ? (child.size / memoryBlock.size * 100).toFixed(0) + "%" : "";
+            divs.sizeDiv.textContent = (child.size / MB).toFixed(1) + "\u2009MB";
+        }
+
+        var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(memoryBlock);
+        this._totalDiv.textContent = viewProperties._description + ": " + (memoryBlock.size / MB).toFixed(1) + "\u2009MB";
+    }
+}
+
+WebInspector.NativeMemoryBarChart.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/ProfileLauncherView.js b/Source/WebCore/inspector/front-end/ProfileLauncherView.js
index 7efd104c8..cfe22bee9 100644
--- a/Source/WebCore/inspector/front-end/ProfileLauncherView.js
+++ b/Source/WebCore/inspector/front-end/ProfileLauncherView.js
@@ -50,6 +50,14 @@ WebInspector.ProfileLauncherView = function(profilesPanel)
     header.textContent = WebInspector.UIString("Select profiling type");
 
     this._profileTypeSelectorForm = this._contentElement.createChild("form");
+
+    if (WebInspector.experimentsSettings.liveNativeMemoryChart.isEnabled()) {
+        this._nativeMemoryElement = document.createElement("div");
+        this._contentElement.appendChild(this._nativeMemoryElement);
+        this._nativeMemoryLiveChart = new WebInspector.NativeMemoryBarChart();
+        this._nativeMemoryLiveChart.show(this._nativeMemoryElement);
+    }
+
     this._contentElement.createChild("div", "flexible-space");
 
     this._controlButton = this._contentElement.createChild("button", "control-profiling");
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index c9fcd3a23..e973fc533 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -138,6 +138,7 @@ WebInspector.Script.prototype = {
          */
         function didEditScriptSource(error, callFrames, debugData)
         {
+            // FIXME: support debugData.stack_update_needs_step_in flag by calling WebInspector.debugger_model.callStackModified
             if (!error)
                 this._source = newSource;
             callback(error, callFrames);
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index b42f9bcc3..a37829daf 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -52,6 +52,7 @@ var Preferences = {
 var Capabilities = {
     samplingCPUProfiler: false,
     debuggerCausesRecompilation: true,
+    separateScriptCompilationAndExecutionEnabled: false,
     profilerCausesRecompilation: true,
     heapProfilerPresent: false,
     canOverrideDeviceMetrics: false,
@@ -184,6 +185,7 @@ WebInspector.ExperimentsSettings = function()
     this.showShadowDOM = this._createExperiment("showShadowDOM", "Show shadow DOM");
     this.snippetsSupport = this._createExperiment("snippetsSupport", "Snippets support");
     this.nativeMemorySnapshots = this._createExperiment("nativeMemorySnapshots", "Native memory profiling");
+    this.liveNativeMemoryChart = this._createExperiment("liveNativeMemoryChart", "Live native memory chart");
     this.fileSystemInspection = this._createExperiment("fileSystemInspection", "FileSystem inspection");
 
     this._cleanUpSetting();
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextViewer.js
index d80d6cc01..e36e19d66 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextViewer.js
@@ -1216,7 +1216,7 @@ WebInspector.TextEditorMainPanel.prototype = {
         if (!range)
             return false;
 
-        range.normalize();
+        range = range.normalize();
 
         if (range.endColumn === 0)
             return false;
diff --git a/Source/WebCore/inspector/front-end/TimelineGrid.js b/Source/WebCore/inspector/front-end/TimelineGrid.js
index 251e68fa7..3d4ad7544 100644
--- a/Source/WebCore/inspector/front-end/TimelineGrid.js
+++ b/Source/WebCore/inspector/front-end/TimelineGrid.js
@@ -43,13 +43,17 @@ WebInspector.TimelineGrid = function()
     this._dividersElement.className = "resources-dividers";
     this.element.appendChild(this._dividersElement);
 
+    this._gridHeaderElement = document.createElement("div"); 
+
     this._eventDividersElement = document.createElement("div");
     this._eventDividersElement.className = "resources-event-dividers";
-    this.element.appendChild(this._eventDividersElement);
+    this._gridHeaderElement.appendChild(this._eventDividersElement);
 
     this._dividersLabelBarElement = document.createElement("div");
     this._dividersLabelBarElement.className = "resources-dividers-label-bar";
-    this.element.appendChild(this._dividersLabelBarElement);
+    this._gridHeaderElement.appendChild(this._dividersLabelBarElement);
+
+    this.element.appendChild(this._gridHeaderElement);
 }
 
 WebInspector.TimelineGrid.prototype = {
@@ -63,6 +67,11 @@ WebInspector.TimelineGrid.prototype = {
         return this._dividersElement;
     },
 
+    get gridHeaderElement()
+    {
+        return this._gridHeaderElement;
+    },
+
     removeDividers: function()
     {
         this._dividersElement.removeChildren();
@@ -158,12 +167,12 @@ WebInspector.TimelineGrid.prototype = {
 
     addEventDividers: function(dividers)
     {
-        this.element.removeChild(this._eventDividersElement);
+        this._gridHeaderElement.removeChild(this._eventDividersElement);
         for (var i = 0; i < dividers.length; ++i) {
             if (dividers[i])
                 this._eventDividersElement.appendChild(dividers[i]);
         }
-        this.element.appendChild(this._eventDividersElement);
+        this._gridHeaderElement.appendChild(this._eventDividersElement);
     },
 
     removeEventDividers: function()
@@ -184,7 +193,5 @@ WebInspector.TimelineGrid.prototype = {
     setScrollAndDividerTop: function(scrollTop, dividersTop)
     {
         this._dividersElement.style.top = scrollTop + "px";
-        this._eventDividersElement.style.top = scrollTop + "px";
-        this._dividersLabelBarElement.style.top = dividersTop + "px";
     }
 }
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index dc400d34f..4e4891eb7 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -55,22 +55,25 @@ WebInspector.TimelineOverviewPane = function(model)
 
     var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
 
-    var eventsOverviewItem = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-events", WebInspector.UIString("Events"));
-    topPaneSidebarTree.appendChild(eventsOverviewItem);
-    eventsOverviewItem.revealAndSelect(false);
-    eventsOverviewItem.onselect = this._showEvents.bind(this);
+    this._currentMode = WebInspector.TimelineOverviewPane.Mode.Events;
 
+    this._overviewItems = {};
+    this._overviewItems[WebInspector.TimelineOverviewPane.Mode.Events] = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-events",
+        WebInspector.UIString("Events"));
     if (Capabilities.timelineSupportsFrameInstrumentation) {
-        var framesOverviewItem = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-frames", WebInspector.UIString("Frames"));
-        topPaneSidebarTree.appendChild(framesOverviewItem);
-        framesOverviewItem.onselect = this._showFrames.bind(this);
+        this._overviewItems[WebInspector.TimelineOverviewPane.Mode.Frames] = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-frames",
+            WebInspector.UIString("Frames"));
     }
+    this._overviewItems[WebInspector.TimelineOverviewPane.Mode.Memory] = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-memory",
+        WebInspector.UIString("Memory"));
 
-    var memoryOverviewItem = new WebInspector.SidebarTreeElement("timeline-overview-sidebar-memory", WebInspector.UIString("Memory"));
-    topPaneSidebarTree.appendChild(memoryOverviewItem);
-    memoryOverviewItem.onselect = this._showMemoryGraph.bind(this);
-
-    this._currentMode = WebInspector.TimelineOverviewPane.Mode.Events;
+    for (var mode in this._overviewItems) {
+        var item = this._overviewItems[mode];
+        item.onselect = this.setMode.bind(this, mode);
+        topPaneSidebarTree.appendChild(item);
+    }
+    
+    this._overviewItems[this._currentMode].revealAndSelect(false);
 
     this._overviewContainer = this.element.createChild("div", "fill");
     this._overviewContainer.id = "timeline-overview-container";
@@ -134,39 +137,24 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._update();
     },
 
-    _showEvents: function()
+    setMode: function(newMode)
     {
-        if (this._currentMode === WebInspector.TimelineOverviewPane.Mode.Events)
+        if (this._currentMode === newMode)
             return;
-        this._heapGraph.hide();
-        this._setFrameMode(false);
-        this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
-        this._setMode(WebInspector.TimelineOverviewPane.Mode.Events);
-    },
 
-    _showFrames: function()
-    {
-        if (this._currentMode === WebInspector.TimelineOverviewPane.Mode.Frames)
-            return;
-        this._heapGraph.hide();
-        this._setFrameMode(true);
-        this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
-        this._setMode(WebInspector.TimelineOverviewPane.Mode.Frames);
-    },
-
-    _showMemoryGraph: function()
-    {
-        if (this._currentMode === WebInspector.TimelineOverviewPane.Mode.Memory)
-            return;
-        this._setFrameMode(false);
-        this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
-        this._heapGraph.show();
-        this._setMode(WebInspector.TimelineOverviewPane.Mode.Memory);
-    },
-
-    _setMode: function(newMode)
-    {
         this._currentMode = newMode;
+        this._setFrameMode(this._currentMode === WebInspector.TimelineOverviewPane.Mode.Frames);
+        switch (this._currentMode) {
+            case WebInspector.TimelineOverviewPane.Mode.Events:
+            case WebInspector.TimelineOverviewPane.Mode.Frames:
+                this._heapGraph.hide();
+                this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
+                break;
+            case WebInspector.TimelineOverviewPane.Mode.Memory:
+                this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
+                this._heapGraph.show();
+        }
+        this._overviewItems[this._currentMode].revealAndSelect(false);
         this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._currentMode);
         this._update();
     },
@@ -196,6 +184,7 @@ WebInspector.TimelineOverviewPane.prototype = {
     {
         delete this._refreshTimeout;
 
+        this._updateWindow();
         this._overviewCalculator.setWindow(this._model.minimumRecordTime(), this._model.maximumRecordTime());
         this._overviewCalculator.setDisplayWindow(0, this._overviewContainer.clientWidth);
 
@@ -232,6 +221,7 @@ WebInspector.TimelineOverviewPane.prototype = {
     {
         this._overviewContainer.style.left = width + "px";
         this._topPaneSidebarElement.style.width = width + "px";
+        this._update();
     },
 
     /**
@@ -311,6 +301,8 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     _onWindowChanged: function()
     {
+        if (this._ignoreWindowChangedEvent)
+            return;
         if (this._frameOverview) {
             var times = this._frameOverview.getWindowTimes(this.windowLeft(), this.windowRight());
             this._windowStartTime = times.startTime;
@@ -325,6 +317,28 @@ WebInspector.TimelineOverviewPane.prototype = {
     },
 
     /**
+     * @param {Number} left
+     * @param {Number} right
+     */
+    setWindowTimes: function(left, right)
+    {
+        this._windowStartTime = left;
+        this._windowEndTime = right;
+        this._updateWindow();
+    },
+
+    _updateWindow: function()
+    {
+        var offset = this._model.minimumRecordTime();
+        var timeSpan = this._model.maximumRecordTime() - offset;
+        var left = this._windowStartTime ? (this._windowStartTime - offset) / timeSpan : 0;
+        var right = this._windowEndTime < Infinity ? (this._windowEndTime - offset) / timeSpan : 1;
+        this._ignoreWindowChangedEvent = true;
+        this._overviewWindow._setWindow(left, right);
+        this._ignoreWindowChangedEvent = false;
+    },
+
+    /**
      * @param {boolean} value
      */
     setShowShortEvents: function(value)
@@ -338,7 +352,7 @@ WebInspector.TimelineOverviewPane.prototype = {
             return;
         if (!this.isShowing())
             return;
-        this._refreshTimeout = setTimeout(this._update.bind(this), 100);
+        this._refreshTimeout = setTimeout(this._update.bind(this), 300);
     }
 }
 
@@ -509,6 +523,16 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this._setWindowPosition(0, this._parentElement.clientWidth);
     },
 
+    /**
+     * @param {number} left
+     * @param {number} right
+     */
+    _setWindow: function(left, right)
+    {
+        var clientWidth = this._parentElement.clientWidth;
+        this._setWindowPosition(left * clientWidth, right * clientWidth);
+    },
+
     _setWindowPosition: function(start, end)
     {
         var clientWidth = this._parentElement.clientWidth;
@@ -559,10 +583,12 @@ WebInspector.TimelineOverviewWindow.prototype = {
         var left = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
         var right = this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
 
-        if (factor < 1 && factor * (right - left) < WebInspector.TimelineOverviewPane.MinSelectableSize)
+        var delta = factor * (right - left);
+        if (factor < 1 && delta < WebInspector.TimelineOverviewPane.MinSelectableSize)
             return;
-        left = Math.max(0, referencePoint + (left - referencePoint) * factor);
-        right = Math.min(this._parentElement.clientWidth, referencePoint + (right - referencePoint) * factor);
+        var max = this._parentElement.clientWidth;
+        left = Math.max(0, Math.min(max - delta, referencePoint + (left - referencePoint) * factor));
+        right = Math.min(max, left + delta);
         this._setWindowPosition(left, right);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index b83ce6d69..c80ec438e 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -42,7 +42,7 @@ WebInspector.TimelinePanel = function()
 
     this._overviewPane = new WebInspector.TimelineOverviewPane(this._model);
     this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
-    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
+    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._overviewModeChanged, this);
     this._overviewPane.show(this.element);
 
     this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
@@ -53,6 +53,8 @@ WebInspector.TimelinePanel = function()
     this.element.appendChild(this._sidebarBackgroundElement);
 
     this.createSplitViewWithSidebarTree();
+    this.element.appendChild(this.splitView.sidebarResizerElement);
+
     this._containerElement = this.splitView.element;
     this._containerElement.id = "timeline-container";
     this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
@@ -77,7 +79,9 @@ WebInspector.TimelinePanel = function()
     this._itemsGraphsElement = this._timelineGrid.itemsGraphsElement;
     this._itemsGraphsElement.id = "timeline-graphs";
     this._containerContentElement.appendChild(this._timelineGrid.element);
+    this._timelineGrid.gridHeaderElement.id = "timeline-grid-header";
     this._memoryStatistics.setMainTimelineGrid(this._timelineGrid);
+    this.element.appendChild(this._timelineGrid.gridHeaderElement);
 
     this._topGapElement = document.createElement("div");
     this._topGapElement.className = "timeline-gap";
@@ -104,9 +108,9 @@ WebInspector.TimelinePanel = function()
     this._boundariesAreValid = true;
     this._scrollTop = 0;
 
-    this._popoverHelper = new WebInspector.PopoverHelper(this._containerElement, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
-    this._containerElement.addEventListener("mousemove", this._mouseMove.bind(this), false);
-    this._containerElement.addEventListener("mouseout", this._mouseOut.bind(this), false);
+    this._popoverHelper = new WebInspector.PopoverHelper(this.element, this._getPopoverAnchor.bind(this), this._showPopover.bind(this));
+    this.element.addEventListener("mousemove", this._mouseMove.bind(this), false);
+    this.element.addEventListener("mouseout", this._mouseOut.bind(this), false);
 
     // Disable short events filter by default.
     this.toggleFilterButton.toggled = true;
@@ -128,6 +132,8 @@ WebInspector.TimelinePanel = function()
     this._presentationModel.addFilter(this._overviewPane);
     this._presentationModel.addFilter(new WebInspector.TimelineCategoryFilter()); 
     this._presentationModel.addFilter(new WebInspector.TimelineIsLongFilter(this)); 
+
+    this._overviewModeSetting = WebInspector.settings.createSetting("timelineOverviewMode", WebInspector.TimelineOverviewPane.Mode.Events);
 }
 
 // Define row height, should be in sync with styles for timeline graphs.
@@ -328,7 +334,7 @@ WebInspector.TimelinePanel.prototype = {
     _updateEventDividers: function()
     {
         this._timelineGrid.removeEventDividers();
-        var clientWidth = this._graphRowsElement.offsetWidth;
+        var clientWidth = this._graphRowsElementWidth;
         var dividers = [];
 
         for (var i = 0; i < this._timeStampRecords.length; ++i) {
@@ -352,7 +358,7 @@ WebInspector.TimelinePanel.prototype = {
     _updateFrames: function()
     {
         var frames = this._presentationModel.frames();
-        var clientWidth = this._graphRowsElement.offsetWidth;
+        var clientWidth = this._graphRowsElementWidth;
         if (this._frameContainer)
             this._frameContainer.removeChildren();
         else {
@@ -402,10 +408,12 @@ WebInspector.TimelinePanel.prototype = {
         this._overviewPane.zoomToFrame(frameBar._frame);
     },
 
-    _timelinesOverviewModeChanged: function(event)
+    _overviewModeChanged: function(event)
     {
-        var shouldShowMemory = event.data === WebInspector.TimelineOverviewPane.Mode.Memory;
-        var frameMode = event.data === WebInspector.TimelineOverviewPane.Mode.Frames;
+        var mode = event.data;
+        var shouldShowMemory = mode === WebInspector.TimelineOverviewPane.Mode.Memory;
+        var frameMode = mode === WebInspector.TimelineOverviewPane.Mode.Frames;
+        this._overviewModeSetting.set(mode);
         if (frameMode !== this._frameMode) {
             this._frameMode = frameMode;
             this._glueParentButton.disabled = frameMode;
@@ -480,8 +488,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _onTimelineEventRecorded: function(event)
     {
-        this._innerAddRecordToTimeline(event.data, this._rootRecord());
-        this._scheduleRefresh(false);
+        if (this._innerAddRecordToTimeline(event.data, this._rootRecord()))
+            this._scheduleRefresh(false);
     },
 
     _innerAddRecordToTimeline: function(record, parentRecord)
@@ -490,29 +498,39 @@ WebInspector.TimelinePanel.prototype = {
         ++this._allRecordsCount;
         var recordTypes = WebInspector.TimelineModel.RecordType;
         var timeStampRecords = this._timeStampRecords;
-        function addTimestampRecords(record)
+        var hasVisibleRecords = false;
+        var presentationModel = this._presentationModel;
+        function processRecord(record)
         {
             if (WebInspector.TimelinePresentationModel.isEventDivider(record))
                 timeStampRecords.push(record);
+            hasVisibleRecords |= presentationModel.isVisible(record);
         }
-        WebInspector.TimelinePresentationModel.forAllRecords([ formattedRecord ], addTimestampRecords);
+        var records = [ formattedRecord ];
+        WebInspector.TimelinePresentationModel.forAllRecords(records, processRecord);
+        // Tell caller update is necessary either if we added a visible record or if we re-parented a record.
+        return hasVisibleRecords || formattedRecord.parent !== this._presentationModel.rootRecord;
     },
 
     sidebarResized: function(event)
     {
         var width = event.data;
         this._sidebarBackgroundElement.style.width = width + "px";
-        this._scheduleRefresh(false);
+        this.onResize();
         this._overviewPane.sidebarResized(width);
         // Min width = <number of buttons on the left> * 31
         this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
         this._memoryStatistics.setSidebarWidth(width);
+        this._timelineGrid.gridHeaderElement.style.left = width + "px";
     },
 
     onResize: function()
     {
         this._closeRecordDetails();
         this._scheduleRefresh(false);
+        this._graphRowsElementWidth = this._graphRowsElement.offsetWidth;
+        this._timelineGrid.gridHeaderElement.style.width = this._itemsGraphsElement.offsetWidth + "px";
+        this._containerElementHeight = this._containerElement.clientHeight;
     },
 
     _clearPanel: function()
@@ -534,6 +552,7 @@ WebInspector.TimelinePanel.prototype = {
         this._adjustScrollPosition(0);
         this._closeRecordDetails();
         this._allRecordsCount = 0;
+        this._automaticallySizeWindow = true;
     },
 
     elementsToRestoreScrollPositionsFor: function()
@@ -548,6 +567,7 @@ WebInspector.TimelinePanel.prototype = {
             WebInspector.TimelinePanel._categoryStylesInitialized = true;
             this._injectCategoryStyles();
         }
+        this._overviewPane.setMode(this._overviewModeSetting.get());
         this._refresh();
         WebInspector.drawer.currentPanelCounters = this.recordsCounter;
     },
@@ -562,9 +582,9 @@ WebInspector.TimelinePanel.prototype = {
     _onScroll: function(event)
     {
         this._closeRecordDetails();
-        var scrollTop = this._containerElement.scrollTop;
-        var dividersTop = Math.max(0, scrollTop);
-        this._timelineGrid.setScrollAndDividerTop(scrollTop, dividersTop);
+        this._scrollTop = this._containerElement.scrollTop;
+        var dividersTop = Math.max(0, this._scrollTop);
+        this._timelineGrid.setScrollAndDividerTop(this._scrollTop, dividersTop);
         this._scheduleRefresh(true);
     },
 
@@ -580,7 +600,7 @@ WebInspector.TimelinePanel.prototype = {
             this._refresh();
         else {
             if (!this._refreshTimeout)
-                this._refreshTimeout = setTimeout(this._refresh.bind(this), 100);
+                this._refreshTimeout = setTimeout(this._refresh.bind(this), 300);
         }
     },
 
@@ -592,7 +612,7 @@ WebInspector.TimelinePanel.prototype = {
         }
 
         this._calculator.setWindow(this._overviewPane.windowStartTime(), this._overviewPane.windowEndTime());
-        this._calculator.setDisplayWindow(!this._overviewPane.windowLeft() ? this._expandOffset : 0, this._graphRowsElement.clientWidth);
+        this._calculator.setDisplayWindow(!this._overviewPane.windowLeft() ? this._expandOffset : 0, this._graphRowsElementWidth);
 
         var recordsInWindowCount = this._refreshRecords();
         this._updateRecordsCounter(recordsInWindowCount);
@@ -643,26 +663,33 @@ WebInspector.TimelinePanel.prototype = {
         var recordsInWindow = this._presentationModel.filteredRecords();
 
         // Calculate the visible area.
-        this._scrollTop = this._containerElement.scrollTop;
         var visibleTop = this._scrollTop;
-        var visibleBottom = visibleTop + this._containerElement.clientHeight;
+        var visibleBottom = visibleTop + this._containerElementHeight;
 
         const rowHeight = WebInspector.TimelinePanel.rowHeight;
 
         // Convert visible area to visible indexes. Always include top-level record for a visible nested record.
         var startIndex = Math.max(0, Math.min(Math.floor(visibleTop / rowHeight) - 1, recordsInWindow.length - 1));
         var endIndex = Math.min(recordsInWindow.length, Math.ceil(visibleBottom / rowHeight));
+        var lastVisibleLine = Math.max(0, Math.floor(visibleBottom / rowHeight) - 1);
+        if (this._automaticallySizeWindow && recordsInWindow.length > lastVisibleLine) {
+            this._automaticallySizeWindow = false;
+            // If we're at the top, always use real timeline start as a left window bound so that expansion arrow padding logic works.
+            var windowStartTime = startIndex ? recordsInWindow[startIndex].startTime : this._model.minimumRecordTime();
+            this._overviewPane.setWindowTimes(windowStartTime, recordsInWindow[Math.max(0, lastVisibleLine - 1)].endTime);
+            recordsInWindow = this._presentationModel.filteredRecords();
+            endIndex = Math.min(recordsInWindow.length, lastVisibleLine);
+        }
 
         // Resize gaps first.
         const top = (startIndex * rowHeight) + "px";
         this._topGapElement.style.height = top;
         this.sidebarElement.style.top = top;
-        this.splitView.sidebarResizerElement.style.top = top;
         this._bottomGapElement.style.height = (recordsInWindow.length - endIndex) * rowHeight + "px";
 
         // Update visible rows.
         var listRowElement = this._sidebarListElement.firstChild;
-        var width = this._graphRowsElement.offsetWidth;
+        var width = this._graphRowsElementWidth;
         this._itemsGraphsElement.removeChild(this._graphRowsElement);
         var graphRowElement = this._graphRowsElement.firstChild;
         var scheduleRefreshCallback = this._scheduleRefresh.bind(this, true);
@@ -712,7 +739,6 @@ WebInspector.TimelinePanel.prototype = {
 
         this._itemsGraphsElement.insertBefore(this._graphRowsElement, this._bottomGapElement);
         this._itemsGraphsElement.appendChild(this._expandElements);
-        this.splitView.sidebarResizerElement.style.height = this.sidebarElement.clientHeight + "px";
         this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
 
         return recordsInWindow.length;
@@ -721,7 +747,7 @@ WebInspector.TimelinePanel.prototype = {
     _adjustScrollPosition: function(totalHeight)
     {
         // Prevent the container from being scrolled off the end.
-        if ((this._containerElement.scrollTop + this._containerElement.offsetHeight) > totalHeight + 1)
+        if ((this._scrollTop + this._containerElementHeight) > totalHeight + 1)
             this._containerElement.scrollTop = (totalHeight - this._containerElement.offsetHeight);
     },
 
@@ -805,7 +831,6 @@ WebInspector.TimelineCalculator = function(model)
 }
 
 WebInspector.TimelineCalculator._minWidth = 5;
-WebInspector.TimelineCalculator._borderWidth = 4;
 
 WebInspector.TimelineCalculator.prototype = {
     /**
@@ -828,13 +853,19 @@ WebInspector.TimelineCalculator.prototype = {
     computeBarGraphWindowPosition: function(record)
     {
         var percentages = this.computeBarGraphPercentages(record);
+        var widthAdjustment = 0;
 
         var left = this.computePosition(record.startTime);
-        var width = (percentages.end - percentages.start) / 100 * this._workingArea + WebInspector.TimelineCalculator._minWidth;
-        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * this._workingArea;
-        var cpuWidth = percentages.cpuWidth / 100 * this._workingArea + WebInspector.TimelineCalculator._minWidth;
+        var width = (percentages.end - percentages.start) / 100 * this._workingArea;
+        if (width < WebInspector.TimelineCalculator._minWidth) {
+            widthAdjustment = WebInspector.TimelineCalculator._minWidth - width;
+            left -= widthAdjustment / 2;
+            width += widthAdjustment;
+        }
+        var widthWithChildren = (percentages.endWithChildren - percentages.start) / 100 * this._workingArea + widthAdjustment;
+        var cpuWidth = percentages.cpuWidth / 100 * this._workingArea + widthAdjustment;
         if (percentages.endWithChildren > percentages.end)
-            widthWithChildren += WebInspector.TimelineCalculator._borderWidth + WebInspector.TimelineCalculator._minWidth;
+            widthWithChildren += widthAdjustment;
         return {left: left, width: width, widthWithChildren: widthWithChildren, cpuWidth: cpuWidth};
     },
 
@@ -851,7 +882,7 @@ WebInspector.TimelineCalculator.prototype = {
      */
     setDisplayWindow: function(paddingLeft, clientWidth)
     {
-        this._workingArea = clientWidth - WebInspector.TimelineCalculator._minWidth - WebInspector.TimelineCalculator._borderWidth - paddingLeft;
+        this._workingArea = clientWidth - WebInspector.TimelineCalculator._minWidth - paddingLeft;
         this.paddingLeft = paddingLeft;
     },
 
@@ -959,7 +990,7 @@ WebInspector.TimelineRecordGraphRow.prototype = {
         this._barWithChildrenElement.style.left = barPosition.left + "px";
         this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
         this._barElement.style.left = barPosition.left + "px";
-        this._barElement.style.width =  barPosition.width + "px";
+        this._barElement.style.width = barPosition.width + "px";
         this._barCpuElement.style.left = barPosition.left + "px";
         this._barCpuElement.style.width = barPosition.cpuWidth + "px";
         this._expandElement._update(record, index, barPosition.left - expandOffset, barPosition.width);
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
index 3d03a1d93..66a77ac84 100644
--- a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -295,19 +295,6 @@ WebInspector.TimelinePresentationModel.prototype = {
 
     filteredRecords: function()
     {
-        function filter(record)
-        {
-            for (var i = 0; i < this._filters.length; ++i) {
-                if (!this._filters[i].accept(record))
-                    return false;
-            }
-            return true;
-        }
-        return this._filterRecords(filter.bind(this));
-    },
-
-    _filterRecords: function(filter)
-    {
         var recordsInWindow = [];
 
         var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
@@ -318,7 +305,7 @@ WebInspector.TimelinePresentationModel.prototype = {
                  var record = records[entry.index];
                  ++entry.index;
 
-                 if (filter(record)) {
+                 if (this.isVisible(record)) {
                      ++record.parent._invisibleChildrenCount;
                      if (!entry.parentIsCollapsed)
                          recordsInWindow.push(record);
@@ -339,6 +326,15 @@ WebInspector.TimelinePresentationModel.prototype = {
         }
 
         return recordsInWindow;
+    },
+
+    isVisible: function(record)
+    {
+        for (var i = 0; i < this._filters.length; ++i) {
+            if (!this._filters[i].accept(record))
+                return false;
+        }
+        return true;
     }
 }
 
@@ -476,15 +472,16 @@ WebInspector.TimelinePresentationModel.Record.prototype = {
     {
         var contentHelper = new WebInspector.TimelinePresentationModel.PopupContentHelper(this.title);
 
+        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
+            Number.secondsToString(this._startTimeOffset));
+        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
+
         if (this._children && this._children.length) {
             contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
+            contentHelper._appendTextRow(WebInspector.UIString("CPU Time"), Number.secondsToString(this._cpuTime, true));
             contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"),
                 WebInspector.TimelinePresentationModel._generateAggregatedInfo(this._aggregatedStats));
         }
-        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
-            Number.secondsToString(this._startTimeOffset));
-        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
-
         const recordTypes = WebInspector.TimelineModel.RecordType;
 
         switch (this.type) {
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 129c01d97..ba164cfa3 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -396,6 +396,7 @@ WebInspector.doLoadedDone = function()
     WebInspector.WorkerManager.loaded();
 
     DebuggerAgent.causesRecompilation(WebInspector._initializeCapability.bind(WebInspector, "debuggerCausesRecompilation", null));
+    DebuggerAgent.supportsSeparateScriptCompilationAndExecution(WebInspector._initializeCapability.bind(WebInspector, "separateScriptCompilationAndExecutionEnabled", null));
     ProfilerAgent.causesRecompilation(WebInspector._initializeCapability.bind(WebInspector, "profilerCausesRecompilation", null));
     ProfilerAgent.isSampling(WebInspector._initializeCapability.bind(WebInspector, "samplingCPUProfiler", null));
     ProfilerAgent.hasHeapProfiler(WebInspector._initializeCapability.bind(WebInspector, "heapProfilerPresent", null));
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index e33487b1c..4b283acff 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -71,7 +71,7 @@ iframe.view {
 .resources-event-dividers {
     position: absolute;
     left: 0;
-    right: 5px;
+    right: 0;
     height: 100%;
     top: 0;
     z-index: 300;
diff --git a/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css b/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
index 98f8e5ce5..4c42afd9f 100644
--- a/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
+++ b/Source/WebCore/inspector/front-end/nativeMemoryProfiler.css
@@ -49,3 +49,38 @@
 .memory-blocks-list .item {
     margin: 10px;
 }
+
+.memory-bar-chart-name {
+    text-align: right;
+    white-space: nowrap;
+}
+
+.memory-bar-chart-bar {
+    border: 1px solid #bbb;
+    border-radius: 2px;
+    float: left;
+    height: 20px;
+    overflow: hidden;
+    position: relative;
+}
+
+.memory-bar-chart-unused {
+    background-color: rgba(255, 255, 255, 0.5);
+    float: right;
+    height: 100%;
+}
+
+.memory-bar-chart-percent {
+    position: absolute;
+    text-align: center;
+    width: 100%;
+}
+
+.memory-bar-chart-size {
+    text-indent: 6px;
+    white-space: nowrap;
+}
+
+.memory-bar-chart-total {
+    font-weight: bold;
+}
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index 8b037f0a3..a86c4e0c0 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -45,6 +45,10 @@
     bottom: auto;
 }
 
+.timeline .split-view-resizer {
+    top: 20px;
+}
+
 .timeline-sidebar-background {
     top: 90px;
     bottom: 0;
@@ -590,11 +594,7 @@
 
 .timeline-frame-container {
     height: 19px;
-}
-
-.timeline-frame-strip {
-    position: absolute;
-    height: 19px;
+    overflow: hidden;
     background-color: rgb(220, 220, 220);
     opacity: 0.6;
     color: black;
@@ -603,3 +603,17 @@
     z-index: 350;
     pointer-events: auto;
 }
+
+.timeline-frame-strip {
+    position: absolute;
+    height: 19px;
+}
+
+#timeline-grid-header {
+    position: absolute;
+    left: 200px;
+    right: 0;
+    top: 90px;
+    bottom: 0;
+    pointer-events: none;
+}
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 1c22bb4c5..aeb4c696d 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -146,7 +146,8 @@ DocumentThreadableLoader::~DocumentThreadableLoader()
 
 void DocumentThreadableLoader::cancel()
 {
-    if (m_client) {
+    // Cacnel can re-enter and m_resource might be null here as a result.
+    if (m_client && m_resource) {
         ResourceError error(errorDomainWebKitInternal, 0, m_resource->url(), "Load cancelled");
         error.setIsCancellation(true);
         didFail(error);
@@ -163,9 +164,13 @@ void DocumentThreadableLoader::setDefersLoading(bool value)
 
 void DocumentThreadableLoader::clearResource()
 {
-    if (m_resource) {
-        m_resource->removeClient(this);
+    // Script can cancel and restart a request reentrantly within removeClient(),
+    // which could lead to calling CachedResource::removeClient() multiple times for
+    // this DocumentThreadableLoader. Save off a copy of m_resource and clear it to
+    // prevent the reentrancy.
+    if (CachedResourceHandle<CachedRawResource> resource = m_resource) {
         m_resource = 0;
+        resource->removeClient(this);
     }
 }
 
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 38c8c18d1..979a4acd8 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -591,7 +591,7 @@ public:
     virtual void setController(DeviceOrientationController*) { }
     virtual void startUpdating() { }
     virtual void stopUpdating() { }
-    virtual DeviceOrientation* lastOrientation() const { return 0; }
+    virtual DeviceOrientationData* lastOrientation() const { return 0; }
     virtual void deviceOrientationControllerDestroyed() { }
 };
 
diff --git a/Source/WebCore/loader/TextResourceDecoder.cpp b/Source/WebCore/loader/TextResourceDecoder.cpp
index ebf37feb2..4f36a6e48 100644
--- a/Source/WebCore/loader/TextResourceDecoder.cpp
+++ b/Source/WebCore/loader/TextResourceDecoder.cpp
@@ -502,38 +502,6 @@ bool TextResourceDecoder::checkForCSSCharset(const char* data, size_t len, bool&
     return true;
 }
 
-// Other browsers allow comments in the head section, so we need to also.
-// It's important not to look for tags inside the comments.
-static inline void skipComment(const char*& ptr, const char* pEnd)
-{
-    const char* p = ptr;
-    if (p == pEnd)
-        return;
-
-    // Allow <!-->; other browsers do.
-    if (*p == '>') {
-        ptr = p + 1;
-        return;
-    }
-
-    while (p + 2 < pEnd) {
-        if (*p == '-') {
-            // This is the real end of comment, "-->".
-            if (bytesEqual(p + 1, '-', '>')) {
-                p += 3;
-                break;
-            }
-            // This is the incorrect end of comment that other browsers allow, "--!>".
-            if (p + 3 < pEnd && bytesEqual(p + 1, '-', '!', '>')) {
-                p += 4;
-                break;
-            }
-        }
-        p++;
-    }
-    ptr = p;
-}
-
 bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool& movedDataToBuffer)
 {
     if (m_source != DefaultEncoding && m_source != EncodingFromParentFrame) {
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index 2fe78ee7c..fb8bb6068 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -151,7 +151,7 @@ inline Image* CachedImage::lookupOrCreateImageForRenderer(const RenderObject* re
         return 0;
     if (!m_image->isSVGImage())
         return m_image.get();
-    Image* useImage = m_svgImageCache->lookupOrCreateBitmapImageForClient(renderer);
+    Image* useImage = m_svgImageCache->lookupOrCreateBitmapImageForRenderer(renderer);
     if (useImage == Image::nullImage())
         return m_image.get();
     return useImage;
@@ -207,10 +207,7 @@ void CachedImage::setContainerSizeForRenderer(const RenderObject* renderer, cons
         return;
     }
 
-    // FIXME (85335): This needs to take CSS transform scale into account as well.
-    float containerScale = renderer->document()->page()->deviceScaleFactor() * renderer->document()->page()->pageScaleFactor();
-
-    m_svgImageCache->setRequestedSizeAndScales(renderer, SVGImageCache::SizeAndScales(containerSize, containerZoom, containerScale));
+    m_svgImageCache->setRequestedSizeAndScales(renderer, SVGImageCache::SizeAndScales(containerSize, containerZoom));
 #else
     UNUSED_PARAM(renderer);
     UNUSED_PARAM(containerZoom);
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 46eae48f9..dbfb3d783 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -442,10 +442,10 @@ bool DragController::concludeEditDrag(DragData* dragData)
     Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
     if (!element)
         return false;
-    Frame* innerFrame = element->ownerDocument()->frame();
+    RefPtr<Frame> innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
-    if (m_page->dragCaretController()->hasCaret() && !dispatchTextInputEventFor(innerFrame, dragData))
+    if (m_page->dragCaretController()->hasCaret() && !dispatchTextInputEventFor(innerFrame.get(), dragData))
         return true;
 
     if (dragData->containsColor()) {
@@ -490,7 +490,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
     ResourceCacheValidationSuppressor validationSuppressor(cachedResourceLoader);
     if (dragIsMove(innerFrame->selection(), dragData) || dragCaret.isContentRichlyEditable()) {
         bool chosePlainText = false;
-        RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, innerFrame, range, true, chosePlainText);
+        RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, innerFrame.get(), range, true, chosePlainText);
         if (!fragment || !innerFrame->editor()->shouldInsertFragment(fragment, range, EditorInsertActionDropped)) {
             return false;
         }
@@ -503,7 +503,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
             bool smartInsert = smartDelete && innerFrame->selection()->granularity() == WordGranularity && dragData->canSmartReplace();
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
         } else {
-            if (setSelectionToDragCaret(innerFrame, dragCaret, range, point)) {
+            if (setSelectionToDragCaret(innerFrame.get(), dragCaret, range, point)) {
                 ReplaceSelectionCommand::CommandOptions options = ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::PreventNesting;
                 if (dragData->canSmartReplace())
                     options |= ReplaceSelectionCommand::SmartReplace;
@@ -513,13 +513,13 @@ bool DragController::concludeEditDrag(DragData* dragData)
             }
         }
     } else {
-        String text = dragData->asPlainText(innerFrame);
+        String text = dragData->asPlainText(innerFrame.get());
         if (text.isEmpty() || !innerFrame->editor()->shouldInsertText(text, range.get(), EditorInsertActionDropped)) {
             return false;
         }
 
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
-        if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
+        if (setSelectionToDragCaret(innerFrame.get(), dragCaret, range, point))
             applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text),  ReplaceSelectionCommand::SelectReplacement | ReplaceSelectionCommand::MatchStyle | ReplaceSelectionCommand::PreventNesting));
     }
 
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index d1b8c12a3..82f3300da 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -2485,7 +2485,7 @@ bool EventHandler::bestClickableNodeForTouchPoint(const IntPoint& touchCenter, c
     IntPoint hitTestPoint = m_frame->view()->windowToContents(touchCenter);
     HitTestResult result = hitTestResultAtPoint(hitTestPoint, /*allowShadowContent*/ false, /*ignoreClipping*/ false, DontHitTestScrollbars, hitType, touchRadius);
 
-    IntRect touchRect = result.rectForPoint(touchCenter);
+    IntRect touchRect(touchCenter - touchRadius, touchRadius + touchRadius);
     RefPtr<StaticHashSetNodeList> nodeList = StaticHashSetNodeList::adopt(result.rectBasedTestResult());
     return findBestClickableCandidate(targetNode, targetPoint, touchCenter, touchRect, *nodeList.get());
 }
@@ -2496,7 +2496,7 @@ bool EventHandler::bestZoomableAreaForTouchPoint(const IntPoint& touchCenter, co
     IntPoint hitTestPoint = m_frame->view()->windowToContents(touchCenter);
     HitTestResult result = hitTestResultAtPoint(hitTestPoint, /*allowShadowContent*/ false, /*ignoreClipping*/ false, DontHitTestScrollbars, hitType, touchRadius);
 
-    IntRect touchRect = result.rectForPoint(touchCenter);
+    IntRect touchRect(touchCenter - touchRadius, touchRadius + touchRadius);
     RefPtr<StaticHashSetNodeList> nodeList = StaticHashSetNodeList::adopt(result.rectBasedTestResult());
     return findBestZoomableArea(targetNode, targetArea, touchCenter, touchRect, *nodeList.get());
 }
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 91d31e3bf..ea57bb4f1 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -1089,9 +1089,16 @@ DragImageRef Frame::nodeImage(Node* node)
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
+    float deviceScaleFactor = 1;
+    if (m_page)
+        deviceScaleFactor = m_page->deviceScaleFactor();
+    paintingRect.setWidth(paintingRect.width() * deviceScaleFactor);
+    paintingRect.setHeight(paintingRect.height() * deviceScaleFactor);
+
     OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
+    buffer->context()->scale(FloatSize(deviceScaleFactor, deviceScaleFactor));
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
     buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
@@ -1112,9 +1119,16 @@ DragImageRef Frame::dragImageForSelection()
 
     IntRect paintingRect = enclosingIntRect(selection()->bounds());
 
+    float deviceScaleFactor = 1;
+    if (m_page)
+        deviceScaleFactor = m_page->deviceScaleFactor();
+    paintingRect.setWidth(paintingRect.width() * deviceScaleFactor);
+    paintingRect.setHeight(paintingRect.height() * deviceScaleFactor);
+
     OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
+    buffer->context()->scale(FloatSize(deviceScaleFactor, deviceScaleFactor));
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
     buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 3af6f07e9..1af15be49 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -115,8 +115,8 @@ bool Navigator::cookieEnabled() const
 {
     if (!m_frame)
         return false;
-        
-    if (m_frame->page() && !m_frame->page()->cookieEnabled())
+
+    if (m_frame->page() && !m_frame->page()->settings()->cookieEnabled())
         return false;
 
     return cookiesEnabled(m_frame->document());
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index b0c2be5df..e618036d2 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -237,9 +237,6 @@ namespace WebCore {
         bool inLowQualityImageInterpolationMode() const;
         void setInLowQualityImageInterpolationMode(bool = true);
 
-        bool cookieEnabled() const { return m_cookieEnabled; }
-        void setCookieEnabled(bool enabled) { m_cookieEnabled = enabled; }
-
         float mediaVolume() const { return m_mediaVolume; }
         void setMediaVolume(float volume);
 
diff --git a/Source/WebCore/page/Performance.cpp b/Source/WebCore/page/Performance.cpp
index 5bf23b6de..903393021 100644
--- a/Source/WebCore/page/Performance.cpp
+++ b/Source/WebCore/page/Performance.cpp
@@ -34,8 +34,11 @@
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "MemoryInfo.h"
+#include "PerformanceEntry.h"
 #include "PerformanceNavigation.h"
+#include "PerformanceResourceTiming.h"
 #include "PerformanceTiming.h"
+#include "ResourceResponse.h"
 #include <wtf/CurrentTime.h>
 
 #if ENABLE(WEB_TIMING)
@@ -49,6 +52,22 @@ Performance::Performance(Frame* frame)
 {
 }
 
+Performance::~Performance()
+{
+}
+
+const AtomicString& Performance::interfaceName() const
+{
+    return eventNames().interfaceForPerformance;
+}
+
+ScriptExecutionContext* Performance::scriptExecutionContext() const
+{
+    if (!frame())
+        return 0;
+    return frame()->document();
+}
+
 PassRefPtr<MemoryInfo> Performance::memory() const
 {
     return MemoryInfo::create(m_frame);
@@ -75,23 +94,77 @@ PerformanceTiming* Performance::timing() const
 PassRefPtr<PerformanceEntryList> Performance::webkitGetEntries() const
 {
     RefPtr<PerformanceEntryList> entries = PerformanceEntryList::create();
+
+#if ENABLE(RESOURCE_TIMING)
+    entries->appendAll(m_resourceTimingBuffer);
+#endif // ENABLE(RESOURCE_TIMING)
+
     return entries;
 }
 
-PassRefPtr<PerformanceEntryList> Performance::webkitGetEntriesByType(const String&)
+PassRefPtr<PerformanceEntryList> Performance::webkitGetEntriesByType(const String& entryType)
 {
     RefPtr<PerformanceEntryList> entries = PerformanceEntryList::create();
+
+#if ENABLE(RESOURCE_TIMING)
+    if (equalIgnoringCase(entryType, "resource"))
+        for (Vector<RefPtr<PerformanceEntry> >::const_iterator resource = m_resourceTimingBuffer.begin(); resource != m_resourceTimingBuffer.end(); ++resource)
+            entries->append(*resource);
+#endif // ENABLE(RESOURCE_TIMING)
+
     return entries;
 }
 
-PassRefPtr<PerformanceEntryList> Performance::webkitGetEntriesByName(const String&, const String&)
+PassRefPtr<PerformanceEntryList> Performance::webkitGetEntriesByName(const String& name, const String& entryType)
 {
     RefPtr<PerformanceEntryList> entries = PerformanceEntryList::create();
+
+#if ENABLE(RESOURCE_TIMING)
+    if (entryType.isNull() || equalIgnoringCase(entryType, "resource"))
+        for (Vector<RefPtr<PerformanceEntry> >::const_iterator resource = m_resourceTimingBuffer.begin(); resource != m_resourceTimingBuffer.end(); ++resource)
+            if ((*resource)->name() == name)
+                entries->append(*resource);
+#endif // ENABLE(RESOURCE_TIMING)
+
     return entries;
 }
 
 #endif // ENABLE(PERFORMANCE_TIMELINE)
 
+#if ENABLE(RESOURCE_TIMING)
+
+void Performance::webkitClearResourceTimings()
+{
+    m_resourceTimingBuffer.clear();
+}
+
+void Performance::webkitSetResourceTimingBufferSize(unsigned int)
+{
+    // FIXME: Implement this.
+}
+
+void Performance::addResourceTiming(const ResourceRequest& request, const ResourceResponse& response, double finishTime, Document* requestingDocument)
+{
+    if (!response.resourceLoadTiming())
+        return;
+
+    RefPtr<PerformanceEntry> entry = PerformanceResourceTiming::create(request, response, finishTime, requestingDocument);
+    // FIXME: Need to enforce buffer limits.
+    m_resourceTimingBuffer.append(entry);
+}
+
+#endif // ENABLE(RESOURCE_TIMING)
+
+EventTargetData* Performance::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* Performance::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
 double Performance::webkitNow() const
 {
     return 1000.0 * m_frame->document()->loader()->timing()->convertMonotonicTimeToZeroBasedDocumentTime(monotonicallyIncreasingTime());
diff --git a/Source/WebCore/page/Performance.h b/Source/WebCore/page/Performance.h
index aa4c79282..deae0aec0 100644
--- a/Source/WebCore/page/Performance.h
+++ b/Source/WebCore/page/Performance.h
@@ -34,6 +34,7 @@
 #if ENABLE(WEB_TIMING)
 
 #include "DOMWindowProperty.h"
+#include "EventTarget.h"
 #include "MemoryInfo.h"
 #include "PerformanceEntryList.h"
 #include "PerformanceNavigation.h"
@@ -45,9 +46,17 @@
 
 namespace WebCore {
 
-class Performance : public RefCounted<Performance>, public DOMWindowProperty {
+class Document;
+class ResourceRequest;
+class ResourceResponse;
+
+class Performance : public RefCounted<Performance>, public DOMWindowProperty, public EventTarget {
 public:
     static PassRefPtr<Performance> create(Frame* frame) { return adoptRef(new Performance(frame)); }
+    ~Performance();
+
+    virtual const AtomicString& interfaceName() const;
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
 
     PassRefPtr<MemoryInfo> memory() const;
     PerformanceNavigation* navigation() const;
@@ -60,11 +69,35 @@ public:
     PassRefPtr<PerformanceEntryList> webkitGetEntriesByName(const String& name, const String& entryType);
 #endif
 
+#if ENABLE(RESOURCE_TIMING)
+    void webkitClearResourceTimings();
+    void webkitSetResourceTimingBufferSize(unsigned int);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitresourcetimingbufferfull);
+
+    void addResourceTiming(const ResourceRequest&, const ResourceResponse&, double finishTime, Document*);
+#endif
+
+    using RefCounted<Performance>::ref;
+    using RefCounted<Performance>::deref;
+
 private:
     explicit Performance(Frame*);
 
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+
+    EventTargetData m_eventTargetData;
+    ScriptExecutionContext *m_scriptExecutionContext;
+
     mutable RefPtr<PerformanceNavigation> m_navigation;
     mutable RefPtr<PerformanceTiming> m_timing;
+
+#if ENABLE(RESOURCE_TIMING)
+    Vector<RefPtr<PerformanceEntry> > m_resourceTimingBuffer;
+#endif
 };
 
 }
diff --git a/Source/WebCore/page/Performance.idl b/Source/WebCore/page/Performance.idl
index 663b74247..fc9ffdf1f 100644
--- a/Source/WebCore/page/Performance.idl
+++ b/Source/WebCore/page/Performance.idl
@@ -33,6 +33,7 @@ module window {
     // See: http://dev.w3.org/2006/webapi/WebTiming/
     interface [
         Conditional=WEB_TIMING,
+        EventTarget,
         OmitConstructor
     ] Performance {
         readonly attribute PerformanceNavigation navigation;
@@ -44,6 +45,13 @@ module window {
         PerformanceEntryList webkitGetEntriesByType(in DOMString entryType);
         PerformanceEntryList webkitGetEntriesByName(in DOMString name, in [Optional=DefaultIsNullString] DOMString entryType);
 #endif
+
+#if defined(ENABLE_RESOURCE_TIMING) && ENABLE_RESOURCE_TIMING
+        void webkitClearResourceTimings();
+        void webkitSetResourceTimingBufferSize(in unsigned long maxSize);
+
+        attribute EventListener onwebkitresourcetimingbufferfull;
+#endif
         // See http://www.w3.org/TR/hr-time/ for details.
         double webkitNow();
     };
diff --git a/Source/WebCore/page/PerformanceEntry.cpp b/Source/WebCore/page/PerformanceEntry.cpp
index ac523c6dc..ad6954700 100644
--- a/Source/WebCore/page/PerformanceEntry.cpp
+++ b/Source/WebCore/page/PerformanceEntry.cpp
@@ -43,6 +43,10 @@ PerformanceEntry::PerformanceEntry(const String& name, const String& entryType,
 {
 }
 
+PerformanceEntry::~PerformanceEntry()
+{
+}
+
 String PerformanceEntry::name() const
 {
     return m_name;
diff --git a/Source/WebCore/page/PerformanceEntry.h b/Source/WebCore/page/PerformanceEntry.h
index 8666e431d..6d9672197 100644
--- a/Source/WebCore/page/PerformanceEntry.h
+++ b/Source/WebCore/page/PerformanceEntry.h
@@ -42,11 +42,15 @@ namespace WebCore {
 
 class PerformanceEntry : public RefCounted<PerformanceEntry> {
 public:
+    virtual ~PerformanceEntry();
+
     String name() const;
     String entryType() const;
     double startTime() const;
     double duration() const;
 
+    virtual bool isResource() { return false; }
+
 protected:
     PerformanceEntry(const String& name, const String& entryType, double startTime, double duration);
 
diff --git a/Source/WebCore/page/PerformanceEntry.idl b/Source/WebCore/page/PerformanceEntry.idl
index a788bd9c6..9e10fe0bf 100644
--- a/Source/WebCore/page/PerformanceEntry.idl
+++ b/Source/WebCore/page/PerformanceEntry.idl
@@ -34,6 +34,7 @@ module window {
     interface [
         Conditional=WEB_TIMING,
         Conditional=PERFORMANCE_TIMELINE,
+        CustomToJSObject,
         OmitConstructor
     ] PerformanceEntry {
         readonly attribute DOMString name;
diff --git a/Source/WebCore/page/PerformanceEntryList.cpp b/Source/WebCore/page/PerformanceEntryList.cpp
index a4e09a319..9f273bc44 100644
--- a/Source/WebCore/page/PerformanceEntryList.cpp
+++ b/Source/WebCore/page/PerformanceEntryList.cpp
@@ -62,6 +62,11 @@ void PerformanceEntryList::append(PassRefPtr<PerformanceEntry> entry)
     m_entries.append(entry);
 }
 
+void PerformanceEntryList::appendAll(const Vector<RefPtr<PerformanceEntry> >& entries)
+{
+    m_entries.append(entries);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_TIMING) && ENABLE(PERFORMANCE_TIMELINE)
diff --git a/Source/WebCore/page/PerformanceEntryList.h b/Source/WebCore/page/PerformanceEntryList.h
index 0ecf9ba3b..8f76267e1 100644
--- a/Source/WebCore/page/PerformanceEntryList.h
+++ b/Source/WebCore/page/PerformanceEntryList.h
@@ -51,6 +51,7 @@ public:
     PerformanceEntry* item(unsigned index);
 
     void append(PassRefPtr<PerformanceEntry>);
+    void appendAll(const Vector<RefPtr<PerformanceEntry> >&);
 
 private:
     PerformanceEntryList();
diff --git a/Source/WebCore/page/PerformanceResourceTiming.cpp b/Source/WebCore/page/PerformanceResourceTiming.cpp
new file mode 100644
index 000000000..0976add78
--- /dev/null
+++ b/Source/WebCore/page/PerformanceResourceTiming.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PerformanceResourceTiming.h"
+
+#if ENABLE(RESOURCE_TIMING)
+
+#include "Document.h"
+#include "DocumentLoadTiming.h"
+#include "DocumentLoader.h"
+#include "KURL.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "SecurityOrigin.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+PerformanceResourceTiming::PerformanceResourceTiming(const ResourceRequest& request, const ResourceResponse& response, double finishTime, Document* requestingDocument)
+    : PerformanceEntry(request.url().string(), "resource", response.resourceLoadTiming()->requestTime, finishTime)
+    , m_timing(response.resourceLoadTiming())
+    , m_finishTime(finishTime)
+    , m_requestingDocument(requestingDocument)
+{
+}
+
+PerformanceResourceTiming::~PerformanceResourceTiming()
+{
+}
+
+String PerformanceResourceTiming::initiatorType() const
+{
+    // FIXME: This should be decided by the resource type.
+    return "other";
+}
+
+// FIXME: Need to enforce same-origin policy on these.
+
+double PerformanceResourceTiming::redirectStart() const
+{
+    // FIXME: Need to track and report redirects for resources.
+    return 0;
+}
+
+double PerformanceResourceTiming::redirectEnd() const
+{
+    return 0;
+}
+
+double PerformanceResourceTiming::fetchStart() const
+{
+    return monotonicTimeToDocumentMilliseconds(m_timing->requestTime);
+}
+
+double PerformanceResourceTiming::domainLookupStart() const
+{
+    if (m_timing->dnsStart < 0)
+        return fetchStart();
+
+    return resourceTimeToDocumentMilliseconds(m_timing->dnsStart);
+}
+
+double PerformanceResourceTiming::domainLookupEnd() const
+{
+    if (m_timing->dnsEnd < 0)
+        return domainLookupStart();
+
+    return resourceTimeToDocumentMilliseconds(m_timing->dnsEnd);
+}
+
+double PerformanceResourceTiming::connectStart() const
+{
+    if (m_timing->connectStart < 0) // Connection was reused.
+        return domainLookupEnd();
+
+    // connectStart includes any DNS time, so we may need to trim that off.
+    int connectStart = m_timing->connectStart;
+    if (m_timing->dnsEnd >= 0)
+        connectStart = m_timing->dnsEnd;
+
+    return resourceTimeToDocumentMilliseconds(connectStart);
+}
+
+double PerformanceResourceTiming::connectEnd() const
+{
+    if (m_timing->connectEnd < 0) // Connection was reused.
+        return connectStart();
+
+    return resourceTimeToDocumentMilliseconds(m_timing->connectEnd);
+}
+
+double PerformanceResourceTiming::secureConnectionStart() const
+{
+    if (m_timing->sslStart < 0) // Secure connection not negotiated.
+        return 0;
+
+    return resourceTimeToDocumentMilliseconds(m_timing->sslStart);
+}
+
+double PerformanceResourceTiming::requestStart() const
+{
+    return resourceTimeToDocumentMilliseconds(m_timing->sendStart);
+}
+
+double PerformanceResourceTiming::responseStart() const
+{
+    // FIXME: This number isn't exactly correct. See the notes in PerformanceTiming::responseStart().
+    return resourceTimeToDocumentMilliseconds(m_timing->receiveHeadersEnd);
+}
+
+double PerformanceResourceTiming::responseEnd() const
+{
+    return monotonicTimeToDocumentMilliseconds(m_finishTime);
+}
+
+double PerformanceResourceTiming::monotonicTimeToDocumentMilliseconds(double seconds) const
+{
+    ASSERT(seconds >= 0.0);
+    return m_requestingDocument->loader()->timing()->convertMonotonicTimeToDocumentTime(seconds) * 1000.0;
+}
+
+double PerformanceResourceTiming::resourceTimeToDocumentMilliseconds(int deltaMilliseconds) const
+{
+    return monotonicTimeToDocumentMilliseconds(m_timing->requestTime) + deltaMilliseconds;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(RESOURCE_TIMING)
diff --git a/Source/WebCore/page/PerformanceResourceTiming.h b/Source/WebCore/page/PerformanceResourceTiming.h
new file mode 100644
index 000000000..082b89251
--- /dev/null
+++ b/Source/WebCore/page/PerformanceResourceTiming.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PerformanceResourceTiming_h
+#define PerformanceResourceTiming_h
+
+#if ENABLE(RESOURCE_TIMING)
+
+#include "PerformanceEntry.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Document;
+class KURL;
+class ResourceLoadTiming;
+class ResourceRequest;
+class ResourceResponse;
+
+class PerformanceResourceTiming : public PerformanceEntry {
+public:
+    static PassRefPtr<PerformanceResourceTiming> create(const ResourceRequest& request, const ResourceResponse& response, double finishTime, Document* requestingDocument)
+    {
+        return adoptRef(new PerformanceResourceTiming(request, response, finishTime, requestingDocument));
+    }
+
+    String initiatorType() const;
+
+    double redirectStart() const;
+    double redirectEnd() const;
+    double fetchStart() const;
+    double domainLookupStart() const;
+    double domainLookupEnd() const;
+    double connectStart() const;
+    double connectEnd() const;
+    double secureConnectionStart() const;
+    double requestStart() const;
+    double responseStart() const;
+    double responseEnd() const;
+
+    virtual bool isResource() { return true; }
+
+private:
+    PerformanceResourceTiming(const ResourceRequest&, const ResourceResponse&, double finishTime, Document*);
+    ~PerformanceResourceTiming();
+
+    double monotonicTimeToDocumentMilliseconds(double seconds) const;
+    double resourceTimeToDocumentMilliseconds(int deltaMilliseconds) const;
+
+    RefPtr<ResourceLoadTiming> m_timing;
+    double m_finishTime;
+    RefPtr<Document> m_requestingDocument;
+};
+
+}
+
+#endif // ENABLE(RESOURCE_TIMING)
+
+#endif // !defined(PerformanceResourceTiming_h)
diff --git a/Source/WebCore/page/PerformanceResourceTiming.idl b/Source/WebCore/page/PerformanceResourceTiming.idl
new file mode 100644
index 000000000..3e0ad59ce
--- /dev/null
+++ b/Source/WebCore/page/PerformanceResourceTiming.idl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    // See: https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/ResourceTiming/Overview.html
+    interface [
+        Conditional=RESOURCE_TIMING,
+        OmitConstructor
+    ] PerformanceResourceTiming : PerformanceEntry {
+        readonly attribute DOMString initiatorType;
+
+        readonly attribute double redirectStart;
+        readonly attribute double redirectEnd;
+        readonly attribute double fetchStart;
+        readonly attribute double domainLookupStart;
+        readonly attribute double domainLookupEnd;
+        readonly attribute double connectStart;
+        readonly attribute double connectEnd;
+        readonly attribute double secureConnectionStart;
+        readonly attribute double requestStart;
+        readonly attribute double responseStart;
+        readonly attribute double responseEnd;
+    };
+}
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index bc95c4ebd..91b41c09b 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -368,6 +368,9 @@ static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 
 bool SecurityOrigin::canDisplay(const KURL& url) const
 {
+    if (m_universalAccess)
+        return true;
+
     String protocol = url.protocol().lower();
 
     if (isFeedWithNestedProtocolInHTTPFamily(url))
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index d939b2c38..edd3d7931 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -270,6 +270,7 @@ Settings::Settings(Page* page)
     , m_needsDidFinishLoadOrderQuirk(false)
     , m_fixedPositionCreatesStackingContext(false)
     , m_syncXHRInDocumentsEnabled(true)
+    , m_cookieEnabled(true)
     , m_windowFocusRestricted(true)
     , m_loadsImagesAutomaticallyTimer(this, &Settings::loadsImagesAutomaticallyTimerFired)
     , m_incrementalRenderingSuppressionTimeoutInSeconds(defaultIncrementalRenderingSuppressionTimeoutInSeconds)
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index a017d8fe2..158d240ab 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Settings_h
@@ -331,6 +331,14 @@ namespace WebCore {
         bool cssRegionsEnabled() const { return false; }
 #endif
 
+#if ENABLE(CSS_VARIABLES)
+        void setCSSVariablesEnabled(bool enabled) { m_cssVariablesEnabled = enabled; }
+        bool cssVariablesEnabled() const { return true; }
+#else
+        void setCSSVariablesEnabled(bool) { }
+        bool cssVariablesEnabled() const { return false; }
+#endif
+
         void setRegionBasedColumnsEnabled(bool enabled) { m_regionBasedColumnsEnabled = enabled; }
         bool regionBasedColumnsEnabled() const { return m_regionBasedColumnsEnabled; }
 
@@ -586,6 +594,9 @@ namespace WebCore {
         static bool shouldRespectPriorityInCSSAttributeSetters();
 #endif
 
+        void setCookieEnabled(bool enabled) { m_cookieEnabled = enabled; }
+        bool cookieEnabled() const { return m_cookieEnabled; }
+
     private:
         Settings(Page*);
 
@@ -674,6 +685,9 @@ namespace WebCore {
 #if ENABLE(CSS_REGIONS)
         bool m_cssRegionsEnabled : 1;
 #endif
+#if ENABLE(CSS_VARIABLES)
+        bool m_cssVariablesEnabled : 1;
+#endif
         bool m_regionBasedColumnsEnabled : 1;
         bool m_cssGridLayoutEnabled : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
@@ -750,6 +764,7 @@ namespace WebCore {
 
         bool m_fixedPositionCreatesStackingContext : 1;
         bool m_syncXHRInDocumentsEnabled : 1;
+        bool m_cookieEnabled : 1;
 
         bool m_windowFocusRestricted : 1;
 
diff --git a/Source/WebCore/page/SpatialNavigation.cpp b/Source/WebCore/page/SpatialNavigation.cpp
index 6dcb814a3..4150b64f3 100644
--- a/Source/WebCore/page/SpatialNavigation.cpp
+++ b/Source/WebCore/page/SpatialNavigation.cpp
@@ -399,7 +399,7 @@ bool scrollInDirection(Node* container, FocusDirection direction)
             return false;
         }
 
-        container->renderBox()->enclosingLayer()->scrollByRecursively(dx, dy);
+        container->renderBox()->enclosingLayer()->scrollByRecursively(IntSize(dx, dy));
         return true;
     }
 
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 9be00e92d..1a766370d 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -86,7 +86,7 @@ public:
 
     bool operator==(const CalculationValue& o) const 
     { 
-        return m_value == o.m_value || *(m_value.get()) == *(o.m_value.get());
+        return *(m_value.get()) == *(o.m_value.get());
     }
     
 private:
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 6d7e05ed9..b3c259a97 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -74,10 +74,10 @@ typedef struct _GModule GModule;
 namespace WebCore {
 
 // PlatformModule
-#if PLATFORM(GTK)
-typedef GModule* PlatformModule;
-#elif OS(WINDOWS)
+#if OS(WINDOWS)
 typedef HMODULE PlatformModule;
+#elif PLATFORM(GTK)
+typedef GModule* PlatformModule;
 #elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
 typedef CFBundleRef PlatformModule;
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index d19471e68..1815130a9 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -34,8 +34,15 @@
 
 namespace WebCore {
 
-enum LengthType { Auto, Relative, Percent, Fixed, Intrinsic, MinIntrinsic, Calculated, ViewportPercentageWidth, ViewportPercentageHeight, ViewportPercentageMin, Undefined };
- 
+enum LengthType {
+    Auto, Relative, Percent, Fixed,
+    Intrinsic, MinIntrinsic,
+    MinContent, MaxContent, FillAvailable, FitContent,
+    Calculated,
+    ViewportPercentageWidth, ViewportPercentageHeight, ViewportPercentageMin,
+    Undefined
+};
+
 class CalculationValue;    
     
 struct Length {
@@ -213,7 +220,9 @@ public:
     bool isRelative() const { return type() == Relative; }
     bool isPercent() const { return type() == Percent || type() == Calculated; }
     bool isFixed() const { return type() == Fixed; }
-    bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
+    bool isIntrinsicOrAuto() const { return type() == Auto || isLegacyIntrinsic() || isIntrinsic(); }
+    bool isLegacyIntrinsic() const { return type() == Intrinsic || type() == MinIntrinsic; }
+    bool isIntrinsic() const { return type() == MinContent || type() == MaxContent || type() == FillAvailable || type() == FitContent; }
     bool isSpecified() const { return type() == Fixed || type() == Percent || type() == Calculated || isViewportPercentage(); }
     bool isCalculated() const { return type() == Calculated; }
     bool isCalculatedEqual(const Length&) const;
diff --git a/Source/WebCore/platform/PlatformExportMacros.h b/Source/WebCore/platform/PlatformExportMacros.h
index ae3e30a3a..6c70813ad 100644
--- a/Source/WebCore/platform/PlatformExportMacros.h
+++ b/Source/WebCore/platform/PlatformExportMacros.h
@@ -35,8 +35,7 @@
 // See note in wtf/Platform.h for more info on EXPORT_MACROS.
 #if USE(EXPORT_MACROS)
 
-#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit) || \
-    defined(STATICALLY_LINKED_WITH_WebCore) || defined(STATICALLY_LINKED_WITH_WebKit)
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
 #define WEBKIT_EXPORTDATA WTF_EXPORT
 #else
 #define WEBKIT_EXPORTDATA WTF_IMPORT
@@ -46,8 +45,7 @@
 
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 
-#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit) || \
-    defined(STATICALLY_LINKED_WITH_WebCore) || defined(STATICALLY_LINKED_WITH_WebKit)
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
 #define WEBKIT_EXPORTDATA __declspec(dllexport)
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
diff --git a/Source/WebCore/platform/RunLoop.cpp b/Source/WebCore/platform/RunLoop.cpp
index cbbca4c61..78030af76 100644
--- a/Source/WebCore/platform/RunLoop.cpp
+++ b/Source/WebCore/platform/RunLoop.cpp
@@ -57,14 +57,50 @@ RunLoop* RunLoop::main()
 
 void RunLoop::performWork()
 {
-    Vector<Function<void()> > functionQueue;
+    // It is important to handle the functions in the queue one at a time because while inside one of these
+    // functions we might re-enter RunLoop::performWork() and we need to be able to pick up where we left off.
+    // See http://webkit.org/b/89590 for more discussion.
+
+    // One possible scenario when handling the function queue is as follows:
+    // - RunLoop::performWork() is invoked with 1 function on the queue
+    // - Handling that function results in 1 more function being enqueued
+    // - Handling that one results in yet another being enqueued
+    // - And so on
+    //
+    // In this situation one invocation of performWork() never returns so all other event sources are blocked.
+    // By only handling up to the number of functions that were in the queue when performWork() is called
+    // we guarantee to occasionally return from the run loop so other event sources will be allowed to spin.
+
+    Function<void()> function;
+    size_t functionsToHandle = 0;
+
     {
         MutexLocker locker(m_functionQueueLock);
-        m_functionQueue.swap(functionQueue);
+        functionsToHandle = m_functionQueue.size();
+
+        if (m_functionQueue.isEmpty())
+            return;
+
+        function = m_functionQueue.takeFirst();
     }
 
-    for (size_t i = 0; i < functionQueue.size(); ++i)
-        functionQueue[i]();
+    function();
+
+    for (size_t functionsHandled = 1; functionsHandled < functionsToHandle; ++functionsHandled) {
+        {
+            MutexLocker locker(m_functionQueueLock);
+
+            // Even if we start off with N functions to handle and we've only handled less than N functions, the queue
+            // still might be empty because those functions might have been handled in an inner RunLoop::performWork().
+            // In that case we should bail here.
+            if (m_functionQueue.isEmpty())
+                break;
+
+            function = m_functionQueue.takeFirst();
+        }
+        
+        function();
+    }
 }
 
 void RunLoop::dispatch(const Function<void()>& function)
diff --git a/Source/WebCore/platform/RunLoop.h b/Source/WebCore/platform/RunLoop.h
index 40b41949c..35f33e9e0 100644
--- a/Source/WebCore/platform/RunLoop.h
+++ b/Source/WebCore/platform/RunLoop.h
@@ -28,12 +28,12 @@
 #ifndef RunLoop_h
 #define RunLoop_h
 
+#include <wtf/Deque.h>
 #include <wtf/Forward.h>
 #include <wtf/Functional.h>
 #include <wtf/HashMap.h>
 #include <wtf/ThreadSpecific.h>
 #include <wtf/Threading.h>
-#include <wtf/Vector.h>
 
 #if PLATFORM(GTK)
 #include <wtf/gobject/GRefPtr.h>
@@ -58,6 +58,7 @@ public:
 
     static void run();
     void stop();
+    void wakeUp();
 
 #if PLATFORM(MAC)
     void runForDuration(double duration);
@@ -132,10 +133,9 @@ private:
     ~RunLoop();
 
     void performWork();
-    void wakeUp();
 
     Mutex m_functionQueueLock;
-    Vector<Function<void()> > m_functionQueue;
+    Deque<Function<void()> > m_functionQueue;
 
 #if PLATFORM(WIN)
     static bool registerRunLoopMessageWindowClass();
diff --git a/Source/WebCore/platform/TreeShared.h b/Source/WebCore/platform/TreeShared.h
index 2ebdb1d1c..6c4154ede 100644
--- a/Source/WebCore/platform/TreeShared.h
+++ b/Source/WebCore/platform/TreeShared.h
@@ -111,6 +111,12 @@ public:
     bool m_inRemovedLastRefFunction;
 #endif
 
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+        memoryObjectInfo->reportInstrumentedPointer(m_parent);
+    }
+
 private:
 #ifndef NDEBUG
     friend void adopted<>(TreeShared<NodeType, ParentNodeType>*);
diff --git a/Source/WebCore/platform/chromium/ClipboardUtilitiesChromium.cpp b/Source/WebCore/platform/chromium/ClipboardUtilitiesChromium.cpp
index f00c80ab9..e2ec9f15e 100644
--- a/Source/WebCore/platform/chromium/ClipboardUtilitiesChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardUtilitiesChromium.cpp
@@ -36,6 +36,7 @@
 #include "PlatformString.h"
 
 #include <public/WebClipboard.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -50,19 +51,14 @@ WebKit::WebClipboard::Buffer currentPasteboardBuffer()
 void replaceNewlinesWithWindowsStyleNewlines(String& str)
 {
     DEFINE_STATIC_LOCAL(String, windowsNewline, ("\r\n"));
-    const static unsigned windowsNewlineLength = windowsNewline.length();
-
-    unsigned index = 0;
-    unsigned strLength = str.length();
-    while (index < strLength) {
-        if (str[index] != '\n' || (index > 0 && str[index - 1] == '\r')) {
-            ++index;
-            continue;
-        }
-        str.replace(index, 1, windowsNewline);
-        strLength = str.length();
-        index += windowsNewlineLength;
+    StringBuilder result;
+    for (unsigned index = 0; index < str.length(); ++index) {
+        if (str[index] != '\n' || (index > 0 && str[index - 1] == '\r'))
+            result.append(str[index]);
+        else
+            result.append(windowsNewline);
     }
+    str = result.toString();
 }
 #endif
 
diff --git a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
index a64a77efa..5cdd4ba6b 100644
--- a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
+++ b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
@@ -201,4 +201,9 @@ void Extensions3DChromium::getQueryObjectuivEXT(Platform3DObject query, GC3Denum
     m_private->webContext()->getQueryObjectuivEXT(query, pname, params);
 }
 
+void Extensions3DChromium::copyTextureCHROMIUM(GC3Denum target, Platform3DObject sourceId, Platform3DObject destId, GC3Dint level, GC3Denum internalFormat)
+{
+    m_private->webContext()->copyTextureCHROMIUM(target, sourceId, destId, level, internalFormat);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/support/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/chromium/support/GraphicsContext3DPrivate.cpp
index 71c77343e..1cf6f5cd5 100644
--- a/Source/WebCore/platform/chromium/support/GraphicsContext3DPrivate.cpp
+++ b/Source/WebCore/platform/chromium/support/GraphicsContext3DPrivate.cpp
@@ -44,7 +44,7 @@
 namespace {
 
 // The limit of the number of textures we hold in the GrContext's bitmap->texture cache.
-const int maxGaneshTextureCacheCount = 512;
+const int maxGaneshTextureCacheCount = 2048;
 // The limit of the bytes allocated toward textures in the GrContext's bitmap->texture cache.
 const size_t maxGaneshTextureCacheBytes = 96 * 1024 * 1024;
 
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
index 65c7b4968..051553cec 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "EflKeyboardUtilities.h"
 
+#include "KeyboardEvent.h"
 #include "WindowsKeyboardCodes.h"
 #include <wtf/HashMap.h>
 #include <wtf/text/StringHash.h>
@@ -37,6 +38,7 @@ namespace WebCore {
 
 typedef HashMap<String, String> KeyMap;
 typedef HashMap<String, int> WindowsKeyMap;
+typedef HashMap<int, const char*> KeyCommandMap;
 
 static KeyMap& keyMap()
 {
@@ -50,6 +52,18 @@ static WindowsKeyMap& windowsKeyMap()
     return windowsKeyMap;
 }
 
+static KeyCommandMap& keyDownCommandsMap()
+{
+    DEFINE_STATIC_LOCAL(KeyCommandMap, keyDownCommandsMap, ());
+    return keyDownCommandsMap;
+}
+
+static KeyCommandMap& keyPressCommandsMap()
+{
+    DEFINE_STATIC_LOCAL(KeyCommandMap, keyPressCommandsMap, ());
+    return keyPressCommandsMap;
+}
+
 static inline void addCharactersToKeyMap(const char from, const char to)
 {
     for (char c = from; c <= to; c++)
@@ -204,6 +218,89 @@ static void createWindowsKeyMap()
     }
 }
 
+static const unsigned CtrlKey = 1 << 0;
+static const unsigned AltKey = 1 << 1;
+static const unsigned ShiftKey = 1 << 2;
+
+struct KeyDownEntry {
+    unsigned virtualKey;
+    unsigned modifiers;
+    const char* name;
+};
+
+struct KeyPressEntry {
+    unsigned charCode;
+    unsigned modifiers;
+    const char* name;
+};
+
+static const KeyDownEntry keyDownEntries[] = {
+    { VK_LEFT,   0,                  "MoveLeft"                                    },
+    { VK_LEFT,   ShiftKey,           "MoveLeftAndModifySelection"                  },
+    { VK_LEFT,   CtrlKey,            "MoveWordLeft"                                },
+    { VK_LEFT,   CtrlKey | ShiftKey, "MoveWordLeftAndModifySelection"              },
+    { VK_RIGHT,  0,                  "MoveRight"                                   },
+    { VK_RIGHT,  ShiftKey,           "MoveRightAndModifySelection"                 },
+    { VK_RIGHT,  CtrlKey,            "MoveWordRight"                               },
+    { VK_RIGHT,  CtrlKey | ShiftKey, "MoveWordRightAndModifySelection"             },
+    { VK_UP,     0,                  "MoveUp"                                      },
+    { VK_UP,     ShiftKey,           "MoveUpAndModifySelection"                    },
+    { VK_PRIOR,  ShiftKey,           "MovePageUpAndModifySelection"                },
+    { VK_DOWN,   0,                  "MoveDown"                                    },
+    { VK_DOWN,   ShiftKey,           "MoveDownAndModifySelection"                  },
+    { VK_NEXT,   ShiftKey,           "MovePageDownAndModifySelection"              },
+    { VK_PRIOR,  0,                  "MovePageUp"                                  },
+    { VK_NEXT,   0,                  "MovePageDown"                                },
+    { VK_HOME,   0,                  "MoveToBeginningOfLine"                       },
+    { VK_HOME,   ShiftKey,           "MoveToBeginningOfLineAndModifySelection"     },
+    { VK_HOME,   CtrlKey,            "MoveToBeginningOfDocument"                   },
+    { VK_HOME,   CtrlKey | ShiftKey, "MoveToBeginningOfDocumentAndModifySelection" },
+
+    { VK_END,    0,                  "MoveToEndOfLine"                             },
+    { VK_END,    ShiftKey,           "MoveToEndOfLineAndModifySelection"           },
+    { VK_END,    CtrlKey,            "MoveToEndOfDocument"                         },
+    { VK_END,    CtrlKey | ShiftKey, "MoveToEndOfDocumentAndModifySelection"       },
+
+    { VK_BACK,   0,                  "DeleteBackward"                              },
+    { VK_BACK,   ShiftKey,           "DeleteBackward"                              },
+    { VK_DELETE, 0,                  "DeleteForward"                               },
+    { VK_BACK,   CtrlKey,            "DeleteWordBackward"                          },
+    { VK_DELETE, CtrlKey,            "DeleteWordForward"                           },
+
+    { 'B',       CtrlKey,            "ToggleBold"                                  },
+    { 'I',       CtrlKey,            "ToggleItalic"                                },
+
+    { VK_ESCAPE, 0,                  "Cancel"                                      },
+    { VK_OEM_PERIOD, CtrlKey,        "Cancel"                                      },
+    { VK_TAB,    0,                  "InsertTab"                                   },
+    { VK_TAB,    ShiftKey,           "InsertBacktab"                               },
+    { VK_RETURN, 0,                  "InsertNewline"                               },
+    { VK_RETURN, CtrlKey,            "InsertNewline"                               },
+    { VK_RETURN, AltKey,             "InsertNewline"                               },
+    { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
+};
+
+static const KeyPressEntry keyPressEntries[] = {
+    { '\t',   0,                  "InsertTab"                                   },
+    { '\t',   ShiftKey,           "InsertBacktab"                               },
+    { '\r',   0,                  "InsertNewline"                               },
+    { '\r',   CtrlKey,            "InsertNewline"                               },
+    { '\r',   AltKey,             "InsertNewline"                               },
+    { '\r',   AltKey | ShiftKey,  "InsertNewline"                               },
+};
+
+static void createKeyDownCommandMap()
+{
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyDownEntries); ++i)
+        keyDownCommandsMap().set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
+}
+
+static void createKeyPressCommandMap()
+{
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyPressEntries); ++i)
+        keyPressCommandsMap().set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
+}
+
 String keyIdentifierForEvasKeyName(const String& keyName)
 {
     if (keyMap().isEmpty())
@@ -226,4 +323,44 @@ int windowsKeyCodeForEvasKeyName(const String& keyName)
     return 0;
 }
 
+const char* getKeyDownCommandName(const KeyboardEvent* event)
+{
+    unsigned modifiers = 0;
+    if (event->shiftKey())
+        modifiers |= ShiftKey;
+    if (event->altKey())
+        modifiers |= AltKey;
+    if (event->ctrlKey())
+        modifiers |= CtrlKey;
+
+    int mapKey = modifiers << 16 | event->keyCode();
+    if (!mapKey)
+        return 0;
+
+    if (keyDownCommandsMap().isEmpty())
+        createKeyDownCommandMap();
+
+    return keyDownCommandsMap().get(mapKey);
+}
+
+const char* getKeyPressCommandName(const KeyboardEvent* event)
+{
+    unsigned modifiers = 0;
+    if (event->shiftKey())
+        modifiers |= ShiftKey;
+    if (event->altKey())
+        modifiers |= AltKey;
+    if (event->ctrlKey())
+        modifiers |= CtrlKey;
+
+    int mapKey = modifiers << 16 | event->charCode();
+    if (!mapKey)
+        return 0;
+
+    if (keyPressCommandsMap().isEmpty())
+        createKeyPressCommandMap();
+
+    return keyPressCommandsMap().get(mapKey);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.h b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
index ad36327f4..cb5933c8c 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.h
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
@@ -34,10 +34,15 @@ class String;
 
 namespace WebCore {
 
+class KeyboardEvent;
+
 WTF::String keyIdentifierForEvasKeyName(const WTF::String&);
 WTF::String singleCharacterString(const WTF::String&);
 int windowsKeyCodeForEvasKeyName(const WTF::String&);
 
+const char* getKeyDownCommandName(const KeyboardEvent*);
+const char* getKeyPressCommandName(const KeyboardEvent*);
+
 } // namespace WebCore
 
 #endif // EflKeyboardUtilities_h
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
index c638bc0fc..7d6ad7895 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
@@ -31,7 +31,7 @@
 
 #if PLATFORM(QT)
 #include "ANGLE/include/GLSLANG/ShaderLang.h"
-#elif !PLATFORM(GTK) && !PLATFORM(EFL)
+#elif !PLATFORM(GTK) && !PLATFORM(EFL) && !PLATFORM(BLACKBERRY)
 #include "ANGLE/ShaderLang.h"
 #else
 #include "ShaderLang.h"
diff --git a/Source/WebCore/platform/graphics/BitmapImage.cpp b/Source/WebCore/platform/graphics/BitmapImage.cpp
index 448241b81..8bc97227f 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.cpp
+++ b/Source/WebCore/platform/graphics/BitmapImage.cpp
@@ -178,25 +178,26 @@ void BitmapImage::didDecodeProperties() const
         imageObserver()->decodedSizeChanged(this, deltaBytes);
 }
 
+void BitmapImage::updateSize() const
+{
+    if (!m_sizeAvailable || m_haveSize)
+        return;
+
+    m_size = m_source.size();
+    m_sizeRespectingOrientation = m_source.size(RespectImageOrientation);
+    m_haveSize = true;
+    didDecodeProperties();
+}
+
 IntSize BitmapImage::size() const
 {
-    if (m_sizeAvailable && !m_haveSize) {
-        m_size = m_source.size();
-        m_sizeRespectingOrientation = m_source.size(RespectImageOrientation);
-        m_haveSize = true;
-        didDecodeProperties();
-    }
+    updateSize();
     return m_size;
 }
 
 IntSize BitmapImage::sizeRespectingOrientation() const
 {
-    if (m_sizeAvailable && !m_haveSize) {
-        m_size = m_source.size();
-        m_sizeRespectingOrientation = m_source.size(RespectImageOrientation);
-        m_haveSize = true;
-        didDecodeProperties();
-    }
+    updateSize();
     return m_sizeRespectingOrientation;
 }
 
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index afb981627..2f1969e43 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -179,6 +179,9 @@ public:
     virtual bool notSolidColor();
 #endif
 
+private:
+    void updateSize() const;
+
 protected:
     enum RepetitionCountStatus {
       Unknown,    // We haven't checked the source's repetition count.
diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
index 22f81685a..73d8e95ed 100644
--- a/Source/WebCore/platform/graphics/Color.cpp
+++ b/Source/WebCore/platform/graphics/Color.cpp
@@ -397,17 +397,18 @@ void Color::getHSL(double& hue, double& saturation, double& lightness) const
 
 Color colorFromPremultipliedARGB(unsigned pixelColor)
 {
-    RGBA32 rgba;
+    Color color;
 
     if (unsigned alpha = (pixelColor & 0xFF000000) >> 24) {
-        rgba = makeRGBA(((pixelColor & 0x00FF0000) >> 16) * 255 / alpha,
+        color = Color::createUnCheked(
+                        ((pixelColor & 0x00FF0000) >> 16) * 255 / alpha,
                         ((pixelColor & 0x0000FF00) >> 8) * 255 / alpha,
                          (pixelColor & 0x000000FF) * 255 / alpha,
                           alpha);
     } else
-        rgba = pixelColor;
+        color = Color(pixelColor);
 
-    return Color(rgba);
+    return color;
 }
 
 unsigned premultipliedARGBFromColor(const Color& color)
diff --git a/Source/WebCore/platform/graphics/Color.h b/Source/WebCore/platform/graphics/Color.h
index ddfe20f06..41dc0a4ae 100644
--- a/Source/WebCore/platform/graphics/Color.h
+++ b/Source/WebCore/platform/graphics/Color.h
@@ -89,6 +89,17 @@ public:
     explicit Color(const String&);
     explicit Color(const char*);
 
+    static Color createUnCheked(int r, int g, int b) 
+    {
+        RGBA32 color = 0xFF000000 | r << 16 | g << 8 | b;
+        return Color(color);
+    }
+    static Color createUnCheked(int r, int g, int b, int a) 
+    {
+        RGBA32 color = a << 24 | r << 16 | g << 8 | b;
+        return Color(color);
+    }
+
     // Returns the color serialized according to HTML5
     // - http://www.whatwg.org/specs/web-apps/current-work/#serialization-of-a-color
     String serialized() const;
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index 7c1004991..7cf9420fc 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -66,6 +66,8 @@ public:
     //   GL_OES_compressed_ETC1_RGB8_texture
     //   GL_IMG_texture_compression_pvrtc
     //   EXT_texture_filter_anisotropic
+    //   GL_CHROMIUM_copy_texture
+    //   GL_CHROMIUM_flipy
 
     // Takes full name of extension; for example,
     // "GL_EXT_texture_format_BGRA8888".
@@ -140,6 +142,13 @@ public:
         // GL_EXT_texture_filter_anisotropic
         TEXTURE_MAX_ANISOTROPY_EXT = 0x84FE,
         MAX_TEXTURE_MAX_ANISOTROPY_EXT = 0x84FF,
+
+        // GL_CHROMIUM_flipy
+        UNPACK_FLIP_Y_CHROMIUM = 0x9240,
+
+        // GL_CHROMIUM_copy_texture
+        UNPACK_PREMULTIPLY_ALPHA_CHROMIUM = 0x9241,
+        UNPACK_UNPREMULTIPLY_ALPHA_CHROMIUM = 0x9242
     };
 
     // GL_ARB_robustness
@@ -165,6 +174,9 @@ public:
 
     // GL_ANGLE_translated_shader_source
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject) = 0;
+
+    // GL_CHROMIUM_copy_texture
+    virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index af252a787..f27bec7cb 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -488,7 +488,7 @@ namespace WebCore {
         void drawWindowsBitmap(WindowsBitmap*, const IntPoint&);
 #endif
 
-#if (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
+#if (PLATFORM(GTK) && OS(WINDOWS)) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
         HDC getWindowsContext(const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         void releaseWindowsContext(HDC, const IntRect&, bool supportAlphaBlend = true, bool mayCreateBitmap = true);
         bool shouldIncludeChildWindows() const { return false; }
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 113d3cfaf..b6c1b6441 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -43,7 +43,7 @@
 #undef VERSION
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
+#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(BLACKBERRY)
 #include "ANGLEWebKitBridge.h"
 #endif
 
@@ -91,6 +91,10 @@ const Platform3DObject NullPlatform3DObject = 0;
 #include <CoreGraphics/CGContext.h>
 #endif
 
+#if PLATFORM(BLACKBERRY)
+#include <GLES2/gl2.h>
+#endif
+
 namespace WebCore {
 class DrawingBuffer;
 class Extensions3D;
@@ -108,6 +112,8 @@ class IntRect;
 class IntSize;
 #if USE(CAIRO)
 class PlatformContextCairo;
+#elif PLATFORM(BLACKBERRY)
+class GraphicsContext;
 #endif
 
 struct ActiveInfo {
@@ -940,7 +946,7 @@ public:
     RetainPtr<WebGLLayer> m_webGLLayer;
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
+#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL) || PLATFORM(BLACKBERRY)
     typedef struct {
         String source;
         String log;
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.cpp b/Source/WebCore/platform/graphics/ImageBuffer.cpp
index 1fda2103c..46f2d14cd 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/ImageBuffer.cpp
@@ -105,4 +105,11 @@ PlatformLayer* ImageBuffer::platformLayer() const
 }
 #endif
 
+#if !USE(SKIA)
+bool ImageBuffer::copyToPlatformTexture(GraphicsContext3D&, Platform3DObject, GC3Denum, bool, bool)
+{
+    return false;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index ad20fbf1c..24831ed0a 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -36,6 +36,7 @@
 #include "GraphicsLayer.h"
 #endif
 #include "GraphicsTypes.h"
+#include "GraphicsTypes3D.h"
 #include "IntSize.h"
 #include "ImageBufferData.h"
 #include <wtf/Forward.h>
@@ -51,6 +52,7 @@ namespace WebCore {
     class ImageData;
     class IntPoint;
     class IntRect;
+    class GraphicsContext3D;
 
     enum Multiply {
         Premultiplied,
@@ -117,6 +119,8 @@ namespace WebCore {
         PlatformLayer* platformLayer() const;
 #endif
 
+        bool copyToPlatformTexture(GraphicsContext3D&, Platform3DObject, GC3Denum, bool, bool);
+
     private:
 #if USE(CG)
         NativeImagePtr copyNativeImage(BackingStoreCopy = CopyBackingStore) const;
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 7d845accc..73aacd496 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -176,15 +176,14 @@ struct MediaPlayerFactory {
     WTF_MAKE_NONCOPYABLE(MediaPlayerFactory); WTF_MAKE_FAST_ALLOCATED;
 public:
     MediaPlayerFactory(CreateMediaEnginePlayer constructor, MediaEngineSupportedTypes getSupportedTypes, MediaEngineSupportsType supportsTypeAndCodecs,
-        MediaEngineGetSitesInMediaCache getSitesInMediaCache, MediaEngineClearMediaCache clearMediaCache, MediaEngineClearMediaCacheForSite clearMediaCacheForSite) 
+        MediaEngineGetSitesInMediaCache getSitesInMediaCache, MediaEngineClearMediaCache clearMediaCache, MediaEngineClearMediaCacheForSite clearMediaCacheForSite)
         : constructor(constructor)
         , getSupportedTypes(getSupportedTypes)
         , supportsTypeAndCodecs(supportsTypeAndCodecs)
         , getSitesInMediaCache(getSitesInMediaCache)
         , clearMediaCache(clearMediaCache)
         , clearMediaCacheForSite(clearMediaCacheForSite)
-
-    { 
+    {
     }
 
     CreateMediaEnginePlayer constructor;
@@ -196,7 +195,8 @@ public:
 };
 
 static void addMediaEngine(CreateMediaEnginePlayer, MediaEngineSupportedTypes, MediaEngineSupportsType, MediaEngineGetSitesInMediaCache, MediaEngineClearMediaCache, MediaEngineClearMediaCacheForSite);
-static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, const String& codecs, const String& keySystem, MediaPlayerFactory* current = 0);
+
+static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, const String& codecs, const String& keySystem, const KURL&, MediaPlayerFactory* current = 0);
 static MediaPlayerFactory* nextMediaEngine(MediaPlayerFactory* current);
 
 static Vector<MediaPlayerFactory*>& installedMediaEngines() 
@@ -253,7 +253,7 @@ static const AtomicString& codecs()
     return codecs;
 }
 
-static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, const String& codecs, const String& keySystem, MediaPlayerFactory* current)
+static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, const String& codecs, const String& keySystem, const KURL& url, MediaPlayerFactory* current)
 {
     if (type.isEmpty())
         return 0;
@@ -280,11 +280,11 @@ static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, c
             continue;
         }
 #if ENABLE(ENCRYPTED_MEDIA)
-        MediaPlayer::SupportsType engineSupport = engines[ndx]->supportsTypeAndCodecs(type, codecs, keySystem);
+        MediaPlayer::SupportsType engineSupport = engines[ndx]->supportsTypeAndCodecs(type, codecs, keySystem, url);
 #else
         UNUSED_PARAM(keySystem);
         ASSERT(keySystem.isEmpty());
-        MediaPlayer::SupportsType engineSupport = engines[ndx]->supportsTypeAndCodecs(type, codecs);
+        MediaPlayer::SupportsType engineSupport = engines[ndx]->supportsTypeAndCodecs(type, codecs, url);
 #endif
         if (engineSupport > supported) {
             supported = engineSupport;
@@ -352,14 +352,14 @@ bool MediaPlayer::load(const KURL& url, const ContentType& contentType, const St
 {
     m_contentMIMEType = contentType.type().lower();
     m_contentTypeCodecs = contentType.parameter(codecs());
-    m_url = url.string();
+    m_url = url;
     m_keySystem = keySystem.lower();
     m_contentMIMETypeWasInferredFromExtension = false;
 
     // If the MIME type is missing or is not meaningful, try to figure it out from the URL.
     if (m_contentMIMEType.isEmpty() || m_contentMIMEType == applicationOctetStream() || m_contentMIMEType == textPlain()) {
-        if (protocolIs(m_url, "data"))
-            m_contentMIMEType = mimeTypeFromDataURL(m_url);
+        if (protocolIs(m_url.string(), "data"))
+            m_contentMIMEType = mimeTypeFromDataURL(m_url.string());
         else {
             String lastPathComponent = url.lastPathComponent();
             size_t pos = lastPathComponent.reverseFind('.');
@@ -383,7 +383,7 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
     MediaPlayerFactory* engine = 0;
 
     if (!m_contentMIMEType.isEmpty())
-        engine = bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_keySystem, current);
+        engine = bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_keySystem, m_url, current);
 
     // If no MIME type is specified or the type was inferred from the file extension, just use the next engine.
     if (!engine && (m_contentMIMEType.isEmpty() || m_contentMIMETypeWasInferredFromExtension))
@@ -410,7 +410,7 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
     }
 
     if (m_private)
-        m_private->load(m_url);
+        m_private->load(m_url.string());
     else {
         m_private = createNullMediaPlayer(this);
         if (m_mediaPlayerClient) {
@@ -418,7 +418,7 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
             m_mediaPlayerClient->mediaPlayerResourceNotSupported(this);
         }
     }
-}    
+}
 
 bool MediaPlayer::hasAvailableVideoFrame() const
 {
@@ -724,7 +724,7 @@ void MediaPlayer::paintCurrentFrameInContext(GraphicsContext* p, const IntRect&
     m_private->paintCurrentFrameInContext(p, r);
 }
 
-MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentType, const String& keySystem, const MediaPlayerSupportsTypeClient* client)
+MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentType, const String& keySystem, const KURL& url, const MediaPlayerSupportsTypeClient* client)
 {
     String type = contentType.type().lower();
     // The codecs string is not lower-cased because MP4 values are case sensitive
@@ -737,7 +737,7 @@ MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentTy
     if (type == applicationOctetStream())
         return IsNotSupported;
 
-    MediaPlayerFactory* engine = bestMediaEngineForTypeAndCodecs(type, typeCodecs, system);
+    MediaPlayerFactory* engine = bestMediaEngineForTypeAndCodecs(type, typeCodecs, system, url);
     if (!engine)
         return IsNotSupported;
 
@@ -757,10 +757,10 @@ MediaPlayer::SupportsType MediaPlayer::supportsType(const ContentType& contentTy
 #endif
 
 #if ENABLE(ENCRYPTED_MEDIA)
-    return engine->supportsTypeAndCodecs(type, typeCodecs, system);
+    return engine->supportsTypeAndCodecs(type, typeCodecs, system, url);
 #else
     ASSERT(system.isEmpty());
-    return engine->supportsTypeAndCodecs(type, typeCodecs);
+    return engine->supportsTypeAndCodecs(type, typeCodecs, url);
 #endif
 }
 
@@ -942,7 +942,7 @@ void MediaPlayer::networkStateChanged()
     if (m_private->networkState() >= FormatError
         && m_private->readyState() < HaveMetadata
         && installedMediaEngines().size() > 1) {
-        if (m_contentMIMEType.isEmpty() || bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_keySystem, m_currentMediaEngine)) {
+        if (m_contentMIMEType.isEmpty() || bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, m_keySystem, m_url, m_currentMediaEngine)) {
             m_reloadTimer.startOneShot(0);
             return;
         }
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 3fdfcce6e..8eb728596 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -203,7 +203,7 @@ public:
 
     // Media engine support.
     enum SupportsType { IsNotSupported, IsSupported, MayBeSupported };
-    static MediaPlayer::SupportsType supportsType(const ContentType&, const String& keySystem, const MediaPlayerSupportsTypeClient*);
+    static MediaPlayer::SupportsType supportsType(const ContentType&, const String& keySystem, const KURL&, const MediaPlayerSupportsTypeClient*);
     static void getSupportedTypes(HashSet<String>&);
     static bool isAvailable();
     static void getSitesInMediaCache(Vector<String>&);
@@ -401,7 +401,7 @@ private:
     Timer<MediaPlayer> m_reloadTimer;
     OwnPtr<MediaPlayerPrivateInterface> m_private;
     MediaPlayerFactory* m_currentMediaEngine;
-    String m_url;
+    KURL m_url;
     String m_contentMIMEType;
     String m_contentTypeCodecs;
     String m_keySystem;
@@ -424,17 +424,16 @@ private:
 typedef PassOwnPtr<MediaPlayerPrivateInterface> (*CreateMediaEnginePlayer)(MediaPlayer*);
 typedef void (*MediaEngineSupportedTypes)(HashSet<String>& types);
 #if ENABLE(ENCRYPTED_MEDIA)
-typedef MediaPlayer::SupportsType (*MediaEngineSupportsType)(const String& type, const String& codecs, const String& keySystem);
+typedef MediaPlayer::SupportsType (*MediaEngineSupportsType)(const String& type, const String& codecs, const String& keySystem, const KURL& url);
 #else
-typedef MediaPlayer::SupportsType (*MediaEngineSupportsType)(const String& type, const String& codecs);
+typedef MediaPlayer::SupportsType (*MediaEngineSupportsType)(const String& type, const String& codecs, const KURL& url);
 #endif
 typedef void (*MediaEngineGetSitesInMediaCache)(Vector<String>&);
 typedef void (*MediaEngineClearMediaCache)();
 typedef void (*MediaEngineClearMediaCacheForSite)(const String&);
 
-typedef void (*MediaEngineRegistrar)(CreateMediaEnginePlayer, MediaEngineSupportedTypes, MediaEngineSupportsType, 
-    MediaEngineGetSitesInMediaCache, MediaEngineClearMediaCache, MediaEngineClearMediaCacheForSite); 
-
+typedef void (*MediaEngineRegistrar)(CreateMediaEnginePlayer, MediaEngineSupportedTypes, MediaEngineSupportsType,
+    MediaEngineGetSitesInMediaCache, MediaEngineClearMediaCache, MediaEngineClearMediaCacheForSite);
 
 }
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
index 875d12dfb..a9f39a40d 100644
--- a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
+++ b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
@@ -725,7 +725,7 @@ void MediaPlayerPrivateAVFoundationCF::getSupportedTypes(HashSet<String>& suppor
     supportedTypes = mimeTypeCache();
 } 
 
-MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationCF::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationCF::supportsType(const String& type, const String& codecs, const KURL&)
 {
     // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask if it supports an
     // extended MIME type until rdar://8721715 is fixed.
diff --git a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h
index f5dd00150..81a9bc6e4 100644
--- a/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h
+++ b/Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h
@@ -46,7 +46,7 @@ private:
     // Engine support
     static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
     static void getSupportedTypes(HashSet<String>& types);
-    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
     static bool isAvailable();
 
     virtual void cancelLoad();
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
index dcc046d07..e5cfcb445 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h
@@ -60,7 +60,7 @@ private:
     // engine support
     static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
     static void getSupportedTypes(HashSet<String>& types);
-    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
     static bool isAvailable();
 
     virtual void cancelLoad();
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index 0c97c422e..a26141daf 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -670,7 +670,7 @@ void MediaPlayerPrivateAVFoundationObjC::getSupportedTypes(HashSet<String>& supp
     supportedTypes = mimeTypeCache();
 } 
 
-MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationObjC::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationObjC::supportsType(const String& type, const String& codecs, const KURL&)
 {
     if (!mimeTypeCache().contains(type))
         return MediaPlayer::IsNotSupported;
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
index 2d008b620..781dfc5c8 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -72,7 +72,7 @@ void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
         types.add(i->c_str());
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs, const KURL&)
 {
     if (type.isNull() || type.isEmpty()) {
         LOG(Media, "MediaPlayer does not support type; type is null or empty.");
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
index 19b654cff..589749c6f 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -39,7 +39,7 @@ public:
     static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
     static void registerMediaEngine(MediaEngineRegistrar);
     static void getSupportedTypes(HashSet<String>&);
-    static MediaPlayer::SupportsType supportsType(const String&, const String&);
+    static MediaPlayer::SupportsType supportsType(const String&, const String&, const KURL&);
     static void notifyAppActivatedEvent(bool);
     static void setCertificatePath(const String&);
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index 669eb9c85..ac292d375 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -159,7 +159,8 @@ bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned
         decoder.setData(image->data(), true);
         if (!decoder.frameCount() || !decoder.frameIsCompleteAtIndex(0))
             return false;
-        imageSurface = decoder.createFrameAtIndex(0)->surface();
+        OwnPtr<NativeImageCairo> nativeImage = adoptPtr(decoder.createFrameAtIndex(0));
+        imageSurface = nativeImage->surface();
     } else {
         imageSurface = image->nativeImageForCurrentFrame()->surface();
         if (!premultiplyAlpha)
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index d5577a3dc..4cc8c80c6 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -52,7 +52,8 @@ public:
         : platformContext(newPlatformContext)
 #if PLATFORM(GTK)
         , expose(0)
-#elif PLATFORM(WIN)
+#endif
+#if PLATFORM(WIN) || (PLATFORM(GTK) && OS(WINDOWS))
         // NOTE:  These may note be needed: review and remove once Cairo implementation is complete
         , m_hdc(0)
         , m_shouldIncludeChildWindows(false)
@@ -97,7 +98,8 @@ public:
 
 #if PLATFORM(GTK)
     GdkEventExpose* expose;
-#elif PLATFORM(WIN)
+#endif
+#if PLATFORM(WIN) || (PLATFORM(GTK) && OS(WINDOWS))
     HDC m_hdc;
     bool m_shouldIncludeChildWindows;
 #endif
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 2ed6bd69a..5e5f56853 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -241,10 +241,10 @@ void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, c
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned* pixel = row + x + destx;
-            Color pixelColor(srcRows[basex],
-                    srcRows[basex + 1],
-                    srcRows[basex + 2],
-                    srcRows[basex + 3]);
+            Color pixelColor = Color::createUnCheked(srcRows[basex],
+                                                     srcRows[basex + 1],
+                                                     srcRows[basex + 2],
+                                                     srcRows[basex + 3]);
             if (multiplied == Unmultiplied)
                 *pixel = premultipliedARGBFromColor(pixelColor);
             else
diff --git a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
index b2241b5e0..6fe1a873d 100644
--- a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
+++ b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.h
@@ -33,13 +33,13 @@
 
 #include <wtf/PassOwnPtr.h>
 
+namespace WebCore {
+
 class KeyframeValueList;
 class Animation;
 class FloatSize;
 class CCActiveAnimation;
 
-namespace WebCore {
-
 // Translates WebCore animation data into a CCActiveAnimation. If we are unable
 // to perform this translation, we return nullptr. This can happen if
 //   - a steps timing function is used,
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 970f1c30e..71b390f5b 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -31,6 +31,7 @@
 #include "BitmapSkPictureCanvasLayerTextureUpdater.h"
 
 #include "LayerPainterChromium.h"
+#include "PlatformColor.h"
 #include "SkCanvas.h"
 #include "SkDevice.h"
 
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 30b9a4907..09481d284 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -29,7 +29,6 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerTextureSubImage.h"
-#include "PlatformColor.h"
 #include "SkBitmap.h"
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
index 0df0b83a5..200c80a47 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
@@ -33,8 +33,8 @@
 #include "LayerRendererChromium.h" // For GLC() macro.
 #include "SkCanvas.h"
 #include "SkDeferredCanvas.h"
+#include "TraceEvent.h"
 #include "cc/CCProxy.h"
-#include "cc/CCTextureUpdater.h"
 #include <public/WebGraphicsContext3D.h>
 
 using WebKit::WebExternalTextureLayer;
@@ -166,5 +166,14 @@ void Canvas2DLayerBridge::contextAcquired()
         m_layer.willModifyTexture();
 }
 
+unsigned Canvas2DLayerBridge::backBufferTexture()
+{
+    contextAcquired();
+    if (m_canvas)
+        m_canvas->flush();
+    m_context->flush();
+    return m_backBufferTexture;
+}
+
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
index 1940078f6..b207a2b3c 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
@@ -26,6 +26,7 @@
 #ifndef Canvas2DLayerBridge_h
 #define Canvas2DLayerBridge_h
 
+#include "GraphicsContext3D.h"
 #include "ImageBuffer.h" // For DeferralMode enum.
 #include "IntSize.h"
 #include <public/WebExternalTextureLayer.h>
@@ -62,6 +63,8 @@ public:
     LayerChromium* layer() const;
     void contextAcquired();
 
+    unsigned backBufferTexture();
+
 private:
     Canvas2DLayerBridge(PassRefPtr<GraphicsContext3D>, const IntSize&, DeferralMode, unsigned textureId);
 
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 7c00babcd..05ee55225 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -38,7 +38,6 @@
 #include "BitmapSkPictureCanvasLayerTextureUpdater.h"
 #include "FrameBufferSkPictureCanvasLayerTextureUpdater.h"
 #include "LayerPainterChromium.h"
-#include "LayerRendererChromium.h"
 #include "PlatformSupport.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSettings.h"
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index a341de5a2..d72818599 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -35,7 +35,6 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "TiledLayerChromium.h"
-#include "cc/CCTiledLayerImpl.h"
 
 class SkCanvas;
 
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index 308070e31..2fdaee6b6 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -37,7 +37,6 @@
 #include "GraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
 #include "cc/CCProxy.h"
-#include "cc/CCTextureUpdater.h"
 #include <algorithm>
 #include <public/WebExternalTextureLayer.h>
 #include <public/WebExternalTextureLayerClient.h>
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index 92821360b..82787f400 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -156,6 +156,9 @@ public:
     void getQueryivEXT(GC3Denum, GC3Denum, GC3Dint*);
     void getQueryObjectuivEXT(Platform3DObject, GC3Denum, GC3Duint*);
 
+    // GL_CHROMIUM_copy_texture
+    void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
+
 private:
     // Instances of this class are strictly owned by the GraphicsContext3D implementation and do not
     // need to be instantiated by any other code.
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index dac035552..a2c43ce1b 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -33,6 +33,7 @@
 #include "LayerPainterChromium.h"
 #include "SkCanvas.h"
 #include "SkGpuDevice.h"
+#include "cc/CCGraphicsContext.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index 5841b47ca..d37572d93 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -93,7 +93,8 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     m_opaqueRectTrackingContentLayerDelegate = adoptPtr(new OpaqueRectTrackingContentLayerDelegate(this));
     m_layer = WebContentLayer::create(m_opaqueRectTrackingContentLayerDelegate.get());
     m_layer.setDrawsContent(m_drawsContent && m_contentsVisible);
-
+    if (client)
+        deviceOrPageScaleFactorChanged();
     updateDebugIndicators();
 }
 
@@ -838,6 +839,7 @@ void GraphicsLayerChromium::setupContentsLayer(LayerChromium* contentsLayer)
         return;
 
     if (!m_contentsLayer.isNull()) {
+        m_contentsLayer.setUseParentBackfaceVisibility(false);
         m_contentsLayer.removeFromParent();
         m_contentsLayer.reset();
     }
@@ -846,6 +848,7 @@ void GraphicsLayerChromium::setupContentsLayer(LayerChromium* contentsLayer)
         m_contentsLayer = WebLayer(contentsLayer);
 
         m_contentsLayer.setAnchorPoint(FloatPoint(0, 0));
+        m_contentsLayer.setUseParentBackfaceVisibility(true);
 
         // It is necessary to call setDrawsContent as soon as we receive the new contentsLayer, for
         // the correctness of early exit conditions in setDrawsContent() and setContentsVisible().
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index dedec6a55..9716b174d 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -33,7 +33,6 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "ContentLayerChromium.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
 #include "OpaqueRectTrackingContentLayerDelegate.h"
@@ -47,6 +46,7 @@ namespace WebCore {
 
 class LayerChromium;
 class LinkHighlight;
+class Path;
 
 class GraphicsLayerChromium : public GraphicsLayer, public GraphicsContextPainter, public CCLayerAnimationDelegate {
 public:
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 71fc1fbef..1fb3e4305 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -39,7 +39,6 @@
 #include "LayerTextureUpdater.h"
 #include "ManagedTexture.h"
 #include "PlatformColor.h"
-#include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 1d1bb1413..5aed1c7f9 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -83,6 +83,7 @@ LayerChromium::LayerChromium()
     , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
     , m_preserves3D(false)
+    , m_useParentBackfaceVisibility(false)
     , m_alwaysReserveTextures(false)
     , m_drawCheckerboardForMissingTiles(false)
     , m_forceRenderSurface(false)
@@ -96,6 +97,10 @@ LayerChromium::LayerChromium()
     , m_layerAnimationDelegate(0)
     , m_layerScrollDelegate(0)
 {
+    if (m_layerId < 0) {
+        s_nextLayerId = 1;
+        m_layerId = s_nextLayerId++;
+    }
 }
 
 LayerChromium::~LayerChromium()
@@ -533,6 +538,7 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setBackgroundColor(m_backgroundColor);
     layer->setBounds(m_bounds);
     layer->setContentBounds(contentBounds());
+    layer->setContentsScale(contentsScale());
     layer->setDebugBorderColor(m_debugBorderColor);
     layer->setDebugBorderWidth(m_debugBorderWidth);
     layer->setDebugName(m_debugName.isolatedCopy()); // We have to use isolatedCopy() here to safely pass ownership to another thread.
@@ -560,6 +566,7 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setIsContainerForFixedPositionLayers(m_isContainerForFixedPositionLayers);
     layer->setFixedToContainerLayer(m_fixedToContainerLayer);
     layer->setPreserves3D(preserves3D());
+    layer->setUseParentBackfaceVisibility(m_useParentBackfaceVisibility);
     layer->setScrollPosition(m_scrollPosition);
     layer->setMaxScrollPosition(m_maxScrollPosition);
     layer->setSublayerTransform(m_sublayerTransform);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 4a5f1ae73..68c2e317b 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -37,10 +37,8 @@
 #include "FloatPoint.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
-#include "ProgramBinding.h"
 #include "Region.h"
 #include "RenderSurfaceChromium.h"
-#include "ShaderChromium.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCOcclusionTracker.h"
 
@@ -87,6 +85,9 @@ public:
     virtual void setOpacityFromAnimation(float) OVERRIDE;
     virtual float opacity() const OVERRIDE { return m_opacity; }
     virtual void setTransformFromAnimation(const WebKit::WebTransformationMatrix&) OVERRIDE;
+    // A layer's transform operates layer space. That is, entirely in logical,
+    // non-page-scaled pixels (that is, they have page zoom baked in, but not page scale).
+    // The root layer is a special case -- it operates in physical pixels.
     virtual const WebKit::WebTransformationMatrix& transform() const OVERRIDE { return m_transform; }
 
     const LayerChromium* rootLayer() const;
@@ -108,6 +109,8 @@ public:
     void setBackgroundColor(const Color&);
     Color backgroundColor() const { return m_backgroundColor; }
 
+    // A layer's bounds are in logical, non-page-scaled pixels (however, the
+    // root layer's bounds are in physical pixels).
     void setBounds(const IntSize&);
     const IntSize& bounds() const { return m_bounds; }
     virtual IntSize contentBounds() const { return bounds(); }
@@ -189,6 +192,9 @@ public:
     void setPreserves3D(bool preserve3D) { m_preserves3D = preserve3D; }
     bool preserves3D() const { return m_preserves3D; }
 
+    void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
+    bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
+
     void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
     bool usesLayerClipping() const { return m_usesLayerClipping; }
 
@@ -236,14 +242,19 @@ public:
     bool screenSpaceTransformIsAnimating() const { return m_screenSpaceTransformIsAnimating; }
     void setScreenSpaceTransformIsAnimating(bool animating) { m_screenSpaceTransformIsAnimating = animating; }
 
-    // This moves from layer space, with origin in the center to target space with origin in the top left
+    // This moves from layer space, with origin in the center to target space with origin in the top left.
+    // That is, it converts from logical, non-page-scaled, to target pixels (and if the target is the
+    // root render surface, then this converts to physical pixels).
     const WebKit::WebTransformationMatrix& drawTransform() const { return m_drawTransform; }
     void setDrawTransform(const WebKit::WebTransformationMatrix& matrix) { m_drawTransform = matrix; }
-    // This moves from layer space, with origin the top left to screen space with origin in the top left
+    // This moves from layer space, with origin the top left to screen space with origin in the top left.
+    // It converts logical, non-page-scaled pixels to physical pixels.
     const WebKit::WebTransformationMatrix& screenSpaceTransform() const { return m_screenSpaceTransform; }
     void setScreenSpaceTransform(const WebKit::WebTransformationMatrix& matrix) { m_screenSpaceTransform = matrix; }
     const IntRect& drawableContentRect() const { return m_drawableContentRect; }
     void setDrawableContentRect(const IntRect& rect) { m_drawableContentRect = rect; }
+    // The contentsScale converts from logical, non-page-scaled pixels to target pixels.
+    // The contentsScale is 1 for the root layer as it is already in physical pixels.
     float contentsScale() const { return m_contentsScale; }
     void setContentsScale(float);
 
@@ -366,6 +377,7 @@ private:
     bool m_usesLayerClipping;
     bool m_isNonCompositedContent;
     bool m_preserves3D;
+    bool m_useParentBackfaceVisibility;
     bool m_alwaysReserveTextures;
     bool m_drawCheckerboardForMissingTiles;
     bool m_forceRenderSurface;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 89ddef547..595cae2e9 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -35,7 +35,6 @@
 #include "LayerRendererChromium.h"
 
 #include "Extensions3D.h"
-#include "Extensions3DChromium.h"
 #include "FloatQuad.h"
 #include "GeometryBinding.h"
 #include "GrTexture.h"
@@ -47,18 +46,14 @@
 #include "PlatformContextSkia.h"
 #include "SharedGraphicsContext3D.h"
 #include "SkBitmap.h"
-#include "TextureCopier.h"
 #include "TextureManager.h"
 #include "ThrottledTextureUploader.h"
 #include "TraceEvent.h"
 #include "TrackingTextureAllocator.h"
 #include "cc/CCCheckerboardDrawQuad.h"
-#include "cc/CCDamageTracker.h"
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCIOSurfaceDrawQuad.h"
-#include "cc/CCLayerImpl.h"
 #include "cc/CCLayerQuad.h"
-#include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCMathUtil.h"
 #include "cc/CCProxy.h"
 #include "cc/CCRenderPass.h"
@@ -70,6 +65,7 @@
 #include "cc/CCStreamVideoDrawQuad.h"
 #include "cc/CCTextureDrawQuad.h"
 #include "cc/CCTileDrawQuad.h"
+#include "cc/CCVideoLayerImpl.h"
 #include "cc/CCYUVVideoDrawQuad.h"
 #include <public/WebVideoFrame.h>
 #include <wtf/CurrentTime.h>
@@ -222,11 +218,7 @@ private:
     void onGpuMemoryAllocationChangedOnImpl(Extensions3DChromium::GpuMemoryAllocationCHROMIUM allocation)
     {
         ASSERT(CCProxy::isImplThread());
-        if (!allocation.suggestHaveBackbuffer)
-            m_layerRenderer->discardFramebuffer();
-        else
-            m_layerRenderer->ensureFramebuffer();
-        m_layerRenderer->m_client->setContentsMemoryAllocationLimitBytes(allocation.gpuResourceSizeInBytes);
+        m_layerRenderer->setGpuMemoryAllocation(allocation);
     }
 
     LayerRendererChromium* m_layerRenderer;
@@ -254,6 +246,7 @@ LayerRendererChromium::LayerRendererChromium(CCRendererClient* client,
     , m_defaultRenderPass(0)
     , m_isViewportChanged(false)
     , m_isFramebufferDiscarded(false)
+    , m_visible(true)
     , m_textureUploaderSetting(textureUploaderSetting)
 {
     ASSERT(m_context.get());
@@ -337,7 +330,7 @@ bool LayerRendererChromium::initialize()
         Extensions3DChromium* extensions3DChromium = static_cast<Extensions3DChromium*>(extensions);
         extensions3DChromium->setGpuMemoryAllocationChangedCallbackCHROMIUM(LayerRendererGpuMemoryAllocationChangedCallbackAdapter::create(this));
     } else {
-        m_client->setContentsMemoryAllocationLimitBytes(TextureManager::highLimitBytes(viewportSize()));
+        m_client->setMemoryAllocationLimitBytes(TextureManager::highLimitBytes(viewportSize()));
     }
 
     m_capabilities.usingDiscardFramebuffer = extensions->supports("GL_CHROMIUM_discard_framebuffer");
@@ -378,8 +371,9 @@ void LayerRendererChromium::debugGLCall(GraphicsContext3D* context, const char*
 
 void LayerRendererChromium::setVisible(bool visible)
 {
-    if (!visible)
-        releaseRenderPassTextures();
+    if (m_visible == visible)
+        return;
+    m_visible = visible;
 
     // TODO: Replace setVisibilityCHROMIUM with an extension to explicitly manage front/backbuffers
     // crbug.com/116049
@@ -1273,6 +1267,22 @@ void LayerRendererChromium::copyTextureToFramebuffer(int textureId, const IntSiz
                                     -1);
 }
 
+void LayerRendererChromium::setGpuMemoryAllocation(Extensions3DChromium::GpuMemoryAllocationCHROMIUM allocation)
+{
+    if (m_visible && !allocation.gpuResourceSizeInBytes)
+        return;
+
+    if (!allocation.suggestHaveBackbuffer && !m_visible)
+        discardFramebuffer();
+
+    if (!allocation.gpuResourceSizeInBytes) {
+        releaseRenderPassTextures();
+        m_client->releaseContentsTextures();
+        GLC(m_context, m_context->flush());
+    } else
+        m_client->setMemoryAllocationLimitBytes(allocation.gpuResourceSizeInBytes);
+}
+
 void LayerRendererChromium::finish()
 {
     TRACE_EVENT("LayerRendererChromium::finish", this, 0);
@@ -1281,12 +1291,8 @@ void LayerRendererChromium::finish()
 
 bool LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
 {
-    // FIXME: Remove this once gpu process supports ignoring swap buffers command while framebuffer is discarded.
-    //        Alternatively (preferably?), protect all cc code so as not to attempt a swap after a framebuffer discard.
-    if (m_isFramebufferDiscarded) {
-        m_client->setFullRootLayerDamage();
-        return false;
-    }
+    ASSERT(m_visible);
+    ASSERT(!m_isFramebufferDiscarded);
 
     TRACE_EVENT("LayerRendererChromium::swapBuffers", this, 0);
     // We're done! Time to swapbuffers!
@@ -1390,6 +1396,14 @@ void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& re
         GLC(context, context->deleteFramebuffer(temporaryFBO));
         GLC(context, context->deleteTexture(temporaryTexture));
     }
+
+    if (!m_visible) {
+        TRACE_EVENT0("cc", "LayerRendererChromium::getFramebufferPixels dropping resources after readback");
+        discardFramebuffer();
+        releaseRenderPassTextures();
+        m_client->releaseContentsTextures();
+        GLC(m_context, m_context->flush());
+    }
 }
 
 bool LayerRendererChromium::getFramebufferTexture(ManagedTexture* texture, const IntRect& deviceRect)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 6b39d9128..f7ccb651f 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -34,8 +34,8 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "Extensions3DChromium.h"
 #include "TextureCopier.h"
-#include "ThrottledTextureUploader.h"
 #include "TrackingTextureAllocator.h"
 #include "cc/CCRenderer.h"
 #include <wtf/PassOwnPtr.h>
@@ -54,12 +54,10 @@ class CCTileDrawQuad;
 class CCYUVVideoDrawQuad;
 class GeometryBinding;
 class GraphicsContext3D;
-class LayerRendererGpuMemoryAllocationChangedCallbackAdapter;
 class LayerRendererSwapBuffersCompleteCallbackAdapter;
+class ManagedTexture;
 class ScopedEnsureFramebufferAllocation;
 
-enum TextureUploaderOption { ThrottledUploader, UnthrottledUploader };
-
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium : public CCRenderer {
     WTF_MAKE_NONCOPYABLE(LayerRendererChromium);
@@ -113,9 +111,9 @@ public:
                           float width, float height, float opacity, const FloatQuad&,
                           int matrixLocation, int alphaLocation, int quadLocation);
     void copyTextureToFramebuffer(int textureId, const IntSize& bounds, const WebKit::WebTransformationMatrix& drawMatrix);
+    void setGpuMemoryAllocation(Extensions3DChromium::GpuMemoryAllocationCHROMIUM);
 
 protected:
-    friend class LayerRendererGpuMemoryAllocationChangedCallbackAdapter;
     void discardFramebuffer();
     void ensureFramebuffer();
     bool isFramebufferDiscarded() const { return m_isFramebufferDiscarded; }
@@ -260,6 +258,7 @@ private:
 
     bool m_isViewportChanged;
     bool m_isFramebufferDiscarded;
+    bool m_visible;
     TextureUploaderOption m_textureUploaderSetting;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
index dba8ab716..cec8ebcd8 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
@@ -31,7 +31,6 @@
 
 #include "ManagedTexture.h"
 #include "GraphicsTypes3D.h"
-#include "cc/CCGraphicsContext.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/chromium/ManagedTexture.cpp b/Source/WebCore/platform/graphics/chromium/ManagedTexture.cpp
index 8f03e0d9e..b06aaa91b 100644
--- a/Source/WebCore/platform/graphics/chromium/ManagedTexture.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ManagedTexture.cpp
@@ -29,7 +29,6 @@
 #include "ManagedTexture.h"
 
 #include "GraphicsContext3D.h"
-#include "TextureManager.h"
 #include "cc/CCGraphicsContext.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/chromium/ProgramBinding.h b/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
index c0ef736b3..aea285689 100644
--- a/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
+++ b/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
@@ -29,7 +29,6 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "PlatformString.h"
-#include "TraceEvent.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index b7fee8783..a5c4c6082 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -31,7 +31,6 @@
 
 #include "FilterOperations.h"
 #include "LayerChromium.h"
-#include "LayerRendererChromium.h"
 #include "cc/CCMathUtil.h"
 #include <public/WebTransformationMatrix.h>
 #include <wtf/text/CString.h>
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index e6e6800d9..0e7d4e38c 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -31,9 +31,6 @@
 
 #include "FloatRect.h"
 #include "IntRect.h"
-#include "ProgramBinding.h"
-#include "ShaderChromium.h"
-#include "TextureManager.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebTransformationMatrix.h>
 #include <wtf/Noncopyable.h>
diff --git a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
index bd8c33a9a..a29c28551 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 
 #include "TextureCopier.h"
+#include "TraceEvent.h"
 
 #include "LayerRendererChromium.h" // For the GLC() macro
 
diff --git a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
index 90b62b1ce..859864e62 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureLayerChromium.cpp
@@ -29,8 +29,6 @@
 
 #include "TextureLayerChromium.h"
 
-#include "Extensions3D.h"
-#include "GraphicsContext3DPrivate.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCTextureLayerImpl.h"
 #include <public/WebGraphicsContext3D.h>
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
index 97e62b91c..d1f52faeb 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
@@ -28,8 +28,8 @@
 
 #include "TextureManager.h"
 
-#include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
+#include "TraceEvent.h"
 
 using namespace std;
 
@@ -242,6 +242,13 @@ void TextureManager::deleteEvictedTextures(TextureAllocator* allocator)
     m_evictedTextures.clear();
 }
 
+void TextureManager::evictAndRemoveAllDeletedTextures()
+{
+    unprotectAllTextures();
+    reduceMemoryToLimit(0);
+    m_evictedTextures.clear();
+}
+
 void TextureManager::evictAndDeleteAllTextures(TextureAllocator* allocator)
 {
     unprotectAllTextures();
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.h b/Source/WebCore/platform/graphics/chromium/TextureManager.h
index 3147635a8..7ca14f437 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.h
@@ -44,6 +44,7 @@ class TextureAllocator {
 public:
     virtual unsigned createTexture(const IntSize&, GC3Denum format) = 0;
     virtual void deleteTexture(unsigned texture, const IntSize&, GC3Denum) = 0;
+    virtual void deleteAllTextures() = 0;
 
 protected:
     virtual ~TextureAllocator() { }
@@ -88,6 +89,7 @@ public:
     unsigned allocateTexture(TextureAllocator*, TextureToken);
     void deleteEvictedTextures(TextureAllocator*);
 
+    void evictAndRemoveAllDeletedTextures();
     void evictAndDeleteAllTextures(TextureAllocator*);
 
     void reduceMemoryToLimit(size_t);
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index a7d877e33..6e052b7fa 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -30,13 +30,13 @@
 #include "TiledLayerChromium.h"
 
 #include "GraphicsContext3D.h"
-#include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
 #include "Region.h"
 #include "TextStream.h"
-#include "TraceEvent.h"
 
 #include "cc/CCLayerImpl.h"
+#include "cc/CCLayerTreeHost.h"
+#include "cc/CCOverdrawMetrics.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTiledLayerImpl.h"
 
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index ca389f2e4..d5b64e916 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -29,11 +29,10 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "LayerChromium.h"
+#include "LayerTextureUpdater.h"
 #include "cc/CCLayerTilingData.h"
-#include "cc/CCTiledLayerImpl.h"
 
 namespace WebCore {
-class LayerTextureUpdater;
 class UpdatableTile;
 
 class TiledLayerChromium : public LayerChromium {
diff --git a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
index aa6c4ec0b..957711eaa 100644
--- a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
@@ -89,6 +89,7 @@ unsigned TrackingTextureAllocator::createTexture(const IntSize& size, GC3Denum f
         extensions->texStorage2DEXT(GraphicsContext3D::TEXTURE_2D, 1, storageFormat, size.width(), size.height());
     } else
         GLC(m_context.get(), m_context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, format, size.width(), size.height(), 0, format, GraphicsContext3D::UNSIGNED_BYTE));
+    m_allocatedTextureIds.add(textureId);
     return textureId;
 }
 
@@ -96,6 +97,16 @@ void TrackingTextureAllocator::deleteTexture(unsigned textureId, const IntSize&
 {
     m_currentMemoryUseBytes -= TextureManager::memoryUseBytes(size, format);
     GLC(m_context.get(), m_context->deleteTexture(textureId));
+    ASSERT(m_allocatedTextureIds.contains(textureId));
+    m_allocatedTextureIds.remove(textureId);
+}
+
+void TrackingTextureAllocator::deleteAllTextures()
+{
+    for (HashSet<unsigned>::const_iterator it = m_allocatedTextureIds.begin(); it != m_allocatedTextureIds.end(); ++it)
+        GLC(m_context.get(), m_context->deleteTexture(*it));
+    m_currentMemoryUseBytes = 0;
+    m_allocatedTextureIds.clear();
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
index a8a54929a..980b94e12 100644
--- a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
+++ b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
@@ -27,6 +27,7 @@
 
 #include "GraphicsContext3D.h"
 #include "TextureManager.h"
+#include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
@@ -40,8 +41,9 @@ public:
     }
     virtual ~TrackingTextureAllocator();
 
-    virtual unsigned createTexture(const IntSize&, GC3Denum format);
-    virtual void deleteTexture(unsigned texture, const IntSize&, GC3Denum format);
+    virtual unsigned createTexture(const IntSize&, GC3Denum format) OVERRIDE;
+    virtual void deleteTexture(unsigned texture, const IntSize&, GC3Denum format) OVERRIDE;
+    virtual void deleteAllTextures() OVERRIDE;
 
     size_t currentMemoryUseBytes() const { return m_currentMemoryUseBytes; }
 
@@ -57,6 +59,7 @@ protected:
     size_t m_currentMemoryUseBytes;
     TextureUsageHint m_textureUsageHint;
     bool m_useTextureStorageExt;
+    HashSet<unsigned> m_allocatedTextureIds;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
index 9a9389457..ba7472539 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveAnimation.h
@@ -25,14 +25,14 @@
 #ifndef CCActiveAnimation_h
 #define CCActiveAnimation_h
 
-#include "cc/CCAnimationCurve.h"
-
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+class CCAnimationCurve;
+
 // A CCActiveAnimation, contains all the state required to play a CCAnimationCurve.
 // Specifically, the affected property, the run state (paused, finished, etc.),
 // loop count, last pause time, and the total time spent paused.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
index a86c587af..8d6a2ee8d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
@@ -70,7 +70,14 @@ private:
     // To correctly track exposed regions, two hashtables of rects are maintained.
     // The "current" map is used to compute exposed regions of the current frame, while
     // the "next" map is used to collect layer rects that are used in the next frame.
-    typedef HashMap<int, FloatRect> RectMap;
+    struct RectMapKeyTraits : HashTraits<int> {
+        static const bool emptyValueIsZero = false;
+        static const bool needsDestruction = false;
+        static int emptyValue() { return -1; }
+        static void constructDeletedValue(int& slot) { slot = -2; }
+        static bool isDeletedValue(int value) { return value == -2; }
+    };
+    typedef HashMap<int, FloatRect, DefaultHash<int>::Hash, RectMapKeyTraits> RectMap;
     OwnPtr<RectMap> m_currentRectHistory;
     OwnPtr<RectMap> m_nextRectHistory;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
index b688a78a2..d6dcdc6de 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp
@@ -26,8 +26,6 @@
 
 #include "cc/CCDelayBasedTimeSource.h"
 
-#include "cc/CCThread.h"
-#include "cc/CCThreadTask.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp
index ce6033bd3..601f5621d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDrawQuad.cpp
@@ -30,7 +30,6 @@
 #include "cc/CCCheckerboardDrawQuad.h"
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCIOSurfaceDrawQuad.h"
-#include "cc/CCLayerImpl.h"
 #include "cc/CCRenderPassDrawQuad.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include "cc/CCStreamVideoDrawQuad.h"
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
index 5da4296c5..ce7d7c70d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFontAtlas.cpp
@@ -27,13 +27,13 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "CCFontAtlas.h"
 
-#include "CCProxy.h"
 #include "Font.h"
 #include "FontCache.h"
 #include "FontDescription.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
 #include "TextRun.h"
+#include "cc/CCProxy.h"
 
 #define ATLAS_SIZE 128
 #define FONT_HEIGHT 14
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
index 84a7cb310..3ab393fd9 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
@@ -27,8 +27,7 @@
 #include "cc/CCFrameRateController.h"
 
 #include "TraceEvent.h"
-#include "cc/CCThread.h"
-#include "cc/CCThreadTask.h"
+#include "cc/CCTimeSource.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
index 5734d4aa6..fa23af2cc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.h
@@ -25,7 +25,6 @@
 #ifndef CCFrameRateController_h
 #define CCFrameRateController_h
 
-#include "cc/CCTimeSource.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
@@ -33,6 +32,8 @@
 
 namespace WebCore {
 
+class CCTimeSource;
+
 class CCFrameRateControllerClient {
 public:
     virtual void vsyncTick() = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 1bbc046e7..1b61317cc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -25,16 +25,14 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#include "CCHeadsUpDisplay.h"
+#include "cc/CCHeadsUpDisplay.h"
 
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
-#include "ManagedTexture.h"
 #include "PlatformCanvas.h"
 #include "TextureManager.h"
 #include "cc/CCDebugRectHistory.h"
-#include "cc/CCFontAtlas.h"
 #include "cc/CCFrameRateCounter.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include <wtf/text/WTFString.h>
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index e1ce93a6c..c505a2086 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -27,6 +27,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "ManagedTexture.h"
 #include "cc/CCFontAtlas.h"
 
 namespace WebCore {
@@ -35,7 +36,7 @@ class CCDebugRectHistory;
 class CCFrameRateCounter;
 class CCLayerTreeHostImpl;
 class GraphicsContext;
-class ManagedTexture;
+
 struct CCLayerTreeSettings;
 
 // Class that handles drawing of composited render layers using GL.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp
index 0ce912647..f8446670a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp
@@ -30,11 +30,11 @@
 #include "cc/CCIOSurfaceLayerImpl.h"
 
 #include "Extensions3DChromium.h"
-#include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
+#include "TextStream.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCIOSurfaceDrawQuad.h"
 #include "cc/CCLayerTreeHostImpl.h"
-#include "cc/CCProxy.h"
 #include "cc/CCQuadCuller.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
index 7dc6f423b..601327581 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.h
@@ -25,8 +25,6 @@
 #ifndef CCLayerAnimationController_h
 #define CCLayerAnimationController_h
 
-#include "cc/CCActiveAnimation.h"
-#include "cc/CCAnimationCurve.h"
 #include "cc/CCAnimationEvents.h"
 
 #include <wtf/HashSet.h>
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 07f022d9c..a3ab4f3b4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -29,13 +29,13 @@
 
 #include "cc/CCLayerImpl.h"
 
-#include "LayerChromium.h"
-#include "LayerRendererChromium.h"
+#include "TextStream.h"
+#include "TraceEvent.h"
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCLayerSorter.h"
 #include "cc/CCMathUtil.h"
+#include "cc/CCProxy.h"
 #include "cc/CCQuadCuller.h"
-#include "cc/CCSolidColorDrawQuad.h"
 #include <wtf/text/WTFString.h>
 
 using WebKit::WebTransformationMatrix;
@@ -50,6 +50,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_layerTreeHostImpl(0)
     , m_anchorPoint(0.5, 0.5)
     , m_anchorPointZ(0)
+    , m_contentsScale(1)
     , m_scrollable(false)
     , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
@@ -60,6 +61,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_opaque(false)
     , m_opacity(1.0)
     , m_preserves3D(false)
+    , m_useParentBackfaceVisibility(false)
     , m_drawCheckerboardForMissingTiles(false)
     , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
@@ -82,6 +84,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_layerAnimationController(CCLayerAnimationController::create(this))
 {
     ASSERT(CCProxy::isImplThread());
+    ASSERT(m_layerId >= 0);
 }
 
 CCLayerImpl::~CCLayerImpl()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 24aba3a93..c735b919d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -34,7 +34,6 @@
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCRenderSurface.h"
-#include "cc/CCSharedQuadState.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebTransformationMatrix.h>
 #include <wtf/OwnPtr.h>
@@ -49,6 +48,7 @@ class CCLayerSorter;
 class CCLayerTreeHostImpl;
 class CCQuadCuller;
 class CCRenderer;
+class CCSharedQuadState;
 class LayerChromium;
 
 class CCLayerImpl : public CCLayerAnimationControllerClient {
@@ -141,6 +141,9 @@ public:
     void setPreserves3D(bool);
     bool preserves3D() const { return m_preserves3D; }
 
+    void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
+    bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
+
     void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
     bool usesLayerClipping() const { return m_usesLayerClipping; }
 
@@ -187,6 +190,9 @@ public:
     const IntSize& contentBounds() const { return m_contentBounds; }
     void setContentBounds(const IntSize&);
 
+    void setContentsScale(float contentsScale) { m_contentsScale = contentsScale; }
+    float contentsScale() const { return m_contentsScale; }
+
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
     void setScrollPosition(const IntPoint&);
 
@@ -305,6 +311,7 @@ private:
     float m_anchorPointZ;
     IntSize m_bounds;
     IntSize m_contentBounds;
+    float m_contentsScale;
     IntPoint m_scrollPosition;
     bool m_scrollable;
     bool m_shouldScrollOnMainThread;
@@ -331,6 +338,7 @@ private:
     float m_opacity;
     FloatPoint m_position;
     bool m_preserves3D;
+    bool m_useParentBackfaceVisibility;
     bool m_drawCheckerboardForMissingTiles;
     WebKit::WebTransformationMatrix m_sublayerTransform;
     WebKit::WebTransformationMatrix m_transform;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index f120d8c77..7d14cf5da 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -27,19 +27,20 @@
 #include "cc/CCLayerTreeHost.h"
 
 #include "LayerChromium.h"
-#include "LayerRendererChromium.h"
+#include "ManagedTexture.h"
 #include "Region.h"
 #include "TraceEvent.h"
 #include "TreeSynchronizer.h"
 #include "cc/CCFontAtlas.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCOcclusionTracker.h"
+#include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "cc/CCThread.h"
 #include "cc/CCThreadProxy.h"
 
 using namespace std;
@@ -72,7 +73,6 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCLayerTre
     , m_needsAnimateLayers(false)
     , m_client(client)
     , m_frameNumber(0)
-    , m_frameIsForDisplay(false)
     , m_layerRendererInitialized(false)
     , m_contextLost(false)
     , m_numTimesRecreateShouldFail(0)
@@ -80,8 +80,6 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCLayerTre
     , m_settings(settings)
     , m_deviceScaleFactor(1)
     , m_visible(true)
-    , m_memoryAllocationBytes(0)
-    , m_memoryAllocationIsForDisplay(false)
     , m_pageScaleFactor(1)
     , m_minPageScaleFactor(1)
     , m_maxPageScaleFactor(1)
@@ -151,11 +149,6 @@ void CCLayerTreeHost::initializeLayerRenderer()
 
     m_contentsTextureManager = TextureManager::create(0, 0, m_proxy->layerRendererCapabilities().maxTextureSize);
 
-    // FIXME: This is the same as setContentsMemoryAllocationLimitBytes, but
-    // we're in the middle of a commit here and don't want to force another.
-    m_memoryAllocationBytes = TextureManager::highLimitBytes(deviceViewportSize());
-    m_memoryAllocationIsForDisplay = true;
-
     m_layerRendererInitialized = true;
 
     m_settings.defaultTileSize = IntSize(min(m_settings.defaultTileSize.width(), m_proxy->layerRendererCapabilities().maxTextureSize),
@@ -256,8 +249,6 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
     hostImpl->setPageScaleFactorAndLimits(m_pageScaleFactor, m_minPageScaleFactor, m_maxPageScaleFactor);
     hostImpl->setBackgroundColor(m_backgroundColor);
     hostImpl->setHasTransparentBackground(m_hasTransparentBackground);
-    hostImpl->setVisible(m_visible);
-    hostImpl->setSourceFrameCanBeDrawn(m_frameIsForDisplay);
 
     m_frameNumber++;
 }
@@ -299,15 +290,6 @@ CCGraphicsContext* CCLayerTreeHost::context()
 
 bool CCLayerTreeHost::compositeAndReadback(void *pixels, const IntRect& rect)
 {
-    if (!m_layerRendererInitialized) {
-        initializeLayerRenderer();
-        if (!m_layerRendererInitialized)
-            return false;
-    }
-    if (m_contextLost) {
-        if (recreateContext() != RecreateSucceeded)
-            return false;
-    }
     m_triggerIdlePaints = false;
     bool ret = m_proxy->compositeAndReadback(pixels, rect);
     m_triggerIdlePaints = true;
@@ -337,11 +319,6 @@ void CCLayerTreeHost::setNeedsCommit()
     m_proxy->setNeedsCommit();
 }
 
-void CCLayerTreeHost::setNeedsForcedCommit()
-{
-    m_proxy->setNeedsForcedCommit();
-}
-
 void CCLayerTreeHost::setNeedsRedraw()
 {
     m_proxy->setNeedsRedraw();
@@ -407,35 +384,15 @@ void CCLayerTreeHost::setVisible(bool visible)
 {
     if (m_visible == visible)
         return;
-
     m_visible = visible;
-
-    // FIXME: Remove this stuff, it is here just for the m20 merge.
-    if (!m_visible && m_layerRendererInitialized) {
-        if (m_proxy->layerRendererCapabilities().contextHasCachedFrontBuffer)
-            setContentsMemoryAllocationLimitBytes(0);
-        else
-            setContentsMemoryAllocationLimitBytes(m_contentsTextureManager->preferredMemoryLimitBytes());
-    }
-
-    setNeedsForcedCommit();
+    m_proxy->setVisible(visible);
 }
 
-void CCLayerTreeHost::setContentsMemoryAllocationLimitBytes(size_t bytes)
+void CCLayerTreeHost::evictAllContentTextures()
 {
     ASSERT(CCProxy::isMainThread());
-    if (m_memoryAllocationBytes == bytes)
-        return;
-
-    m_memoryAllocationBytes = bytes;
-    m_memoryAllocationIsForDisplay = bytes;
-
-    // When not visible, force a commit so that we change our memory allocation
-    // and evict/delete any textures if we are being requested to.
-    if (!m_visible)
-        setNeedsForcedCommit();
-    else
-        setNeedsCommit();
+    ASSERT(m_contentsTextureManager.get());
+    m_contentsTextureManager->evictAndRemoveAllDeletedTextures();
 }
 
 void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
@@ -466,7 +423,7 @@ void CCLayerTreeHost::scheduleComposite()
     m_client->scheduleComposite();
 }
 
-bool CCLayerTreeHost::updateLayers(CCTextureUpdater& updater)
+bool CCLayerTreeHost::initializeLayerRendererIfNeeded()
 {
     if (!m_layerRendererInitialized) {
         initializeLayerRenderer();
@@ -478,26 +435,24 @@ bool CCLayerTreeHost::updateLayers(CCTextureUpdater& updater)
         if (recreateContext() != RecreateSucceeded)
             return false;
     }
+    return true;
+}
 
-    // The visible state and memory allocation are set independently and in
-    // arbitrary order, so do not change the memory allocation used for the
-    // current commit until both values match intentions.
-    // FIXME: These two states should be combined into a single action so we
-    // need a single commit to change visible state, and this can be removed.
-    bool memoryAllocationStateMatchesVisibility = m_visible == m_memoryAllocationIsForDisplay;
-    if (memoryAllocationStateMatchesVisibility) {
-        m_contentsTextureManager->setMemoryAllocationLimitBytes(m_memoryAllocationBytes);
-        m_frameIsForDisplay = m_memoryAllocationIsForDisplay;
-    }
+
+void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t contentsMemoryLimitBytes)
+{
+    ASSERT(m_layerRendererInitialized);
+    ASSERT(contentsMemoryLimitBytes);
 
     if (!rootLayer())
-        return true;
+        return;
 
     if (viewportSize().isEmpty())
-        return true;
+        return;
+
+    m_contentsTextureManager->setMemoryAllocationLimitBytes(contentsMemoryLimitBytes);
 
     updateLayers(rootLayer(), updater);
-    return true;
 }
 
 void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& updater)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index e1209af35..6f6946e31 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -26,13 +26,12 @@
 #define CCLayerTreeHost_h
 
 #include "Color.h"
+#include "GraphicsContext3D.h"
 #include "GraphicsTypes3D.h"
 #include "IntRect.h"
-#include "LayerChromium.h"
 #include "RateLimiter.h"
 #include "cc/CCAnimationEvents.h"
-#include "cc/CCGraphicsContext.h"
-#include "cc/CCLayerTreeHostCommon.h"
+#include "cc/CCOcclusionTracker.h"
 #include "cc/CCProxy.h"
 
 #include <limits>
@@ -43,10 +42,13 @@
 
 namespace WebCore {
 
+class CCGraphicsContext;
+class CCLayerChromium;
 class CCLayerTreeHostImpl;
 class CCLayerTreeHostImplClient;
+struct CCScrollAndScaleSet;
 class CCTextureUpdater;
-class GraphicsContext3D;
+class ManagedTexture;
 class Region;
 class TextureAllocator;
 class TextureManager;
@@ -168,7 +170,8 @@ public:
     void deleteContentsTexturesOnImplThread(TextureAllocator*);
     virtual void acquireLayerTextures();
     // Returns false if we should abort this frame due to initialization failure.
-    bool updateLayers(CCTextureUpdater&);
+    bool initializeLayerRendererIfNeeded();
+    void updateLayers(CCTextureUpdater&, size_t contentsMemoryLimitBytes);
 
     CCLayerTreeHostClient* client() { return m_client; }
 
@@ -199,7 +202,6 @@ public:
     void setNeedsAnimate();
     // virtual for testing
     virtual void setNeedsCommit();
-    void setNeedsForcedCommit();
     void setNeedsRedraw();
     bool commitRequested() const;
 
@@ -225,7 +227,12 @@ public:
     void setHasTransparentBackground(bool transparent) { m_hasTransparentBackground = transparent; }
 
     TextureManager* contentsTextureManager() const;
-    void setContentsMemoryAllocationLimitBytes(size_t);
+
+    // This will cause contents texture manager to evict all textures, but
+    // without deleting them. This happens after all content textures have
+    // already been deleted on impl, after getting a 0 allocation limit.
+    // Set during a commit, but before updateLayers.
+    void evictAllContentTextures();
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
@@ -278,7 +285,6 @@ private:
     CCLayerTreeHostClient* m_client;
 
     int m_frameNumber;
-    bool m_frameIsForDisplay;
 
     OwnPtr<CCProxy> m_proxy;
     bool m_layerRendererInitialized;
@@ -297,9 +303,6 @@ private:
 
     bool m_visible;
 
-    size_t m_memoryAllocationBytes;
-    bool m_memoryAllocationIsForDisplay;
-
     typedef HashMap<WebKit::WebGraphicsContext3D*, RefPtr<RateLimiter> > RateLimiterMap;
     RateLimiterMap m_rateLimiters;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 22b0e0434..c59707a4b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -31,8 +31,6 @@
 #include "IntRect.h"
 #include "LayerChromium.h"
 #include "RenderSurfaceChromium.h"
-#include "cc/CCActiveAnimation.h"
-#include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerSorter.h"
@@ -243,8 +241,15 @@ static bool layerShouldBeSkipped(LayerType* layer)
     if (!layer->drawsContent() || layer->bounds().isEmpty())
         return true;
 
+    LayerType* backfaceTestLayer = layer;
+    if (layer->useParentBackfaceVisibility()) {
+        ASSERT(layer->parent());
+        ASSERT(!layer->parent()->useParentBackfaceVisibility());
+        backfaceTestLayer = layer->parent();
+    }
+
     // The layer should not be drawn if (1) it is not double-sided and (2) the back of the layer is known to be facing the screen.
-    if (!layer->doubleSided() && transformToScreenIsKnown(layer) && isLayerBackFaceVisible(layer))
+    if (!backfaceTestLayer->doubleSided() && transformToScreenIsKnown(backfaceTestLayer) && isLayerBackFaceVisible(backfaceTestLayer))
         return true;
 
     return false;
@@ -483,18 +488,20 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     // When a render surface has a replica layer, that layer's transform is used to draw a second copy of the surface.
     // Transforms named here are relative to the surface, unless they specify they are relative to the replica layer.
     //
+    // We will denote a scale by contents scale S[contentsScale]
+    //
     // The render surface origin transform to its target surface origin is:
-    //        M[surfaceOrigin] = M[owningLayer->Draw] * Tr[origin2center].inverse()
+    //        M[surfaceOrigin] = M[owningLayer->Draw] * S[contentsScale].inverse() * Tr[origin2centerInScreenSpace].inverse()
     //
     // The render surface origin transform to its the root (screen space) origin is:
-    //        M[surface2root] = M[owningLayer->screenspace]
+    //        M[surface2root] =  M[owningLayer->screenspace] * S[contentsScale].inverse()
     //
     // The replica draw transform is:
-    //        M[replicaDraw] = M[surfaceOrigin] * Tr[replica->position()] * Tr[replica] * Tr[anchor2center]
-    //                       = M[owningLayer->draw] * Tr[origin2center].inverse() * Tr[replica->position()] * Tr[replica] * Tr[anchor2clippedCenter]
+    //        M[replicaDraw] = M[surfaceOrigin] * S[contentsScale] * Tr[replica->position()] * Tr[replica] * Tr[anchor2center] * S[contentsScale].inverse()
+    //                       = M[owningLayer->draw] * Tr[origin2center].inverse() * S[contentsScale] * Tr[replica->position()] * Tr[replica] * Tr[anchor2clippedCenter] * S[contentsScale].inverse()
     //
     // The replica origin transform to its target surface origin is:
-    //        M[replicaOrigin] = M[surfaceOrigin] * Tr[replica->position()] * Tr[replica] * Tr[origin2anchor].inverse()
+    //        M[replicaOrigin] = S[contentsScale] * M[surfaceOrigin] * Tr[replica->position()] * Tr[replica] * Tr[origin2anchor].inverse() * S[contentsScale].invers()
     //
     // The replica origin transform to the root (screen space) origin is:
     //        M[replica2root] = M[surface2root] * Tr[replica->position()] * Tr[replica] * Tr[origin2anchor].inverse()
@@ -547,6 +554,8 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         animatingTransformToScreen |= layer->parent()->screenSpaceTransformIsAnimating();
     }
 
+    float contentsScale = layer->contentsScale();
+
     FloatRect layerRect(-0.5 * layer->bounds().width(), -0.5 * layer->bounds().height(), layer->bounds().width(), layer->bounds().height());
     IntRect transformedLayerRect;
 
@@ -570,10 +579,11 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
         // The origin of the new surface is the upper left corner of the layer.
         WebTransformationMatrix drawTransform;
+        drawTransform.scale(contentsScale);
         drawTransform.translate3d(0.5 * bounds.width(), 0.5 * bounds.height(), 0);
         layer->setDrawTransform(drawTransform);
 
-        transformedLayerRect = IntRect(0, 0, bounds.width(), bounds.height());
+        transformedLayerRect = IntRect(0, 0, contentsScale * bounds.width(), contentsScale * bounds.height());
 
         // The opacity value is moved from the layer to its surface, so that the entire subtree properly inherits opacity.
         renderSurface->setDrawOpacity(drawOpacity);
@@ -582,7 +592,16 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         layer->setDrawOpacityIsAnimating(false);
 
         WebTransformationMatrix surfaceOriginTransform = combinedTransform;
-        surfaceOriginTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
+        // The surfaceOriginTransform transforms points in the surface's content space
+        // to its parent's content space. Distances in these spaces are both in physical
+        // pixels, so we need to 'undo' the scale by contentsScale. Ultimately, the
+        // transform should map (0, 0) to contentsScale * position, and preserve distances.
+        // Note, the following two lines are not equivalent to translating by (bounds.width(),
+        // bounds.height). The effect on m41 and m42 would be identical, but the scale
+        // affects the entire matrix. We need to scale these other entries to avoid
+        // double scaling; we must remain in physical pixels.
+        surfaceOriginTransform.scale(1 / contentsScale);
+        surfaceOriginTransform.translate3d(-0.5 * transformedLayerRect.width(), -0.5 * transformedLayerRect.height(), 0);
         renderSurface->setOriginTransform(surfaceOriginTransform);
 
         renderSurface->setTargetSurfaceTransformsAreAnimating(animatingTransformToTarget);
@@ -763,21 +782,33 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         drawTransform.translate3d(surfaceCenter.x() + centerOffsetDueToClipping.width(), surfaceCenter.y() + centerOffsetDueToClipping.height(), 0);
         renderSurface->setDrawTransform(drawTransform);
 
-        // The layer's origin is equal to the surface's origin so the screenSpaceTransform is the same.
-        renderSurface->setScreenSpaceTransform(layer->screenSpaceTransform());
+        WebTransformationMatrix screenSpaceTransform = layer->screenSpaceTransform();
+        // The layer's screen space transform operates on layer rects, but the surfaces
+        // screen space transform operates on surface rects, which are in physical pixels,
+        // so we have to 'undo' the scale here.
+        screenSpaceTransform.scale(1 / contentsScale);
+        renderSurface->setScreenSpaceTransform(screenSpaceTransform);
 
         if (layer->replicaLayer()) {
             // Compute the transformation matrix used to draw the surface's replica to the target surface.
             WebTransformationMatrix replicaDrawTransform = renderSurface->originTransform();
+
+            replicaDrawTransform.scale(contentsScale);
             replicaDrawTransform.translate(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y());
             replicaDrawTransform.multiply(layer->replicaLayer()->transform());
-            replicaDrawTransform.translate(surfaceCenter.x() - anchorPoint.x() * bounds.width(), surfaceCenter.y() - anchorPoint.y() * bounds.height());
+            FloatPoint layerSpaceSurfaceCenter = surfaceCenter;
+            layerSpaceSurfaceCenter.scale(1 / contentsScale, 1 / contentsScale);
+            replicaDrawTransform.translate(layerSpaceSurfaceCenter.x() - anchorPoint.x() * bounds.width(), layerSpaceSurfaceCenter.y() - anchorPoint.y() * bounds.height());
+            replicaDrawTransform.scale(1 / contentsScale);
+
             renderSurface->setReplicaDrawTransform(replicaDrawTransform);
 
             WebTransformationMatrix surfaceOriginToReplicaOriginTransform;
+            surfaceOriginToReplicaOriginTransform.scale(contentsScale);
             surfaceOriginToReplicaOriginTransform.translate(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y());
             surfaceOriginToReplicaOriginTransform.multiply(layer->replicaLayer()->transform());
             surfaceOriginToReplicaOriginTransform.translate(-anchorPoint.x() * bounds.width(), -anchorPoint.y() * bounds.height());
+            surfaceOriginToReplicaOriginTransform.scale(1 / contentsScale);
 
             // Compute the replica's "originTransform" that maps from the replica's origin space to the target surface origin space.
             WebTransformationMatrix replicaOriginTransform = layer->renderSurface()->originTransform() * surfaceOriginToReplicaOriginTransform;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 21a672e8f..9a11bd280 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -26,26 +26,25 @@
 
 #include "cc/CCLayerTreeHostImpl.h"
 
-#include "Extensions3D.h"
 #include "LayerRendererChromium.h"
+#include "TextStream.h"
 #include "TraceEvent.h"
+#include "TrackingTextureAllocator.h"
 #include "cc/CCActiveGestureAnimation.h"
 #include "cc/CCDamageTracker.h"
 #include "cc/CCDebugRectHistory.h"
 #include "cc/CCDelayBasedTimeSource.h"
 #include "cc/CCFontAtlas.h"
 #include "cc/CCFrameRateCounter.h"
-#include "cc/CCGestureCurve.h"
 #include "cc/CCHeadsUpDisplay.h"
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
-#include "cc/CCMathUtil.h"
+#include "cc/CCOverdrawMetrics.h"
 #include "cc/CCPageScaleAnimation.h"
 #include "cc/CCRenderPassDrawQuad.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "cc/CCThreadTask.h"
 #include <wtf/CurrentTime.h>
 
 using WebKit::WebTransformationMatrix;
@@ -122,7 +121,8 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCLayerTreeSettings& settings, CC
     , m_settings(settings)
     , m_deviceScaleFactor(1)
     , m_visible(true)
-    , m_sourceFrameCanBeDrawn(true)
+    , m_contentsTexturesWerePurgedSinceLastCommit(false)
+    , m_memoryAllocationLimitBytes(TextureManager::highLimitBytes(viewportSize()))
     , m_headsUpDisplay(CCHeadsUpDisplay::create())
     , m_pageScale(1)
     , m_pageScaleDelta(1)
@@ -157,6 +157,7 @@ void CCLayerTreeHostImpl::commitComplete()
     // Recompute max scroll position; must be after layer content bounds are
     // updated.
     updateMaxScrollPosition();
+    m_contentsTexturesWerePurgedSinceLastCommit = false;
 }
 
 bool CCLayerTreeHostImpl::canDraw()
@@ -167,12 +168,12 @@ bool CCLayerTreeHostImpl::canDraw()
         return false;
     if (!m_layerRenderer)
         return false;
-    if (!m_sourceFrameCanBeDrawn)
+    if (m_contentsTexturesWerePurgedSinceLastCommit)
         return false;
     return true;
 }
 
-CCGraphicsContext* CCLayerTreeHostImpl::context()
+CCGraphicsContext* CCLayerTreeHostImpl::context() const
 {
     return m_context.get();
 }
@@ -257,11 +258,11 @@ void CCLayerTreeHostImpl::calculateRenderSurfaceLayerList(CCLayerList& renderSur
         deviceScaleTransform.scale(m_deviceScaleFactor);
         CCLayerTreeHostCommon::calculateDrawTransforms(m_rootLayerImpl.get(), m_rootLayerImpl.get(), deviceScaleTransform, identityMatrix, renderSurfaceLayerList, m_rootLayerImpl->renderSurface()->layerList(), &m_layerSorter, layerRendererCapabilities().maxTextureSize);
 
-        if (layerRendererCapabilities().usingPartialSwap || settings().showSurfaceDamageRects)
-            trackDamageForAllSurfaces(m_rootLayerImpl.get(), renderSurfaceLayerList);
-        m_rootScissorRect = m_rootLayerImpl->renderSurface()->damageTracker()->currentDamageRect();
+        trackDamageForAllSurfaces(m_rootLayerImpl.get(), renderSurfaceLayerList);
 
-        if (!layerRendererCapabilities().usingPartialSwap)
+        if (layerRendererCapabilities().usingPartialSwap)
+            m_rootScissorRect = m_rootLayerImpl->renderSurface()->damageTracker()->currentDamageRect();
+        else
             m_rootScissorRect = FloatRect(FloatPoint(0, 0), deviceViewportSize());
 
         CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, m_rootScissorRect);
@@ -469,9 +470,20 @@ bool CCLayerTreeHostImpl::prepareToDraw(FrameData& frame)
     return true;
 }
 
-void CCLayerTreeHostImpl::setContentsMemoryAllocationLimitBytes(size_t bytes)
+void CCLayerTreeHostImpl::releaseContentsTextures()
 {
-    m_client->postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(bytes);
+    contentsTextureAllocator()->deleteAllTextures();
+    m_contentsTexturesWerePurgedSinceLastCommit = true;
+}
+
+void CCLayerTreeHostImpl::setMemoryAllocationLimitBytes(size_t bytes)
+{
+    if (m_memoryAllocationLimitBytes == bytes)
+        return;
+    m_memoryAllocationLimitBytes = bytes;
+
+    ASSERT(bytes);
+    m_client->setNeedsCommitOnImplThread();
 }
 
 void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
@@ -709,11 +721,11 @@ static void applyPageScaleDeltaToScrollLayers(CCLayerImpl* layerImpl, float page
         applyPageScaleDeltaToScrollLayers(layerImpl->children()[i].get(), pageScaleDelta);
 }
 
-void CCLayerTreeHostImpl::setDeviceScaleFactor(float newDeviceScaleFactor)
+void CCLayerTreeHostImpl::setDeviceScaleFactor(float deviceScaleFactor)
 {
-    if (newDeviceScaleFactor == deviceScaleFactor())
+    if (deviceScaleFactor == m_deviceScaleFactor)
         return;
-    m_deviceScaleFactor = newDeviceScaleFactor;
+    m_deviceScaleFactor = deviceScaleFactor;
 
     m_deviceViewportSize = viewportSize();
     m_deviceViewportSize.scale(m_deviceScaleFactor);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 2e7aba4ed..939e42e6b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -26,13 +26,11 @@
 #define CCLayerTreeHostImpl_h
 
 #include "Color.h"
-#include "LayerRendererChromium.h"
 #include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
-#include "cc/CCLayerTreeHost.h"
-#include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCRenderPass.h"
+#include "cc/CCRenderer.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -59,7 +57,6 @@ public:
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) = 0;
-    virtual void postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
@@ -111,11 +108,12 @@ public:
     virtual void didLoseContext() OVERRIDE;
     virtual void onSwapBuffersComplete() OVERRIDE;
     virtual void setFullRootLayerDamage() OVERRIDE;
-    virtual void setContentsMemoryAllocationLimitBytes(size_t) OVERRIDE;
+    virtual void releaseContentsTextures() OVERRIDE;
+    virtual void setMemoryAllocationLimitBytes(size_t) OVERRIDE;
 
     // Implementation
     bool canDraw();
-    CCGraphicsContext* context();
+    CCGraphicsContext* context() const;
 
     String layerTreeAsText() const;
     void setFontAtlas(PassOwnPtr<CCFontAtlas>);
@@ -148,8 +146,8 @@ public:
     int sourceFrameNumber() const { return m_sourceFrameNumber; }
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
 
-    bool sourceFrameCanBeDrawn() const { return m_sourceFrameCanBeDrawn; }
-    void setSourceFrameCanBeDrawn(bool sourceFrameCanBeDrawn) { m_sourceFrameCanBeDrawn = sourceFrameCanBeDrawn; }
+    bool contentsTexturesWerePurgedSinceLastCommit() const { return m_contentsTexturesWerePurgedSinceLastCommit; }
+    size_t memoryAllocationLimitBytes() const { return m_memoryAllocationLimitBytes; }
 
     const IntSize& viewportSize() const { return m_viewportSize; }
     void setViewportSize(const IntSize&);
@@ -237,7 +235,8 @@ private:
     IntSize m_deviceViewportSize;
     float m_deviceScaleFactor;
     bool m_visible;
-    bool m_sourceFrameCanBeDrawn;
+    bool m_contentsTexturesWerePurgedSinceLastCommit;
+    size_t m_memoryAllocationLimitBytes;
 
     OwnPtr<CCHeadsUpDisplay> m_headsUpDisplay;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index 68ccdc9c0..4836eb528 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -32,6 +32,7 @@
 #include "LayerChromium.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCMathUtil.h"
+#include "cc/CCOverdrawMetrics.h"
 
 #include <algorithm>
 
@@ -110,6 +111,9 @@ static inline bool surfaceTransformsToTargetKnown(const CCRenderSurface*) { retu
 static inline bool surfaceTransformsToScreenKnown(const RenderSurfaceChromium* surface) { return !surface->screenSpaceTransformsAreAnimating(); }
 static inline bool surfaceTransformsToScreenKnown(const CCRenderSurface*) { return true; }
 
+static inline bool layerIsInUnsorted3dRenderingContext(const LayerChromium* layer) { return layer->parent() && layer->parent()->preserves3D(); }
+static inline bool layerIsInUnsorted3dRenderingContext(const CCLayerImpl*) { return false; }
+
 template<typename LayerType, typename RenderSurfaceType>
 void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::finishedTargetRenderSurface(const LayerType* owningLayer, const RenderSurfaceType* finishedTarget)
 {
@@ -334,6 +338,9 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
     if (!layerOpacityKnown(layer) || layer->drawOpacity() < 1)
         return;
 
+    if (layerIsInUnsorted3dRenderingContext(layer))
+        return;
+
     Region opaqueContents = layer->visibleContentOpaqueRegion();
     if (opaqueContents.isEmpty())
         return;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
index 12801ffbe..19e533536 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -29,9 +29,9 @@
 #include "FloatQuad.h"
 #include "Region.h"
 #include "cc/CCLayerIterator.h"
-#include "cc/CCOverdrawMetrics.h"
 
 namespace WebCore {
+class CCOverdrawMetrics;
 class CCLayerImpl;
 class CCRenderSurface;
 class LayerChromium;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
index 905c21a1d..506a99376 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
@@ -26,8 +26,6 @@
 
 #include "cc/CCProxy.h"
 
-#include "TraceEvent.h"
-#include "cc/CCLayerTreeHost.h"
 #include "cc/CCThreadTask.h"
 #include <wtf/MainThread.h>
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index fb2cbbae9..1c2f9cafd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -70,6 +70,8 @@ public:
     // Indicates that the compositing surface associated with our context is ready to use.
     virtual void setSurfaceReady() = 0;
 
+    virtual void setVisible(bool) = 0;
+
     // Attempts to initialize the layer renderer. Returns false if the context isn't usable for compositing.
     virtual bool initializeLayerRenderer() = 0;
 
@@ -83,7 +85,6 @@ public:
 
     virtual void setNeedsAnimate() = 0;
     virtual void setNeedsCommit() = 0;
-    virtual void setNeedsForcedCommit() = 0;
     virtual void setNeedsRedraw() = 0;
 
     virtual void didAddAnimation() = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index 0842996ab..63b8fb8bf 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -33,7 +33,6 @@
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCOverdrawMetrics.h"
-#include "cc/CCRenderPass.h"
 #include <public/WebTransformationMatrix.h>
 
 using namespace std;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 2b8bc7e5b..6ce35fe8a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -26,13 +26,13 @@
 #ifndef CCRenderPass_h
 #define CCRenderPass_h
 
-#include "cc/CCDrawQuad.h"
 #include "cc/CCOcclusionTracker.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
+class CCDrawQuad;
 class CCLayerImpl;
 class CCRenderSurface;
 class CCSharedQuadState;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index 306a1c075..1cdad22e4 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -30,7 +30,6 @@
 #include "cc/CCRenderSurface.h"
 
 #include "GraphicsContext3D.h"
-#include "LayerChromium.h"
 #include "LayerRendererChromium.h"
 #include "ManagedTexture.h"
 #include "TextStream.h"
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 14941b952..cdd7a7b59 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -32,7 +32,6 @@
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "TextureManager.h"
-#include "cc/CCLayerQuad.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebTransformationMatrix.h>
 #include <wtf/Noncopyable.h>
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
index 11590e006..abad02bb7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
@@ -40,6 +40,8 @@ class TextureCopier;
 class TextureManager;
 class TextureUploader;
 
+enum TextureUploaderOption { ThrottledUploader, UnthrottledUploader };
+
 class CCRendererClient {
 public:
     virtual const IntSize& deviceViewportSize() const = 0;
@@ -47,7 +49,8 @@ public:
     virtual void didLoseContext() = 0;
     virtual void onSwapBuffersComplete() = 0;
     virtual void setFullRootLayerDamage() = 0;
-    virtual void setContentsMemoryAllocationLimitBytes(size_t) = 0;
+    virtual void releaseContentsTextures() = 0;
+    virtual void setMemoryAllocationLimitBytes(size_t) = 0;
 };
 
 class CCRenderer {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
index 84b842358..d8355bd36 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
@@ -88,11 +88,18 @@ void CCScheduler::setMainThreadNeedsLayerTextures()
 
 void CCScheduler::beginFrameComplete()
 {
-    TRACE_EVENT("CCScheduler::beginFrameComplete", this, 0);
+    TRACE_EVENT0("cc", "CCScheduler::beginFrameComplete");
     m_stateMachine.beginFrameComplete();
     processScheduledActions();
 }
 
+void CCScheduler::beginFrameAborted()
+{
+    TRACE_EVENT0("cc", "CCScheduler::beginFrameAborted");
+    m_stateMachine.beginFrameAborted();
+    processScheduledActions();
+}
+
 void CCScheduler::setMaxFramesPending(int maxFramesPending)
 {
     m_frameRateController->setMaxFramesPending(maxFramesPending);
@@ -100,13 +107,13 @@ void CCScheduler::setMaxFramesPending(int maxFramesPending)
 
 void CCScheduler::didSwapBuffersComplete()
 {
-    TRACE_EVENT("CCScheduler::didSwapBuffersComplete", this, 0);
+    TRACE_EVENT0("cc", "CCScheduler::didSwapBuffersComplete");
     m_frameRateController->didFinishFrame();
 }
 
 void CCScheduler::didLoseContext()
 {
-    TRACE_EVENT("CCScheduler::didLoseContext", this, 0);
+    TRACE_EVENT0("cc", "CCScheduler::didLoseContext");
     m_frameRateController->didAbortAllPendingFrames();
     m_stateMachine.didLoseContext();
     processScheduledActions();
@@ -114,7 +121,7 @@ void CCScheduler::didLoseContext()
 
 void CCScheduler::didRecreateContext()
 {
-    TRACE_EVENT("CCScheduler::didRecreateContext", this, 0);
+    TRACE_EVENT0("cc", "CCScheduler::didRecreateContext");
     m_stateMachine.didRecreateContext();
     processScheduledActions();
 }
@@ -125,7 +132,7 @@ void CCScheduler::vsyncTick()
         m_updateMoreResourcesPending = false;
         m_stateMachine.beginUpdateMoreResourcesComplete(m_client->hasMoreResourceUpdates());
     }
-    TRACE_EVENT("CCScheduler::vsyncTick", this, 0);
+    TRACE_EVENT0("cc", "CCScheduler::vsyncTick");
 
     m_stateMachine.didEnterVSync();
     processScheduledActions();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
index 0e6971642..3e6f7aa7b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
@@ -94,6 +94,7 @@ public:
     void setNeedsForcedRedraw();
 
     void beginFrameComplete();
+    void beginFrameAborted();
 
     void setMaxFramesPending(int);
     void didSwapBuffersComplete();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
index 928a6d6d7..c729d504b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
@@ -26,6 +26,8 @@
 
 #include "cc/CCSchedulerStateMachine.h"
 
+#include <stdio.h>
+
 namespace WebCore {
 
 CCSchedulerStateMachine::CCSchedulerStateMachine()
@@ -299,6 +301,12 @@ void CCSchedulerStateMachine::beginFrameComplete()
     m_commitState = COMMIT_STATE_UPDATING_RESOURCES;
 }
 
+void CCSchedulerStateMachine::beginFrameAborted()
+{
+    ASSERT(m_commitState == COMMIT_STATE_FRAME_IN_PROGRESS);
+    m_commitState = COMMIT_STATE_IDLE;
+}
+
 void CCSchedulerStateMachine::beginUpdateMoreResourcesComplete(bool morePending)
 {
     ASSERT(m_commitState == COMMIT_STATE_UPDATING_RESOURCES);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
index a3a94c294..fe1b180fe 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
@@ -120,6 +120,10 @@ public:
     // updating of compositor resources can begin.
     void beginFrameComplete();
 
+    // Call this only in response to receiving an ACTION_BEGIN_FRAME
+    // from nextState if the client rejects the beginFrame message.
+    void beginFrameAborted();
+
     // Call this only in response to receiving an ACTION_UPDATE_MORE_RESOURCES
     // from nextState. Indicates that the specific update request completed.
     void beginUpdateMoreResourcesComplete(bool morePending);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScopedThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCScopedThreadProxy.h
index ec3f1a87c..bd724a3ec 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScopedThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScopedThreadProxy.h
@@ -25,7 +25,6 @@
 #ifndef CCScopedThreadProxy_h
 #define CCScopedThreadProxy_h
 
-#include "cc/CCProxy.h"
 #include "cc/CCThreadTask.h"
 #include <wtf/ThreadSafeRefCounted.h>
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
index 1fd0c79bc..a22ef5d26 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
@@ -29,9 +29,6 @@
 
 #include "CCScrollbarLayerImpl.h"
 
-#include "LayerRendererChromium.h"
-#include "ManagedTexture.h"
-#include "PlatformCanvas.h"
 #include "ScrollbarTheme.h"
 #include "ScrollbarThemeComposite.h"
 #include "cc/CCQuadCuller.h"
@@ -203,8 +200,8 @@ int CCScrollbarLayerImpl::CCScrollbar::totalSize() const
     // FIXME: Hardcoding the first child here is weird. Think of
     // a cleaner way to get the contentBounds on the Impl side.
     if (orientation() == HorizontalScrollbar)
-        return m_owner->m_scrollLayer->children()[0]->contentBounds().width();
-    return m_owner->m_scrollLayer->children()[0]->contentBounds().height();
+        return m_owner->m_scrollLayer->children()[0]->bounds().width();
+    return m_owner->m_scrollLayer->children()[0]->bounds().height();
 }
 
 int CCScrollbarLayerImpl::CCScrollbar::maximum() const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
index db3f334ef..98d553446 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
@@ -28,9 +28,8 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "CCLayerImpl.h"
-#include "ManagedTexture.h"
 #include "ScrollbarThemeClient.h"
+#include "cc/CCLayerImpl.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 8f3052d93..f54ba7750 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -26,9 +26,10 @@
 
 #include "cc/CCSingleThreadProxy.h"
 
-#include "LayerRendererChromium.h"
 #include "TraceEvent.h"
+#include "cc/CCDrawQuad.h"
 #include "cc/CCFontAtlas.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTimer.h"
@@ -152,6 +153,12 @@ void CCSingleThreadProxy::setSurfaceReady()
     // Scheduling is controlled by the embedder in the single thread case, so nothing to do.
 }
 
+void CCSingleThreadProxy::setVisible(bool visible)
+{
+    DebugScopedSetImplThread impl;
+    m_layerTreeHostImpl->setVisible(visible);
+}
+
 bool CCSingleThreadProxy::initializeLayerRenderer()
 {
     ASSERT(CCProxy::isMainThread());
@@ -257,12 +264,6 @@ void CCSingleThreadProxy::setNeedsCommit()
     m_layerTreeHost->scheduleComposite();
 }
 
-void CCSingleThreadProxy::setNeedsForcedCommit()
-{
-    // This proxy doesn't block commits when not visible so use a normal commit.
-    setNeedsCommit();
-}
-
 void CCSingleThreadProxy::setNeedsRedraw()
 {
     // FIXME: Once we move render_widget scheduling into this class, we can
@@ -289,7 +290,8 @@ void CCSingleThreadProxy::stop()
         DebugScopedSetMainThreadBlocked mainThreadBlocked;
         DebugScopedSetImplThread impl;
 
-        m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+        if (!m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit())
+            m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
         m_layerTreeHostImpl.clear();
     }
     m_layerTreeHost = 0;
@@ -309,14 +311,6 @@ void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr
     m_layerTreeHost->setAnimationEvents(events, wallClockTime);
 }
 
-void CCSingleThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t bytes)
-{
-    ASSERT(CCProxy::isImplThread());
-    DebugScopedSetMainThread main;
-    ASSERT(m_layerTreeHost);
-    m_layerTreeHost->setContentsMemoryAllocationLimitBytes(bytes);
-}
-
 // Called by the legacy scheduling path (e.g. where render_widget does the scheduling)
 void CCSingleThreadProxy::compositeImmediately()
 {
@@ -344,11 +338,16 @@ bool CCSingleThreadProxy::commitAndComposite()
 {
     ASSERT(CCProxy::isMainThread());
 
-    CCTextureUpdater updater;
 
-    if (!m_layerTreeHost->updateLayers(updater))
+    if (!m_layerTreeHost->initializeLayerRendererIfNeeded())
         return false;
 
+    if (m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit())
+        m_layerTreeHost->evictAllContentTextures();
+
+    CCTextureUpdater updater;
+    m_layerTreeHost->updateLayers(updater, m_layerTreeHostImpl->memoryAllocationLimitBytes());
+
     m_layerTreeHost->willCommit();
     doCommit(updater);
     bool result = doComposite();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index d3253e25c..46cb302ac 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -26,7 +26,6 @@
 #define CCSingleThreadProxy_h
 
 #include "cc/CCAnimationEvents.h"
-#include "cc/CCCompletionEvent.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
 #include <limits>
@@ -50,6 +49,7 @@ public:
     virtual bool isStarted() const OVERRIDE;
     virtual bool initializeContext() OVERRIDE;
     virtual void setSurfaceReady() OVERRIDE;
+    virtual void setVisible(bool) OVERRIDE;
     virtual bool initializeLayerRenderer() OVERRIDE;
     virtual bool recreateContext() OVERRIDE;
     virtual int compositorIdentifier() const OVERRIDE { return m_compositorIdentifier; }
@@ -57,7 +57,6 @@ public:
     virtual void loseContext() OVERRIDE;
     virtual void setNeedsAnimate() OVERRIDE;
     virtual void setNeedsCommit() OVERRIDE;
-    virtual void setNeedsForcedCommit() OVERRIDE;
     virtual void setNeedsRedraw() OVERRIDE;
     virtual bool commitRequested() const OVERRIDE;
     virtual void didAddAnimation() OVERRIDE;
@@ -74,7 +73,6 @@ public:
     virtual void setNeedsRedrawOnImplThread() OVERRIDE { m_layerTreeHost->scheduleComposite(); }
     virtual void setNeedsCommitOnImplThread() OVERRIDE { m_layerTreeHost->scheduleComposite(); }
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE;
-    virtual void postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t) OVERRIDE;
 
     // Called by the legacy path where RenderWidget does the scheduling.
     void compositeImmediately();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp
index d1a4f7626..95564b635 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp
@@ -29,7 +29,6 @@
 
 #include "cc/CCSolidColorLayerImpl.h"
 
-#include "LayerRendererChromium.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include <wtf/MathExtras.h>
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureLayerImpl.cpp
index 44d9ff395..cad376076 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureLayerImpl.cpp
@@ -29,11 +29,7 @@
 
 #include "cc/CCTextureLayerImpl.h"
 
-#include "Extensions3DChromium.h"
-#include "GraphicsContext3D.h"
-#include "LayerRendererChromium.h"
-#include "cc/CCIOSurfaceDrawQuad.h"
-#include "cc/CCProxy.h"
+#include "TextStream.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCTextureDrawQuad.h"
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index e95555510..e2ecb9c58 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -27,12 +27,13 @@
 #include "cc/CCThreadProxy.h"
 
 #include "GraphicsContext3D.h"
-#include "LayerRendererChromium.h"
 #include "SharedGraphicsContext3D.h"
 #include "TraceEvent.h"
 #include "cc/CCDelayBasedTimeSource.h"
+#include "cc/CCDrawQuad.h"
 #include "cc/CCFontAtlas.h"
 #include "cc/CCFrameRateController.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCScheduler.h"
@@ -79,6 +80,7 @@ CCThreadProxy::CCThreadProxy(CCLayerTreeHost* layerTreeHost)
     , m_layerRendererInitialized(false)
     , m_started(false)
     , m_texturesAcquired(true)
+    , m_inCompositeAndReadback(false)
     , m_mainThreadProxy(CCScopedThreadProxy::create(CCProxy::mainThread()))
     , m_beginFrameCompletionEventOnImplThread(0)
     , m_readbackRequestOnImplThread(0)
@@ -103,7 +105,7 @@ bool CCThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
     ASSERT(isMainThread());
     ASSERT(m_layerTreeHost);
 
-    if (!m_layerRendererInitialized) {
+    if (!m_layerTreeHost->initializeLayerRendererIfNeeded()) {
         TRACE_EVENT("compositeAndReadback_EarlyOut_LR_Uninitialized", this, 0);
         return false;
     }
@@ -113,7 +115,9 @@ bool CCThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
     CCCompletionEvent beginFrameCompletion;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::forceBeginFrameOnImplThread, AllowCrossThreadAccess(&beginFrameCompletion)));
     beginFrameCompletion.wait();
+    m_inCompositeAndReadback = true;
     beginFrame();
+    m_inCompositeAndReadback = false;
 
     // Perform a synchronous readback.
     ReadbackRequest request;
@@ -202,6 +206,22 @@ void CCThreadProxy::setSurfaceReadyOnImplThread()
     m_schedulerOnImplThread->setCanBeginFrame(true);
 }
 
+void CCThreadProxy::setVisible(bool visible)
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::setVisible");
+    CCCompletionEvent completion;
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setVisibleOnImplThread, AllowCrossThreadAccess(&completion), visible));
+    completion.wait();
+}
+
+void CCThreadProxy::setVisibleOnImplThread(CCCompletionEvent* completion, bool visible)
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::setVisibleOnImplThread");
+    m_layerTreeHostImpl->setVisible(visible);
+    m_schedulerOnImplThread->setVisible(visible);
+    completion->signal();
+}
+
 bool CCThreadProxy::initializeLayerRenderer()
 {
     TRACE_EVENT("CCThreadProxy::initializeLayerRenderer", this, 0);
@@ -299,18 +319,6 @@ void CCThreadProxy::setNeedsCommit()
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsCommitOnImplThread));
 }
 
-void CCThreadProxy::setNeedsForcedCommit()
-{
-    ASSERT(isMainThread());
-    if (m_forcedCommitRequested)
-        return;
-
-    TRACE_EVENT("CCThreadProxy::setNeedsForcedCommit", this, 0);
-    m_commitRequested = true;
-    m_forcedCommitRequested = true;
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsForcedCommitOnImplThread));
-}
-
 void CCThreadProxy::didLoseContextOnImplThread()
 {
     ASSERT(isImplThread());
@@ -348,12 +356,6 @@ void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAni
     m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events, wallClockTime));
 }
 
-void CCThreadProxy::postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t bytes)
-{
-    ASSERT(isImplThread());
-    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setContentsMemoryAllocationLimitBytes, bytes));
-}
-
 void CCThreadProxy::setNeedsRedraw()
 {
     ASSERT(isMainThread());
@@ -455,6 +457,8 @@ void CCThreadProxy::scheduledActionBeginFrame()
     m_pendingBeginFrameRequest->scrollInfo = m_layerTreeHostImpl->processScrollDeltas();
     m_currentTextureUpdaterOnImplThread = adoptPtr(new CCTextureUpdater);
     m_pendingBeginFrameRequest->updater = m_currentTextureUpdaterOnImplThread.get();
+    m_pendingBeginFrameRequest->contentsTexturesWereDeleted = m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit();
+    m_pendingBeginFrameRequest->memoryAllocationLimitBytes = m_layerTreeHostImpl->memoryAllocationLimitBytes();
 
     m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::beginFrame));
 
@@ -497,9 +501,17 @@ void CCThreadProxy::beginFrame()
     // Re-do the commit flow so that we don't send the scrollInfo on the BFAC message.
     m_layerTreeHost->applyScrollAndScale(*request->scrollInfo);
 
+    if (!m_inCompositeAndReadback && !m_layerTreeHost->visible()) {
+        m_commitRequested = false;
+        m_forcedCommitRequested = false;
+
+        TRACE_EVENT0("cc", "EarlyOut_NotVisible");
+        CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::beginFrameAbortedOnImplThread));
+        return;
+    }
+
     m_layerTreeHost->willBeginFrame();
 
-    // FIXME: recreate the context if it was requested by the impl thread.
     m_layerTreeHost->updateAnimations(request->monotonicFrameBeginTime);
     m_layerTreeHost->layout();
 
@@ -509,9 +521,14 @@ void CCThreadProxy::beginFrame()
     m_commitRequested = false;
     m_forcedCommitRequested = false;
 
-    if (!m_layerTreeHost->updateLayers(*request->updater))
+    if (!m_layerTreeHost->initializeLayerRendererIfNeeded())
         return;
 
+    if (request->contentsTexturesWereDeleted)
+        m_layerTreeHost->evictAllContentTextures();
+
+    m_layerTreeHost->updateLayers(*request->updater, request->memoryAllocationLimitBytes);
+
     // Once single buffered layers are committed, they cannot be modified until
     // they are drawn by the impl thread.
     m_texturesAcquired = false;
@@ -558,6 +575,16 @@ void CCThreadProxy::beginFrameCompleteOnImplThread(CCCompletionEvent* completion
     m_schedulerOnImplThread->beginFrameComplete();
 }
 
+void CCThreadProxy::beginFrameAbortedOnImplThread()
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::beginFrameAbortedOnImplThread");
+    ASSERT(isImplThread());
+    ASSERT(m_schedulerOnImplThread);
+    ASSERT(m_schedulerOnImplThread->commitPending());
+
+    m_schedulerOnImplThread->beginFrameAborted();
+}
+
 bool CCThreadProxy::hasMoreResourceUpdates() const
 {
     if (!m_currentTextureUpdaterOnImplThread)
@@ -658,9 +685,7 @@ CCScheduledActionDrawAndSwapResult CCThreadProxy::scheduledActionDrawAndSwapInte
         }
         m_readbackRequestOnImplThread->completion.signal();
         m_readbackRequestOnImplThread = 0;
-    }
-
-    if (drawFrame)
+    } else if (drawFrame)
         result.didSwap = m_layerTreeHostImpl->swapBuffers();
 
     // Tell the main thread that the the newly-commited frame was drawn.
@@ -743,14 +768,6 @@ void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> event
     m_layerTreeHost->setAnimationEvents(events, wallClockTime);
 }
 
-void CCThreadProxy::setContentsMemoryAllocationLimitBytes(size_t bytes)
-{
-    ASSERT(isMainThread());
-    if (!m_layerTreeHost)
-        return;
-    m_layerTreeHost->setContentsMemoryAllocationLimitBytes(bytes);
-}
-
 class CCThreadProxyContextRecreationTimer : public CCTimer, CCTimerClient {
 public:
     static PassOwnPtr<CCThreadProxyContextRecreationTimer> create(CCThreadProxy* proxy) { return adoptPtr(new CCThreadProxyContextRecreationTimer(proxy)); }
@@ -833,7 +850,8 @@ void CCThreadProxy::layerTreeHostClosedOnImplThread(CCCompletionEvent* completio
 {
     TRACE_EVENT("CCThreadProxy::layerTreeHostClosedOnImplThread", this, 0);
     ASSERT(isImplThread());
-    m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+    if (!m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit())
+        m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
     m_inputHandlerOnImplThread.clear();
     m_layerTreeHostImpl.clear();
     m_schedulerOnImplThread.clear();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index 2c2beb012..572f9f488 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -30,8 +30,6 @@
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
 #include "cc/CCScheduler.h"
-#include "cc/CCThread.h"
-#include "cc/CCTimer.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -58,6 +56,7 @@ public:
     virtual bool isStarted() const OVERRIDE;
     virtual bool initializeContext() OVERRIDE;
     virtual void setSurfaceReady() OVERRIDE;
+    virtual void setVisible(bool) OVERRIDE;
     virtual bool initializeLayerRenderer() OVERRIDE;
     virtual bool recreateContext() OVERRIDE;
     virtual int compositorIdentifier() const OVERRIDE;
@@ -65,7 +64,6 @@ public:
     virtual void loseContext() OVERRIDE;
     virtual void setNeedsAnimate() OVERRIDE;
     virtual void setNeedsCommit() OVERRIDE;
-    virtual void setNeedsForcedCommit() OVERRIDE;
     virtual void setNeedsRedraw() OVERRIDE;
     virtual bool commitRequested() const OVERRIDE;
     virtual void didAddAnimation() OVERRIDE { }
@@ -82,7 +80,6 @@ public:
     virtual void setNeedsRedrawOnImplThread() OVERRIDE;
     virtual void setNeedsCommitOnImplThread() OVERRIDE;
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE;
-    virtual void postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t) OVERRIDE;
 
     // CCSchedulerClient implementation
     virtual bool canDraw() OVERRIDE;
@@ -110,6 +107,8 @@ private:
         double monotonicFrameBeginTime;
         OwnPtr<CCScrollAndScaleSet> scrollInfo;
         CCTextureUpdater* updater;
+        bool contentsTexturesWereDeleted;
+        size_t memoryAllocationLimitBytes;
     };
     OwnPtr<BeginFrameAndCommitState> m_pendingBeginFrameRequest;
 
@@ -118,7 +117,6 @@ private:
     void didCommitAndDrawFrame();
     void didCompleteSwapBuffers();
     void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
-    void setContentsMemoryAllocationLimitBytes(size_t);
     void beginContextRecreation();
     void tryToRecreateContext();
 
@@ -131,11 +129,13 @@ private:
     };
     void forceBeginFrameOnImplThread(CCCompletionEvent*);
     void beginFrameCompleteOnImplThread(CCCompletionEvent*);
+    void beginFrameAbortedOnImplThread();
     void requestReadbackOnImplThread(ReadbackRequest*);
     void requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec);
     void finishAllRenderingOnImplThread(CCCompletionEvent*);
     void initializeImplOnImplThread(CCCompletionEvent*);
     void setSurfaceReadyOnImplThread();
+    void setVisibleOnImplThread(CCCompletionEvent*, bool);
     void initializeContextOnImplThread(CCGraphicsContext*);
     void initializeLayerRendererOnImplThread(CCCompletionEvent*, bool* initializeSucceeded, LayerRendererCapabilities*);
     void layerTreeHostClosedOnImplThread(CCCompletionEvent*);
@@ -159,6 +159,7 @@ private:
     LayerRendererCapabilities m_layerRendererCapabilitiesMainThreadCopy;
     bool m_started;
     bool m_texturesAcquired;
+    bool m_inCompositeAndReadback;
 
     OwnPtr<CCLayerTreeHostImpl> m_layerTreeHostImpl;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index efecabd1d..984c3b7be 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -29,9 +29,10 @@
 
 #include "cc/CCTiledLayerImpl.h"
 
-#include "LayerRendererChromium.h"
+#include "TextStream.h"
 #include "cc/CCCheckerboardDrawQuad.h"
 #include "cc/CCDebugBorderDrawQuad.h"
+#include "cc/CCLayerTilingData.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCSolidColorDrawQuad.h"
 #include "cc/CCTileDrawQuad.h"
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
index f588c9cf5..131a32fce 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
@@ -26,13 +26,12 @@
 #ifndef CCTiledLayerImpl_h
 #define CCTiledLayerImpl_h
 
-#include "LayerTextureUpdater.h"
 #include "cc/CCLayerImpl.h"
-#include "cc/CCLayerTilingData.h"
 #include <public/WebTransformationMatrix.h>
 
 namespace WebCore {
 
+class CCLayerTilingData;
 class DrawableTile;
 
 class CCTiledLayerImpl : public CCLayerImpl {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
index ba9eccc95..396d81a55 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.cpp
@@ -29,8 +29,11 @@
  */
 
 #include "config.h"
+
 #include "cc/CCTimer.h"
 
+#include "cc/CCThread.h"
+
 namespace WebCore {
 
 class CCTimerTask : public CCThread::Task {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.h b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.h
index a845190d9..d3288c63c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTimer.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimer.h
@@ -31,10 +31,10 @@
 #ifndef CCTimer_h
 #define CCTimer_h
 
-#include "cc/CCThread.h"
 
 namespace WebCore {
 
+class CCThread;
 class CCTimerTask;
 
 class CCTimerClient {
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index a14b4bf8a..dbb07a004 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -31,11 +31,12 @@
 
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
-#include "LayerRendererChromium.h"
+#include "LayerRendererChromium.h" // For GLC macro
 #include "LayerTextureSubImage.h"
 #include "NotImplemented.h"
-#include "ProgramBinding.h"
+#include "TextStream.h"
 #include "TextureManager.h" // For TextureAllocator
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
 #include "cc/CCQuadCuller.h"
@@ -75,7 +76,7 @@ CCVideoLayerImpl::~CCVideoLayerImpl()
         m_provider->setVideoFrameProviderClient(0);
         m_provider = 0;
     }
-    freePlaneData(layerTreeHostImpl()->layerRenderer());
+    freePlaneData(layerTreeHostImpl()->context());
 
 #if !ASSERT_DISABLED
     for (unsigned i = 0; i < WebKit::WebVideoFrame::maxPlanes; ++i)
@@ -125,7 +126,7 @@ void CCVideoLayerImpl::willDraw(CCRenderer* layerRenderer, CCGraphicsContext* co
     m_providerMutex.lock();
 
     willDrawInternal(layerRenderer, context);
-    freeUnusedPlaneData(layerRenderer);
+    freeUnusedPlaneData(context);
 
     if (!m_frame)
         m_providerMutex.unlock();
@@ -159,7 +160,7 @@ void CCVideoLayerImpl::willDrawInternal(CCRenderer* layerRenderer, CCGraphicsCon
         return;
     }
 
-    if (!allocatePlaneData(layerRenderer)) {
+    if (!allocatePlaneData(layerRenderer, context)) {
         m_provider->putCurrentFrame(m_frame);
         m_frame = 0;
         return;
@@ -282,25 +283,43 @@ IntSize CCVideoLayerImpl::computeVisibleSize(const WebKit::WebVideoFrame& frame,
     return IntSize(visibleWidth, visibleHeight);
 }
 
-bool CCVideoLayerImpl::FramePlane::allocateData(CCRenderer* layerRenderer)
+bool CCVideoLayerImpl::FramePlane::allocateData(CCGraphicsContext* context)
 {
     if (textureId)
         return true;
 
-    textureId = layerRenderer->contentsTextureAllocator()->createTexture(size, format);
+    GraphicsContext3D* context3D = context->context3D();
+    if (!context3D)
+        return false;
+
+    GLC(context3D, textureId = context3D->createTexture());
+    GLC(context3D, context3D->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
+    // Do basic linear filtering on resize.
+    GLC(context3D, context3D->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
+    GLC(context3D, context3D->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR));
+    // NPOT textures in GL ES only work when the wrap mode is set to GraphicsContext3D::CLAMP_TO_EDGE.
+    GLC(context3D, context3D->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
+    GLC(context3D, context3D->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
+
+    GLC(context3D, context3D->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, format, size.width(), size.height(), 0, format, GraphicsContext3D::UNSIGNED_BYTE));
+
     return textureId;
 }
 
-void CCVideoLayerImpl::FramePlane::freeData(CCRenderer* layerRenderer)
+void CCVideoLayerImpl::FramePlane::freeData(CCGraphicsContext* context)
 {
     if (!textureId)
         return;
 
-    layerRenderer->contentsTextureAllocator()->deleteTexture(textureId, size, format);
+    GraphicsContext3D* context3D = context->context3D();
+    if (!context3D)
+        return;
+
+    GLC(context3D, context3D->deleteTexture(textureId));
     textureId = 0;
 }
 
-bool CCVideoLayerImpl::allocatePlaneData(CCRenderer* layerRenderer)
+bool CCVideoLayerImpl::allocatePlaneData(CCRenderer* layerRenderer, CCGraphicsContext* context)
 {
     int maxTextureSize = layerRenderer->capabilities().maxTextureSize;
     for (unsigned planeIndex = 0; planeIndex < m_frame->planes(); ++planeIndex) {
@@ -312,13 +331,13 @@ bool CCVideoLayerImpl::allocatePlaneData(CCRenderer* layerRenderer)
             return false;
 
         if (plane.size != requiredTextureSize || plane.format != m_format) {
-            plane.freeData(layerRenderer);
+            plane.freeData(context);
             plane.size = requiredTextureSize;
             plane.format = m_format;
         }
 
         if (!plane.textureId) {
-            if (!plane.allocateData(layerRenderer))
+            if (!plane.allocateData(context))
                 return false;
             plane.visibleSize = computeVisibleSize(*m_frame, planeIndex);
         }
@@ -351,17 +370,17 @@ bool CCVideoLayerImpl::copyPlaneData(CCRenderer* layerRenderer, CCGraphicsContex
     return true;
 }
 
-void CCVideoLayerImpl::freePlaneData(CCRenderer* layerRenderer)
+void CCVideoLayerImpl::freePlaneData(CCGraphicsContext* context)
 {
     for (unsigned i = 0; i < WebKit::WebVideoFrame::maxPlanes; ++i)
-        m_framePlanes[i].freeData(layerRenderer);
+        m_framePlanes[i].freeData(context);
 }
 
-void CCVideoLayerImpl::freeUnusedPlaneData(CCRenderer* layerRenderer)
+void CCVideoLayerImpl::freeUnusedPlaneData(CCGraphicsContext* context)
 {
     unsigned firstUnusedPlane = m_frame ? m_frame->planes() : 0;
     for (unsigned i = firstUnusedPlane; i < WebKit::WebVideoFrame::maxPlanes; ++i)
-        m_framePlanes[i].freeData(layerRenderer);
+        m_framePlanes[i].freeData(context);
 }
 
 void CCVideoLayerImpl::didReceiveFrame()
@@ -381,7 +400,7 @@ void CCVideoLayerImpl::didUpdateMatrix(const float matrix[16])
 
 void CCVideoLayerImpl::didLoseContext()
 {
-    freePlaneData(layerTreeHostImpl()->layerRenderer());
+    freePlaneData(layerTreeHostImpl()->context());
 }
 
 void CCVideoLayerImpl::setNeedsRedraw()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index bef1d5f09..b2e088fcf 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -75,8 +75,8 @@ public:
 
         FramePlane() : textureId(0) { }
 
-        bool allocateData(CCRenderer*);
-        void freeData(CCRenderer*);
+        bool allocateData(CCGraphicsContext*);
+        void freeData(CCGraphicsContext*);
     };
 
 private:
@@ -86,10 +86,10 @@ private:
     virtual const char* layerTypeAsString() const OVERRIDE { return "VideoLayer"; }
 
     void willDrawInternal(CCRenderer*, CCGraphicsContext*);
-    bool allocatePlaneData(CCRenderer*);
+    bool allocatePlaneData(CCRenderer*, CCGraphicsContext*);
     bool copyPlaneData(CCRenderer*, CCGraphicsContext*);
-    void freePlaneData(CCRenderer*);
-    void freeUnusedPlaneData(CCRenderer*);
+    void freePlaneData(CCGraphicsContext*);
+    void freeUnusedPlaneData(CCGraphicsContext*);
 
     // Guards the destruction of m_provider and the frame that it provides
     Mutex m_providerMutex;
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
index 511c22413..c5771739d 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,14 +30,15 @@
 #include "config.h"
 
 #if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
-#include "CustomFilterShader.h"
+#include "CustomFilterCompiledProgram.h"
+ 
 #include "GraphicsContext3D.h"
 
 namespace WebCore {
 
 #define SHADER(Src) (#Src)
 
-String CustomFilterShader::defaultVertexShaderString()
+String CustomFilterCompiledProgram::defaultVertexShaderString()
 {
     DEFINE_STATIC_LOCAL(String, vertexShaderString, SHADER(
         precision mediump float;
@@ -54,7 +55,7 @@ String CustomFilterShader::defaultVertexShaderString()
     return vertexShaderString;
 }
 
-String CustomFilterShader::defaultFragmentShaderString()
+String CustomFilterCompiledProgram::defaultFragmentShaderString()
 {
     DEFINE_STATIC_LOCAL(String, fragmentShaderString, SHADER(
         precision mediump float;
@@ -68,7 +69,7 @@ String CustomFilterShader::defaultFragmentShaderString()
     return fragmentShaderString;
 }
 
-CustomFilterShader::CustomFilterShader(GraphicsContext3D* context, const String& vertexShaderString, const String& fragmentShaderString)
+CustomFilterCompiledProgram::CustomFilterCompiledProgram(GraphicsContext3D* context, const String& vertexShaderString, const String& fragmentShaderString)
     : m_context(context)
     , m_vertexShaderString(!vertexShaderString.isNull() ? vertexShaderString : defaultVertexShaderString())
     , m_fragmentShaderString(!fragmentShaderString.isNull() ? fragmentShaderString : defaultFragmentShaderString())
@@ -109,7 +110,7 @@ CustomFilterShader::CustomFilterShader(GraphicsContext3D* context, const String&
     m_isInitialized = true;
 }
 
-Platform3DObject CustomFilterShader::compileShader(GC3Denum shaderType, const String& shaderString)
+Platform3DObject CustomFilterCompiledProgram::compileShader(GC3Denum shaderType, const String& shaderString)
 {
     Platform3DObject shader = m_context->createShader(shaderType);
     m_context->shaderSource(shader, shaderString);
@@ -127,7 +128,7 @@ Platform3DObject CustomFilterShader::compileShader(GC3Denum shaderType, const St
     return shader;
 }
 
-Platform3DObject CustomFilterShader::linkProgram(Platform3DObject vertexShader, Platform3DObject fragmentShader)
+Platform3DObject CustomFilterCompiledProgram::linkProgram(Platform3DObject vertexShader, Platform3DObject fragmentShader)
 {
     Platform3DObject program = m_context->createProgram();
     m_context->attachShader(program, vertexShader);
@@ -146,7 +147,7 @@ Platform3DObject CustomFilterShader::linkProgram(Platform3DObject vertexShader,
     return program;
 }
 
-void CustomFilterShader::initializeParameterLocations()
+void CustomFilterCompiledProgram::initializeParameterLocations()
 {
     m_positionAttribLocation = m_context->getAttribLocation(m_program, "a_position");
     m_texAttribLocation = m_context->getAttribLocation(m_program, "a_texCoord");
@@ -161,14 +162,14 @@ void CustomFilterShader::initializeParameterLocations()
     m_contentSamplerLocation = m_context->getUniformLocation(m_program, "u_contentTexture");
 }
 
-int CustomFilterShader::uniformLocationByName(const String& name)
+int CustomFilterCompiledProgram::uniformLocationByName(const String& name)
 {
     ASSERT(m_isInitialized);
     // FIXME: Improve this by caching the uniform locations.
     return m_context->getUniformLocation(m_program, name);
 }
     
-CustomFilterShader::~CustomFilterShader()
+CustomFilterCompiledProgram::~CustomFilterCompiledProgram()
 {
     if (m_program)
         m_context->deleteProgram(m_program);
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
index af35bb1cf..b0c449c3b 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
  * SUCH DAMAGE.
  */
 
-#ifndef CustomFilterShader_h
-#define CustomFilterShader_h
+#ifndef CustomFilterCompiledProgram_h
+#define CustomFilterCompiledProgram_h
 
 #if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
 
@@ -40,14 +40,14 @@ namespace WebCore {
 
 class GraphicsContext3D;
 
-class CustomFilterShader: public RefCounted<CustomFilterShader> {
+class CustomFilterCompiledProgram: public RefCounted<CustomFilterCompiledProgram> {
 public:
-    static PassRefPtr<CustomFilterShader> create(GraphicsContext3D* context, const String& vertexShader, const String& fragmentShader)
+    static PassRefPtr<CustomFilterCompiledProgram> create(GraphicsContext3D* context, const String& vertexShader, const String& fragmentShader)
     {
-        return adoptRef(new CustomFilterShader(context, vertexShader, fragmentShader));
+        return adoptRef(new CustomFilterCompiledProgram(context, vertexShader, fragmentShader));
     }
     
-    ~CustomFilterShader();
+    ~CustomFilterCompiledProgram();
     
     String vertexShaderString() const { return m_vertexShaderString; }
     String fragmentShaderString() const { return m_fragmentShaderString; }
@@ -71,7 +71,7 @@ public:
     Platform3DObject program() const { return m_program; }
 
 private:
-    CustomFilterShader(GraphicsContext3D*, const String& vertexShader, const String& fragmentShader);
+    CustomFilterCompiledProgram(GraphicsContext3D*, const String& vertexShader, const String& fragmentShader);
     
     Platform3DObject compileShader(GC3Denum shaderType, const String& shaderString);
     Platform3DObject linkProgram(Platform3DObject vertexShader, Platform3DObject fragmentShader);
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index 130441a1c..fe43640c6 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -32,8 +32,8 @@
 #if ENABLE(CSS_SHADERS)
 #include "CustomFilterProgram.h"
 
+#include "CustomFilterCompiledProgram.h"
 #include "CustomFilterProgramClient.h"
-#include "CustomFilterShader.h"
 
 #if ENABLE(WEBGL)
 #include "GraphicsContext3D.h"
@@ -81,10 +81,10 @@ void CustomFilterProgram::notifyClients()
 }
 
 #if ENABLE(WEBGL)
-PassRefPtr<CustomFilterShader> CustomFilterProgram::createShaderWithContext(GraphicsContext3D* context)
+PassRefPtr<CustomFilterCompiledProgram> CustomFilterProgram::compileProgramWithContext(GraphicsContext3D* context)
 {
     ASSERT(isLoaded());
-    return CustomFilterShader::create(context, vertexShaderString(), fragmentShaderString());
+    return CustomFilterCompiledProgram::create(context, vertexShaderString(), fragmentShaderString());
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index e08cbb76e..12292a100 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -39,7 +39,7 @@
 namespace WebCore {
 
 class GraphicsContext3D;
-class CustomFilterShader;
+class CustomFilterCompiledProgram;
 class CustomFilterProgramClient;
 
 // This is the base class for the StyleCustomFilterProgram class which knows how to keep
@@ -54,7 +54,7 @@ public:
     void removeClient(CustomFilterProgramClient*);
     
 #if ENABLE(WEBGL)
-    PassRefPtr<CustomFilterShader> createShaderWithContext(GraphicsContext3D*);
+    PassRefPtr<CustomFilterCompiledProgram> compileProgramWithContext(GraphicsContext3D*);
 #endif
 
     // StyleCustomFilterProgram has the only implementation for the following method. That means, it casts to StyleCustomFilterProgram
@@ -63,7 +63,7 @@ public:
     bool operator!=(const CustomFilterProgram& o) const { return !(*this == o); }
 protected:
     // StyleCustomFilterProgram can notify the clients that the cached resources are
-    // loaded and it is ready to create CustomFilterShader objects.
+    // loaded and it is ready to create CustomFilterCompiledProgram objects.
     void notifyClients();
     
     virtual String vertexShaderString() const = 0;
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 49f8cc6ba..ac05941cd 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -32,12 +32,12 @@
 #if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
 #include "FECustomFilter.h"
 
+#include "CustomFilterCompiledProgram.h"
 #include "CustomFilterGlobalContext.h"
 #include "CustomFilterMesh.h"
 #include "CustomFilterNumberParameter.h"
 #include "CustomFilterParameter.h"
 #include "CustomFilterProgram.h"
-#include "CustomFilterShader.h"
 #include "DrawingBuffer.h"
 #include "GraphicsContext3D.h"
 #include "ImageData.h"
@@ -74,7 +74,7 @@ static void orthogonalProjectionMatrix(TransformationMatrix& matrix, float left,
 }
 
 FECustomFilter::FECustomFilter(Filter* filter, CustomFilterGlobalContext* customFilterGlobalContext, PassRefPtr<CustomFilterProgram> program, const CustomFilterParameterList& parameters,
-                               unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType meshBoxType,
+                               unsigned meshRows, unsigned meshColumns, CustomFilterOperation::MeshBoxType,
                                CustomFilterOperation::MeshType meshType)
     : FilterEffect(filter)
     , m_globalContext(customFilterGlobalContext)
@@ -85,7 +85,6 @@ FECustomFilter::FECustomFilter(Filter* filter, CustomFilterGlobalContext* custom
     , m_parameters(parameters)
     , m_meshRows(meshRows)
     , m_meshColumns(meshColumns)
-    , m_meshBoxType(meshBoxType)
     , m_meshType(meshType)
 {
 }
@@ -141,7 +140,7 @@ void FECustomFilter::platformApplySoftware()
         return;
     
     // The shader had compiler errors. We cannot draw anything.
-    if (!m_shader->isInitialized())
+    if (!m_compiledProgram->isInitialized())
         return;
 
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_frameBuffer);
@@ -167,7 +166,7 @@ void FECustomFilter::initializeContext()
     // FIXME: The shader and the mesh can be shared across multiple elements when possible.
     // Sharing the shader means it's no need to analyze / compile and upload to GPU again.
     // https://bugs.webkit.org/show_bug.cgi?id=88427
-    m_shader = m_program->createShaderWithContext(m_context.get());
+    m_compiledProgram = m_program->compileProgramWithContext(m_context.get());
 
     // FIXME: Sharing the mesh would just save the time needed to upload it to the GPU, so I assume we could
     // benchmark that for performance.
@@ -245,7 +244,7 @@ void FECustomFilter::bindProgramParameters()
     size_t parametersSize = m_parameters.size();
     for (size_t i = 0; i < parametersSize; ++i) {
         CustomFilterParameter* parameter = m_parameters.at(i).get();
-        int uniformLocation = m_shader->uniformLocationByName(parameter->name());
+        int uniformLocation = m_compiledProgram->uniformLocationByName(parameter->name());
         if (uniformLocation == -1)
             continue;
         switch (parameter->parameterType()) {
@@ -258,32 +257,32 @@ void FECustomFilter::bindProgramParameters()
 
 void FECustomFilter::bindProgramAndBuffers(Uint8ClampedArray* srcPixelArray)
 {
-    m_context->useProgram(m_shader->program());
+    m_context->useProgram(m_compiledProgram->program());
     
-    if (m_shader->samplerLocation() != -1) {
+    if (m_compiledProgram->samplerLocation() != -1) {
         m_context->activeTexture(GraphicsContext3D::TEXTURE0);
-        m_context->uniform1i(m_shader->samplerLocation(), 0);
+        m_context->uniform1i(m_compiledProgram->samplerLocation(), 0);
         m_inputTexture->load(srcPixelArray->data());
         m_inputTexture->bindTile(0);
     }
     
-    if (m_shader->projectionMatrixLocation() != -1) {
+    if (m_compiledProgram->projectionMatrixLocation() != -1) {
         TransformationMatrix projectionMatrix; 
         orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
         float glProjectionMatrix[16];
         projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
-        m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
+        m_context->uniformMatrix4fv(m_compiledProgram->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
     }
     
     m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_mesh->verticesBufferObject());
     m_context->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, m_mesh->elementsBufferObject());
 
     unsigned offset = 0;
-    bindVertexAttribute(m_shader->positionAttribLocation(), 4, offset);
-    bindVertexAttribute(m_shader->texAttribLocation(), 2, offset);
-    bindVertexAttribute(m_shader->meshAttribLocation(), 2, offset);
+    bindVertexAttribute(m_compiledProgram->positionAttribLocation(), 4, offset);
+    bindVertexAttribute(m_compiledProgram->texAttribLocation(), 2, offset);
+    bindVertexAttribute(m_compiledProgram->meshAttribLocation(), 2, offset);
     if (m_meshType == CustomFilterOperation::DETACHED)
-        bindVertexAttribute(m_shader->triangleAttribLocation(), 3, offset);
+        bindVertexAttribute(m_compiledProgram->triangleAttribLocation(), 3, offset);
     
     bindProgramParameters();
 }
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 03b9f801a..3c731abcc 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -49,7 +49,7 @@ class CustomFilterGlobalContext;
 class CustomFilterMesh;
 class CustomFilterNumberParameter;
 class CustomFilterProgram;
-class CustomFilterShader;
+class CustomFilterCompiledProgram;
 class DrawingBuffer;
 class GraphicsContext3D;
 class IntSize;
@@ -85,7 +85,7 @@ private:
     
     RefPtr<GraphicsContext3D> m_context;
     RefPtr<Texture> m_inputTexture;
-    RefPtr<CustomFilterShader> m_shader;
+    RefPtr<CustomFilterCompiledProgram> m_compiledProgram;
     RefPtr<CustomFilterMesh> m_mesh;
     IntSize m_contextSize;
 
@@ -98,7 +98,6 @@ private:
 
     unsigned m_meshRows;
     unsigned m_meshColumns;
-    CustomFilterOperation::MeshBoxType m_meshBoxType;
     CustomFilterOperation::MeshType m_meshType;
 };
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/ImageGStreamerQt.cpp b/Source/WebCore/platform/graphics/gstreamer/ImageGStreamerQt.cpp
index e5e58df2d..503c13dd3 100644
--- a/Source/WebCore/platform/graphics/gstreamer/ImageGStreamerQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/ImageGStreamerQt.cpp
@@ -50,18 +50,32 @@ ImageGStreamer::ImageGStreamer(GstBuffer* buffer, GstCaps* caps)
     uchar* bufferData = reinterpret_cast<uchar*>(GST_BUFFER_DATA(buffer));
 #endif
     QImage::Format imageFormat;
+    QImage::InvertMode invertMode;
 #if G_BYTE_ORDER == G_LITTLE_ENDIAN
-    imageFormat = (format == GST_VIDEO_FORMAT_BGRA) ? QImage::Format_RGB32 : QImage::Format_RGB888;
+    if (format == GST_VIDEO_FORMAT_BGRA) {
+        imageFormat = QImage::Format_ARGB32;
+        invertMode = QImage::InvertRgba;
+    } else {
+        imageFormat = QImage::Format_RGB32;
+        invertMode = QImage::InvertRgb;
+    }
 #else
-    imageFormat = (format == GST_VIDEO_FORMAT_ARGB) ? QImage::Format_ARGB32 : QImage::Format_RGB888;
+    imageFormat = (format == GST_VIDEO_FORMAT_ARGB) ? QImage::Format_ARGB32 : QImage::Format_RGB32;
 #endif
 
     QImage image(bufferData, size.width(), size.height(), imageFormat);
 
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+    image.invertPixels(invertMode);
+#endif
+
     surface->convertFromImage(image);
     m_image = BitmapImage::create(surface);
 
 #ifdef GST_API_VERSION_1
+    if (GstVideoCropMeta* cropMeta = gst_buffer_get_video_crop_meta(buffer))
+        setCropRect(FloatRect(cropMeta->x, cropMeta->y, cropMeta->width, cropMeta->height));
+
     gst_buffer_unmap(buffer, &info);
 #endif
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index 05b78b089..d2854486b 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -1586,7 +1586,7 @@ void MediaPlayerPrivateGStreamer::getSupportedTypes(HashSet<String>& types)
     types = mimeTypeCache();
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivateGStreamer::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivateGStreamer::supportsType(const String& type, const String& codecs, const KURL&)
 {
     if (type.isNull() || type.isEmpty())
         return MediaPlayer::IsNotSupported;
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index 4a056a29b..506942c2b 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -130,7 +130,8 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
 
             static void getSupportedTypes(HashSet<String>&);
-            static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+            static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
+
             static bool isAvailable();
 
             void updateAudioSink();
diff --git a/Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
index fdb6f4c02..456e400c0 100644
--- a/Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/VideoSinkGStreamer.cpp
@@ -391,14 +391,7 @@ static void webkit_video_sink_class_init(WebKitVideoSinkClass* klass)
     GstElementClass* elementClass = GST_ELEMENT_CLASS(klass);
 
     gst_element_class_add_pad_template(elementClass, gst_static_pad_template_get(&s_sinkTemplate));
-#ifdef GST_API_VERSION_1
-    gst_element_class_set_metadata(elementClass,
-#else
-    gst_element_class_set_details_simple(elementClass,
-#endif
-            "WebKit video sink",
-            "Sink/Video", "Sends video data from a GStreamer pipeline to a Cairo surface",
-            "Alp Toker <alp@atoker.com>");
+    setGstElementClassMetadata(elementClass, "WebKit video sink", "Sink/Video", "Sends video data from a GStreamer pipeline to a Cairo surface", "Alp Toker <alp@atoker.com>");
 
     g_type_class_add_private(klass, sizeof(WebKitVideoSinkPrivate));
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index c5d7690bc..38aaec1f7 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -24,6 +24,7 @@
 #include "Document.h"
 #include "Frame.h"
 #include "GRefPtrGStreamer.h"
+#include "GStreamerVersioning.h"
 #include "MediaPlayer.h"
 #include "NetworkingContext.h"
 #include "NotImplemented.h"
@@ -155,15 +156,8 @@ static void webkit_web_src_class_init(WebKitWebSrcClass* klass)
 
     gst_element_class_add_pad_template(eklass,
                                        gst_static_pad_template_get(&srcTemplate));
-#ifdef GST_API_VERSION_1
-    gst_element_class_set_metadata(eklass,
-#else
-    gst_element_class_set_details_simple(eklass,
-#endif
-                                         (gchar*) "WebKit Web source element",
-                                         (gchar*) "Source",
-                                         (gchar*) "Handles HTTP/HTTPS uris",
-                                         (gchar*) "Sebastian Dröge <sebastian.droege@collabora.co.uk>");
+    setGstElementClassMetadata(eklass, "WebKit Web source element", "Source", "Handles HTTP/HTTPS uris",
+                               "Sebastian Dröge <sebastian.droege@collabora.co.uk>");
 
     // icecast stuff
     g_object_class_install_property(oklass,
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 20c855f36..d38265fa5 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -75,7 +75,7 @@ private:
     // engine support
     static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
     static void getSupportedTypes(HashSet<String>& types);
-    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
     static void getSitesInMediaCache(Vector<String>&);
     static void clearMediaCache();
     static void clearMediaCacheForSite(const String&);
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index 32f344c0f..cd161a3f2 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -1501,7 +1501,7 @@ void MediaPlayerPrivateQTKit::getSupportedTypes(HashSet<String>& supportedTypes)
         supportedTypes.add(*it);
 } 
 
-MediaPlayer::SupportsType MediaPlayerPrivateQTKit::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivateQTKit::supportsType(const String& type, const String& codecs, const KURL&)
 {
     // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask QT if it supports an
     // extended MIME type yet.
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index 0d33b9230..4aa341c32 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -201,6 +201,12 @@ String Extensions3DOpenGL::getTranslatedShaderSourceANGLE(Platform3DObject shade
     // FIXME: implement this function and add GL_ANGLE_translated_shader_source in supports().
 }
 
+void Extensions3DOpenGL::copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum)
+{
+    // FIXME: implement this function and add GL_CHROMIUM_copy_texture in supports().
+    return;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
index 55a3cd836..2b2d30a09 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
@@ -51,6 +51,7 @@ public:
     virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
     virtual void bindVertexArrayOES(Platform3DObject);
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
+    virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
 private:
     // This class only needs to be instantiated by GraphicsContext3D implementations.
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index 27c8366ef..593e63e9a 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -93,6 +93,11 @@ String Extensions3DQt::getTranslatedShaderSourceANGLE(Platform3DObject shader)
     return "";
 }
 
+void Extensions3DQt::copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum)
+{
+    return;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h b/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
index 2664003d5..d9bd748bf 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
@@ -46,6 +46,7 @@ public:
     virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
     virtual void bindVertexArrayOES(Platform3DObject);
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
+    virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
 private:
     // This class only needs to be instantiated by GraphicsContext3D implementations.
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 3a307cb27..794bc1036 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -81,7 +81,7 @@ void MediaPlayerPrivateQt::getSupportedTypes(HashSet<String> &supported)
     }
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivateQt::supportsType(const String& mime, const String& codec)
+MediaPlayer::SupportsType MediaPlayerPrivateQt::supportsType(const String& mime, const String& codec, const KURL&)
 {
     if (!mime.startsWith("audio/") && !mime.startsWith("video/"))
         return MediaPlayer::IsNotSupported;
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index c6fcbd838..a129e5de5 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -51,7 +51,7 @@ public:
 
     static void registerMediaEngine(MediaEngineRegistrar);
     static void getSupportedTypes(HashSet<String>&);
-    static MediaPlayer::SupportsType supportsType(const String&, const String&);
+    static MediaPlayer::SupportsType supportsType(const String&, const String&, const KURL&);
     static bool isAvailable() { return true; }
 
     bool hasVideo() const;
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 1fa246eee..ee8b92248 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -36,8 +36,10 @@
 #include "Base64.h"
 #include "BitmapImage.h"
 #include "BitmapImageSingleFrameSkia.h"
+#include "Extensions3D.h"
 #include "GrContext.h"
 #include "GraphicsContext.h"
+#include "GraphicsContext3D.h"
 #include "ImageData.h"
 #include "JPEGImageEncoder.h"
 #include "MIMETypeRegistry.h"
@@ -166,6 +168,33 @@ PlatformLayer* ImageBuffer::platformLayer() const
     return m_data.m_layerBridge ? m_data.m_layerBridge->layer() : 0;
 }
 
+bool ImageBuffer::copyToPlatformTexture(GraphicsContext3D& context, Platform3DObject texture, GC3Denum internalFormat, bool premultiplyAlpha, bool flipY)
+{
+    if (!m_data.m_layerBridge || !platformLayer())
+        return false;
+
+    Platform3DObject sourceTexture = m_data.m_layerBridge->backBufferTexture();
+
+    if (!context.makeContextCurrent())
+        return false;
+
+    Extensions3D* extensions = context.getExtensions();
+    if (!extensions->supports("GL_CHROMIUM_copy_texture") || !extensions->supports("GL_CHROMIUM_flipy"))
+        return false;
+
+    // The canvas is stored in a premultiplied format, so unpremultiply if necessary.
+    context.pixelStorei(Extensions3D::UNPACK_UNPREMULTIPLY_ALPHA_CHROMIUM, !premultiplyAlpha);
+
+    // The canvas is stored in an inverted position, so the flip semantics are reversed.
+    context.pixelStorei(Extensions3D::UNPACK_FLIP_Y_CHROMIUM, !flipY);
+
+    extensions->copyTextureCHROMIUM(GraphicsContext3D::TEXTURE_2D, sourceTexture, texture, 0, internalFormat);
+
+    context.pixelStorei(Extensions3D::UNPACK_FLIP_Y_CHROMIUM, false);
+    context.pixelStorei(Extensions3D::UNPACK_UNPREMULTIPLY_ALPHA_CHROMIUM, false);
+    return true;
+}
+
 void ImageBuffer::clip(GraphicsContext* context, const FloatRect& rect) const
 {
     context->platformContext()->beginLayerClippedToImage(rect, this);
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index 12498ecc3..f1da4243f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -128,7 +128,7 @@ public:
 
     InterpolationQuality imageInterpolationQuality() const { return m_interpolationQuality; }
     TextDrawingModeFlags textDrawingMode() const { return m_textDrawingMode; }
-    virtual AccelerationMode accelerationMode() const = 0;
+    AccelerationMode accelerationMode() const { return m_accelerationMode; }
 
     virtual void beginPainting(PaintFlags flags = 0) { }
     virtual void endPainting() { }
@@ -139,9 +139,10 @@ public:
     virtual PassRefPtr<BitmapTexture> acquireTextureFromPool(const IntSize&);
 
 protected:
-    TextureMapper()
+    TextureMapper(AccelerationMode accelerationMode)
         : m_interpolationQuality(InterpolationDefault)
         , m_textDrawingMode(TextModeFill)
+        , m_accelerationMode(accelerationMode)
     {}
 
 private:
@@ -157,6 +158,7 @@ private:
     TextDrawingModeFlags m_textDrawingMode;
     Vector<RefPtr<BitmapTexture> > m_texturePool;
     GraphicsContext* m_context;
+    AccelerationMode m_accelerationMode;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index bfdb4738e..6e176e865 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -239,7 +239,8 @@ BitmapTextureGL* toBitmapTextureGL(BitmapTexture* texture)
 }
 
 TextureMapperGL::TextureMapperGL()
-    : m_data(new TextureMapperGLData)
+    : TextureMapper(OpenGLMode)
+    , m_data(new TextureMapperGLData)
     , m_context(0)
 {
 }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 16d686b4f..e75bb08b4 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -63,7 +63,6 @@ public:
     virtual IntSize maxTextureSize() const OVERRIDE { return IntSize(2000, 2000); }
     virtual PassRefPtr<BitmapTexture> createTexture() OVERRIDE;
     virtual GraphicsContext* graphicsContext() OVERRIDE { return m_context; }
-    virtual AccelerationMode accelerationMode() const OVERRIDE { return OpenGLMode; }
     virtual void setGraphicsContext(GraphicsContext* context) OVERRIDE { m_context = context; }
 
 #if ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 38171117f..ebcba4b08 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -57,7 +57,6 @@ public:
     virtual void bindSurface(BitmapTexture* surface) OVERRIDE { m_currentSurface = surface;}
     virtual void endClip() OVERRIDE { graphicsContext()->restore(); }
     virtual PassRefPtr<BitmapTexture> createTexture() OVERRIDE { return BitmapTextureImageBuffer::create(); }
-    virtual AccelerationMode accelerationMode() const OVERRIDE { return SoftwareMode; }
 
     inline GraphicsContext* currentContext()
     {
@@ -65,6 +64,9 @@ public:
     }
 
 private:
+    TextureMapperImageBuffer()
+        : TextureMapper(SoftwareMode)
+    { }
     RefPtr<BitmapTexture> m_currentSurface;
 };
 
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 7ce30c409..b164d7927 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -50,7 +50,7 @@ typedef struct CGAffineTransform CGAffineTransform;
 #include <wx/graphics.h>
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
+#if PLATFORM(WIN) || (PLATFORM(GTK) && OS(WINDOWS)) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
 #if COMPILER(MINGW) && !COMPILER(MINGW64)
 typedef struct _XFORM XFORM;
 #else
@@ -341,7 +341,7 @@ public:
     operator wxGraphicsMatrix() const;
 #endif
 
-#if PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
+#if PLATFORM(WIN) || (PLATFORM(GTK) && OS(WINDOWS)) || (PLATFORM(QT) && OS(WINDOWS)) || (PLATFORM(WX) && OS(WINDOWS))
     operator XFORM() const;
 #endif
 
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index e2deff73e..9fbfd6906 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -27,6 +27,7 @@
 #include "GraphicsContext.h"
 
 #include "AffineTransform.h"
+#include "DIBPixelData.h"
 #include "Path.h"
 
 #include <cairo-win32.h>
@@ -36,6 +37,7 @@ using namespace std;
 
 namespace WebCore {
 
+#if PLATFORM(WIN)
 static cairo_t* createCairoContextWithHDC(HDC hdc, bool hasAlpha)
 {
     // Put the HDC In advanced mode so it will honor affine transforms.
@@ -87,6 +89,7 @@ void GraphicsContext::platformInit(HDC dc, bool hasAlpha)
         setPlatformStrokeColor(strokeColor(), strokeColorSpace());
     }
 }
+#endif
 
 static void setRGBABitmapAlpha(unsigned char* bytes, size_t length, unsigned char level)
 {
@@ -149,6 +152,7 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     ::DeleteDC(hdc);
 }
 
+#if PLATFORM(WIN)
 void GraphicsContext::drawWindowsBitmap(WindowsBitmap* bitmap, const IntPoint& point)
 {
     drawBitmapToContext(m_data, platformContext()->cr(), bitmap->windowsDIB(), IntSize(point.x(), bitmap->size().height() + point.y()));
@@ -171,5 +175,6 @@ void GraphicsContextPlatformPrivate::flush()
     cairo_surface_flush(surface);
     cairo_surface_destroy(surface);
 }
+#endif
 
 }
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
index e319bc4a5..9514a49df 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextWin.cpp
@@ -51,6 +51,7 @@ static void fillWithClearColor(HBITMAP bitmap)
     memset(bmpInfo.bmBits, 0, bufferSize);
 }
 
+#if PLATFORM(WIN)
 void GraphicsContext::setShouldIncludeChildWindows(bool include)
 {
     m_data->m_shouldIncludeChildWindows = include;
@@ -94,6 +95,7 @@ PassOwnPtr<GraphicsContext::WindowsBitmap> GraphicsContext::createWindowsBitmap(
 {
     return adoptPtr(new WindowsBitmap(m_data->m_hdc, size));
 }
+#endif
 
 HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
@@ -133,6 +135,7 @@ HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlpha
     return m_data->m_hdc;
 }
 
+#if PLATFORM(WIN)
 void GraphicsContextPlatformPrivate::save()
 {
     if (!m_hdc)
@@ -202,5 +205,6 @@ void GraphicsContextPlatformPrivate::setCTM(const AffineTransform& transform)
     XFORM xform = transform.toTransformationMatrix();
     SetWorldTransform(m_hdc, &xform);
 }
+#endif
 
 }
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
index 7d9dcafe6..c33cce58d 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
@@ -263,7 +263,7 @@ void MediaPlayerPrivateQuickTimeVisualContext::setUpCookiesForQuickTime(const St
     // download the movie into WinInet before asking QuickTime to open it.
     Document* document = m_player->mediaPlayerClient()->mediaPlayerOwningDocument();
     Frame* frame = document ? document->frame() : 0;
-    if (!frame || !frame->page() || !frame->page()->cookieEnabled())
+    if (!frame || !frame->page() || !frame->page()->settings()->cookieEnabled())
         return;
 
     KURL movieURL = KURL(KURL(), url);
@@ -1011,7 +1011,7 @@ bool MediaPlayerPrivateQuickTimeVisualContext::isAvailable()
     return QTMovie::initializeQuickTime();
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivateQuickTimeVisualContext::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivateQuickTimeVisualContext::supportsType(const String& type, const String& codecs, const KURL&)
 {
     // only return "IsSupported" if there is no codecs parameter for now as there is no way to ask QT if it supports an
     //  extended MIME type
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
index 4c44af401..eb52ef64d 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
@@ -128,7 +128,7 @@ private:
     // engine support
     static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
     static void getSupportedTypes(HashSet<String>& types);
-    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
     static bool isAvailable();
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/wince/MediaPlayerPrivateWinCE.h b/Source/WebCore/platform/graphics/wince/MediaPlayerPrivateWinCE.h
index 0faa04578..ab4ec4d05 100644
--- a/Source/WebCore/platform/graphics/wince/MediaPlayerPrivateWinCE.h
+++ b/Source/WebCore/platform/graphics/wince/MediaPlayerPrivateWinCE.h
@@ -100,7 +100,7 @@ namespace WebCore {
         // engine support
         static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
         static void getSupportedTypes(HashSet<String>& types);
-        static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+        static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs, const KURL&);
         static bool isAvailable();
 
         MediaPlayer* m_player;
diff --git a/Source/WebCore/platform/gtk/FileSystemGtk.cpp b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
index 4235dc4ac..45cd53e68 100644
--- a/Source/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -117,7 +117,7 @@ bool getFileSize(const String& path, long long& resultSize)
     if (filename.isNull())
         return false;
 
-    struct stat statResult;
+    GStatBuf statResult;
     gint result = g_stat(filename.data(), &statResult);
     if (result != 0)
         return false;
@@ -132,7 +132,7 @@ bool getFileModificationTime(const String& path, time_t& modifiedTime)
     if (filename.isNull())
         return false;
 
-    struct stat statResult;
+    GStatBuf statResult;
     gint result = g_stat(filename.data(), &statResult);
     if (result != 0)
         return false;
@@ -356,6 +356,10 @@ int readFromFile(PlatformFileHandle handle, char* data, int length)
 
 bool unloadModule(PlatformModule module)
 {
+#if OS(WINDOWS)
+    return ::FreeLibrary(module);
+#else
     return g_module_close(module);
+#endif
 }
 }
diff --git a/Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp b/Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp
index 2fa5acbee..c7db9099e 100644
--- a/Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp
+++ b/Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp
@@ -55,7 +55,7 @@ void DeviceOrientationClientMock::stopUpdating()
     m_timer.stop();
 }
 
-void DeviceOrientationClientMock::setOrientation(PassRefPtr<DeviceOrientation> orientation)
+void DeviceOrientationClientMock::setOrientation(PassRefPtr<DeviceOrientationData> orientation)
 {
     m_orientation = orientation;
     if (m_isUpdating && !m_timer.isActive())
diff --git a/Source/WebCore/platform/mock/DeviceOrientationClientMock.h b/Source/WebCore/platform/mock/DeviceOrientationClientMock.h
index 1adc61fd3..4d55d207a 100644
--- a/Source/WebCore/platform/mock/DeviceOrientationClientMock.h
+++ b/Source/WebCore/platform/mock/DeviceOrientationClientMock.h
@@ -26,8 +26,8 @@
 #ifndef DeviceOrientationClientMock_h
 #define DeviceOrientationClientMock_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 #include "Timer.h"
 
 #include <wtf/PassRefPtr.h>
@@ -48,15 +48,15 @@ public:
     virtual void setController(DeviceOrientationController*) OVERRIDE;
     virtual void startUpdating() OVERRIDE;
     virtual void stopUpdating() OVERRIDE;
-    virtual DeviceOrientation* lastOrientation() const OVERRIDE { return m_orientation.get(); }
+    virtual DeviceOrientationData* lastOrientation() const OVERRIDE { return m_orientation.get(); }
     virtual void deviceOrientationControllerDestroyed() OVERRIDE { }
 
-    void setOrientation(PassRefPtr<DeviceOrientation>);
+    void setOrientation(PassRefPtr<DeviceOrientationData>);
 
 private:
     void timerFired(Timer<DeviceOrientationClientMock>*);
 
-    RefPtr<DeviceOrientation> m_orientation;
+    RefPtr<DeviceOrientationData> m_orientation;
     DeviceOrientationController* m_controller;
     Timer<DeviceOrientationClientMock> m_timer;
     bool m_isUpdating;
diff --git a/Source/WebCore/platform/network/qt/SocketStreamHandleQt.cpp b/Source/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
index 28101a650..271edd80d 100644
--- a/Source/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
+++ b/Source/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
@@ -191,6 +191,8 @@ SocketStreamHandle::SocketStreamHandle(QTcpSocket* socket, SocketStreamHandleCli
 {
     LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
     m_p = new SocketStreamHandlePrivate(this, socket);
+    if (socket->isOpen())
+        m_state = Open;
 }
 
 SocketStreamHandle::~SocketStreamHandle()
diff --git a/Source/WebCore/platform/qt/DeviceOrientationClientQt.cpp b/Source/WebCore/platform/qt/DeviceOrientationClientQt.cpp
index 5fca859fc..20d9e9d8a 100644
--- a/Source/WebCore/platform/qt/DeviceOrientationClientQt.cpp
+++ b/Source/WebCore/platform/qt/DeviceOrientationClientQt.cpp
@@ -50,7 +50,7 @@ void DeviceOrientationClientQt::stopUpdating()
         m_provider->stop();
 }
 
-DeviceOrientation* DeviceOrientationClientQt::lastOrientation() const
+DeviceOrientationData* DeviceOrientationClientQt::lastOrientation() const
 {
     return (m_provider) ? m_provider->lastOrientation() : 0;
 }
diff --git a/Source/WebCore/platform/qt/DeviceOrientationClientQt.h b/Source/WebCore/platform/qt/DeviceOrientationClientQt.h
index 91244dba6..6a2d5dd0d 100644
--- a/Source/WebCore/platform/qt/DeviceOrientationClientQt.h
+++ b/Source/WebCore/platform/qt/DeviceOrientationClientQt.h
@@ -20,8 +20,8 @@
 #ifndef DeviceOrientationClientQt_h
 #define DeviceOrientationClientQt_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 
 #include "DeviceOrientationController.h"
 #include "DeviceOrientationProviderQt.h"
@@ -37,7 +37,7 @@ public:
     virtual void setController(DeviceOrientationController*);
     virtual void startUpdating();
     virtual void stopUpdating();
-    virtual DeviceOrientation* lastOrientation() const;
+    virtual DeviceOrientationData* lastOrientation() const;
     virtual void deviceOrientationControllerDestroyed();
 
 private:
diff --git a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.cpp b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.cpp
index 488530bb3..8cc6fc4c0 100644
--- a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.cpp
+++ b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.cpp
@@ -26,7 +26,7 @@ DeviceOrientationProviderQt::DeviceOrientationProviderQt()
     : m_controller(0)
 {
     m_sensor.addFilter(this);
-    m_lastOrientation = DeviceOrientation::create();
+    m_lastOrientation = DeviceOrientationData::create();
 }
 
 DeviceOrientationProviderQt::~DeviceOrientationProviderQt()
@@ -66,7 +66,7 @@ bool DeviceOrientationProviderQt::filter(QRotationReading* reading)
         // The Z (alpha) rotation angle is checked via hasAlpha() private method,
         // depending if the device is able do detect the alpha rotation. X (beta) and
         // Y (gamma) axis are availble in this context.
-        m_lastOrientation = DeviceOrientation::create(hasAlpha(), reading->z(),
+        m_lastOrientation = DeviceOrientationData::create(hasAlpha(), reading->z(),
                 /* x available */ true, reading->x(),
                 /* y available */ true, reading->y());
         m_controller->didChangeDeviceOrientation(m_lastOrientation.get());
diff --git a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
index c7f6d2337..c4a22f74e 100644
--- a/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
+++ b/Source/WebCore/platform/qt/DeviceOrientationProviderQt.h
@@ -20,8 +20,8 @@
 #ifndef DeviceOrientationProviderQt_h
 #define DeviceOrientationProviderQt_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationController.h"
+#include "DeviceOrientationData.h"
 #include <QRotationFilter>
 #include <wtf/RefPtr.h>
 
@@ -45,11 +45,11 @@ public:
     void start();
     void stop();
     bool isActive() const { return m_sensor.isActive(); }
-    DeviceOrientation* lastOrientation() const { return m_lastOrientation.get(); }
+    DeviceOrientationData* lastOrientation() const { return m_lastOrientation.get(); }
     bool hasAlpha() const { return m_sensor.property("hasZ").toBool(); }
 
 private:
-    RefPtr<DeviceOrientation> m_lastOrientation;
+    RefPtr<DeviceOrientationData> m_lastOrientation;
     DeviceOrientationController* m_controller;
     QRotationSensor m_sensor;
 };
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index aa66d1362..61e3621b5 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -35,6 +35,7 @@
 #include <wininet.h> // for INTERNET_MAX_URL_LENGTH
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 
 #if USE(CF)
@@ -299,19 +300,14 @@ void markupToCFHTML(const String& markup, const String& srcURL, Vector<char>& re
 void replaceNewlinesWithWindowsStyleNewlines(String& str)
 {
     DEFINE_STATIC_LOCAL(String, windowsNewline, ("\r\n"));
-    const static unsigned windowsNewlineLength = windowsNewline.length();
-
-    unsigned index = 0;
-    unsigned strLength = str.length();
-    while (index < strLength) {
-        if (str[index] != '\n' || (index > 0 && str[index - 1] == '\r')) {
-            ++index;
-            continue;
-        }
-        str.replace(index, 1, windowsNewline);
-        strLength = str.length();
-        index += windowsNewlineLength;
+    StringBuilder result;
+    for (unsigned index = 0; index < str.length(); ++index) {
+        if (str[index] != '\n' || (index > 0 && str[index - 1] == '\r'))
+            result.append(str[index]);
+        else
+            result.append(windowsNewline);
     }
+    str = result.toString();
 }
 
 void replaceNBSPWithSpace(String& str)
diff --git a/Source/WebCore/plugins/PluginView.h b/Source/WebCore/plugins/PluginView.h
index aaf87c104..63ac151fa 100644
--- a/Source/WebCore/plugins/PluginView.h
+++ b/Source/WebCore/plugins/PluginView.h
@@ -47,7 +47,7 @@
 #include "npruntime_internal.h"
 #endif
 
-#if OS(WINDOWS) && (PLATFORM(QT) || PLATFORM(WX))
+#if OS(WINDOWS) && (PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(WX))
 typedef struct HWND__* HWND;
 typedef HWND PlatformPluginWidget;
 #else
@@ -376,7 +376,7 @@ namespace WebCore {
         bool m_haveUpdatedPluginWidget;
 #endif
 
-#if ((PLATFORM(QT) || PLATFORM(WX)) && OS(WINDOWS)) || defined(XP_MACOSX) || PLATFORM(EFL)
+#if ((PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(WX)) && OS(WINDOWS)) || defined(XP_MACOSX) || PLATFORM(EFL)
         // On Mac OSX and Qt/Windows the plugin does not have its own native widget,
         // but is using the containing window as its reference for positioning/painting.
         PlatformPluginWidget m_window;
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index c857a4010..d4dc9b92c 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -86,6 +86,11 @@
 #include <cairo-win32.h>
 #endif
 
+#if PLATFORM(GTK)
+#include <gdk/gdkwin32.h>
+#include <gtk/gtk.h>
+#endif
+
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
 #if HAVE(QT5)
@@ -102,7 +107,13 @@
 
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
-#if PLATFORM(QT)
+#if PLATFORM(GTK)
+    if (!client)
+        return 0;
+    if (GdkWindow* window = gtk_widget_get_window(client))
+        return static_cast<HWND>(GDK_WINDOW_HWND(window));
+    return 0;
+#elif PLATFORM(QT)
     if (!client)
         return 0;
 #if HAVE(QT5)
@@ -300,8 +311,8 @@ static bool registerPluginView()
 
     haveRegisteredWindowClass = true;
 
-#if PLATFORM(QT)
-    WebCore::setInstanceHandle((HINSTANCE)(qWinAppInst()));
+#if PLATFORM(GTK) || PLATFORM(QT)
+    WebCore::setInstanceHandle((HINSTANCE)(GetModuleHandle(0)));
 #endif
 
     ASSERT(WebCore::instanceHandle());
@@ -642,9 +653,9 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
 
     // On Safari/Windows without transparency layers the GraphicsContext returns the HDC
     // of the window and the plugin expects that the passed in DC has window coordinates.
-    // In the Qt port we always draw in an offscreen buffer and therefore need to preserve
-    // the translation set in getWindowsContext.
-#if !PLATFORM(QT) && !OS(WINCE)
+    // In the GTK and Qt ports we always draw in an offscreen buffer and therefore need
+    // to preserve the translation set in getWindowsContext.
+#if !PLATFORM(GTK) && !PLATFORM(QT) && !OS(WINCE)
     if (!context->isInTransparencyLayer()) {
         XFORM transform;
         GetWorldTransform(windowsContext.hdc(), &transform);
@@ -752,7 +763,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 
-#if !PLATFORM(QT) && !PLATFORM(WX) && !OS(WINCE)
+#if !PLATFORM(GTK) && !PLATFORM(QT) && !PLATFORM(WX) && !OS(WINCE)
     // Currently, Widget::setCursor is always called after this function in EventHandler.cpp
     // and since we don't want that we set ignoreNextSetCursor to true here to prevent that.
     ignoreNextSetCursor = true;
@@ -997,7 +1008,7 @@ bool PluginView::platformStart()
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
                                        0, 0, 0, 0, parentWindowHandle, 0, WebCore::instanceHandle(), 0);
 
-#if OS(WINDOWS) && (PLATFORM(QT) || PLATFORM(WX))
+#if OS(WINDOWS) && (PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(WX))
         m_window = window;
 #else
         setPlatformWidget(window);
@@ -1040,7 +1051,7 @@ void PluginView::platformDestroy()
 
 PassRefPtr<Image> PluginView::snapshot()
 {
-#if !PLATFORM(WX) && !OS(WINCE)
+#if !PLATFORM(GTK) && !PLATFORM(WX) && !OS(WINCE)
     OwnPtr<HDC> hdc = adoptPtr(CreateCompatibleDC(0));
 
     if (!m_isWindowed) {
diff --git a/Source/WebCore/rendering/AutoTableLayout.cpp b/Source/WebCore/rendering/AutoTableLayout.cpp
index 0af1f78bf..7a64e7a10 100644
--- a/Source/WebCore/rendering/AutoTableLayout.cpp
+++ b/Source/WebCore/rendering/AutoTableLayout.cpp
@@ -186,10 +186,10 @@ static bool shouldScaleColumns(RenderTable* table)
     bool scale = true;
     while (table) {
         Length tw = table->style()->width();
-        if ((tw.isAuto() || tw.isPercent()) && !table->isPositioned()) {
+        if ((tw.isAuto() || tw.isPercent()) && !table->isOutOfFlowPositioned()) {
             RenderBlock* cb = table->containingBlock();
             while (cb && !cb->isRenderView() && !cb->isTableCell() &&
-                cb->style()->width().isAuto() && !cb->isPositioned())
+                cb->style()->width().isAuto() && !cb->isOutOfFlowPositioned())
                 cb = cb->containingBlock();
 
             table = 0;
diff --git a/Source/WebCore/rendering/EllipsisBox.cpp b/Source/WebCore/rendering/EllipsisBox.cpp
index 130103cfe..8c00fca75 100644
--- a/Source/WebCore/rendering/EllipsisBox.cpp
+++ b/Source/WebCore/rendering/EllipsisBox.cpp
@@ -104,7 +104,7 @@ void EllipsisBox::paintSelection(GraphicsContext* context, const LayoutPoint& pa
     context->drawHighlightForText(font, RenderBlock::constructTextRun(renderer(), font, m_str, style, TextRun::AllowTrailingExpansion), roundedIntPoint(LayoutPoint(x() + paintOffset.x(), y() + paintOffset.y() + top)), h, c, style->colorSpace());
 }
 
-bool EllipsisBox::nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint&, const LayoutPoint&, LayoutUnit, LayoutUnit)
+bool EllipsisBox::nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint&, const LayoutPoint&, LayoutUnit, LayoutUnit)
 {
     return false;
 }
diff --git a/Source/WebCore/rendering/EllipsisBox.h b/Source/WebCore/rendering/EllipsisBox.h
index 14ed4cdb0..35d634d7d 100644
--- a/Source/WebCore/rendering/EllipsisBox.h
+++ b/Source/WebCore/rendering/EllipsisBox.h
@@ -40,7 +40,7 @@ public:
     }
 
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) OVERRIDE;
     void setSelectionState(RenderObject::SelectionState s) { m_selectionState = s; }
     IntRect selectionRect();
 
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index 5ffb65969..541f5d0af 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -49,41 +49,27 @@ namespace WebCore {
 using namespace HTMLNames;
 
 HitTestPoint::HitTestPoint()
-    : m_topPadding(0)
-    , m_rightPadding(0)
-    , m_bottomPadding(0)
-    , m_leftPadding(0)
-    , m_isRectBased(false)
+    : m_isRectBased(false)
 {
 }
 
 HitTestPoint::HitTestPoint(const LayoutPoint& point)
     : m_point(point)
-    , m_topPadding(0)
-    , m_rightPadding(0)
-    , m_bottomPadding(0)
-    , m_leftPadding(0)
+    , m_boundingBox(rectForPoint(point, 0, 0, 0, 0))
     , m_isRectBased(false)
 {
 }
 
 HitTestPoint::HitTestPoint(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
     : m_point(centerPoint)
-    , m_topPadding(topPadding)
-    , m_rightPadding(rightPadding)
-    , m_bottomPadding(bottomPadding)
-    , m_leftPadding(leftPadding)
+    , m_boundingBox(rectForPoint(centerPoint, topPadding, rightPadding, bottomPadding, leftPadding))
+    , m_isRectBased(topPadding || rightPadding || bottomPadding || leftPadding)
 {
-    // If all padding values passed in are zero then it is not a rect based hit test.
-    m_isRectBased = topPadding || rightPadding || bottomPadding || leftPadding;
 }
 
 HitTestPoint::HitTestPoint(const HitTestPoint& other)
     : m_point(other.m_point)
-    , m_topPadding(other.m_topPadding)
-    , m_rightPadding(other.m_rightPadding)
-    , m_bottomPadding(other.m_bottomPadding)
-    , m_leftPadding(other.m_leftPadding)
+    , m_boundingBox(other.m_boundingBox)
     , m_isRectBased(other.m_isRectBased)
 {
 }
@@ -95,15 +81,43 @@ HitTestPoint::~HitTestPoint()
 HitTestPoint& HitTestPoint::operator=(const HitTestPoint& other)
 {
     m_point = other.m_point;
-    m_topPadding = other.m_topPadding;
-    m_rightPadding = other.m_rightPadding;
-    m_bottomPadding = other.m_bottomPadding;
-    m_leftPadding = other.m_leftPadding;
+    m_boundingBox = other.m_boundingBox;
     m_isRectBased = other.m_isRectBased;
 
     return *this;
 }
 
+void HitTestPoint::setPoint(const LayoutPoint& point)
+{
+    m_boundingBox.move(roundedIntPoint(point) - roundedIntPoint(m_point));
+    m_point = point;
+}
+
+template<typename RectType>
+bool hitTestPointIntersects(const HitTestPoint& hitTestPoint, const RectType& rect)
+{
+    // FIXME: When the hit test is not rect based we should use rect.contains(m_point).
+    // That does change some corner case tests though.
+
+    // First check if rect even intersects our bounding rect.
+    if (!rect.intersects(hitTestPoint.boundingBox()))
+        return false;
+
+    // FIXME: Implement quad based intersection test to handle transformed hit test rectangles.
+    return true;
+
+}
+
+bool HitTestPoint::intersects(const LayoutRect& rect) const
+{
+    return hitTestPointIntersects(*this, rect);
+}
+
+bool HitTestPoint::intersects(const FloatRect& rect) const
+{
+    return hitTestPointIntersects(*this, rect);
+}
+
 IntRect HitTestPoint::rectForPoint(const LayoutPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
 {
     IntPoint actualPoint(roundedIntPoint(point));
@@ -606,7 +620,7 @@ bool HitTestResult::isContentEditable() const
     return m_innerNonSharedNode->rendererIsEditable();
 }
 
-bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const LayoutPoint& pointInContainer, const IntRect& rect)
+bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const HitTestPoint& pointInContainer, const LayoutRect& rect)
 {
     // If it is not a rect-based hit test, this method has to be no-op.
     // Return false, so the hit test stops.
@@ -622,7 +636,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const LayoutPoint&
 
     mutableRectBasedTestResult().add(node);
 
-    bool regionFilled = rect.contains(rectForPoint(pointInContainer));
+    bool regionFilled = rect.contains(pointInContainer.boundingBox());
     // FIXME: This code (incorrectly) attempts to correct for culled inline nodes. See https://bugs.webkit.org/show_bug.cgi?id=85849.
     if (node->renderer()->isInline() && !regionFilled) {
         for (RenderObject* curr = node->renderer()->parent(); curr; curr = curr->parent()) {
@@ -641,7 +655,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const LayoutPoint&
     return !regionFilled;
 }
 
-bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const LayoutPoint& pointInContainer, const FloatRect& rect)
+bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const HitTestPoint& pointInContainer, const FloatRect& rect)
 {
     // If it is not a rect-based hit test, this method has to be no-op.
     // Return false, so the hit test stops.
@@ -657,7 +671,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, const LayoutPoint&
 
     mutableRectBasedTestResult().add(node);
 
-    bool regionFilled = rect.contains(rectForPoint(pointInContainer));
+    bool regionFilled = rect.contains(pointInContainer.boundingBox());
     // FIXME: This code (incorrectly) attempts to correct for culled inline nodes. See https://bugs.webkit.org/show_bug.cgi?id=85849.
     if (node->renderer()->isInline() && !regionFilled) {
         for (RenderObject* curr = node->renderer()->parent(); curr; curr = curr->parent()) {
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index 19ddbd1ac..affab95c4 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -51,7 +51,7 @@ public:
 
     HitTestPoint();
     HitTestPoint(const LayoutPoint&);
-    // Pass non-negative padding values to perform a rect-based hit test.
+    // Pass non-zero padding values to perform a rect-based hit test.
     HitTestPoint(const LayoutPoint& centerPoint, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
     HitTestPoint(const HitTestPoint&);
     ~HitTestPoint();
@@ -60,24 +60,25 @@ public:
     LayoutPoint point() const { return m_point; }
     IntPoint roundedPoint() const { return roundedIntPoint(m_point); }
 
-    void setPoint(const LayoutPoint& p) { m_point = p; }
+    void setPoint(const LayoutPoint&);
 
     // Rect-based hit test related methods.
     bool isRectBasedTest() const { return m_isRectBased; }
-    IntRect rectForPoint(const LayoutPoint&) const;
+    IntRect boundingBox() const { return m_boundingBox; }
+
     static IntRect rectForPoint(const LayoutPoint&, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
-    int topPadding() const { return m_topPadding; }
-    int rightPadding() const { return m_rightPadding; }
-    int bottomPadding() const { return m_bottomPadding; }
-    int leftPadding() const { return m_leftPadding; }
+    int topPadding() const { return roundedPoint().y() - m_boundingBox.y(); }
+    int rightPadding() const { return m_boundingBox.maxX() - roundedPoint().x() - 1; }
+    int bottomPadding() const { return m_boundingBox.maxY() - roundedPoint().y() - 1; }
+    int leftPadding() const { return roundedPoint().x() - m_boundingBox.x(); }
+
+    bool intersects(const LayoutRect&) const;
+    bool intersects(const FloatRect&) const;
 
 private:
     LayoutPoint m_point;
 
-    int m_topPadding;
-    int m_rightPadding;
-    int m_bottomPadding;
-    int m_leftPadding;
+    IntRect m_boundingBox;
     bool m_isRectBased;
 };
 
@@ -148,8 +149,8 @@ public:
 
     // Returns true if it is rect-based hit test and needs to continue until the rect is fully
     // enclosed by the boundaries of a node.
-    bool addNodeToRectBasedTestResult(Node*, const LayoutPoint& pointInContainer, const IntRect& = IntRect());
-    bool addNodeToRectBasedTestResult(Node*, const LayoutPoint& pointInContainer, const FloatRect&);
+    bool addNodeToRectBasedTestResult(Node*, const HitTestPoint& pointInContainer, const LayoutRect& = LayoutRect());
+    bool addNodeToRectBasedTestResult(Node*, const HitTestPoint& pointInContainer, const FloatRect&);
     void append(const HitTestResult&);
 
     // If m_rectBasedTestResult is 0 then set it to a new NodeSet. Return *m_rectBasedTestResult. Lazy allocation makes
@@ -181,16 +182,6 @@ private:
     mutable OwnPtr<NodeSet> m_rectBasedTestResult;
 };
 
-// Formula:
-// x = p.x() - rightPadding
-// y = p.y() - topPadding
-// width = leftPadding + rightPadding + 1
-// height = topPadding + bottomPadding + 1
-inline IntRect HitTestPoint::rectForPoint(const LayoutPoint& point) const
-{
-    return rectForPoint(point, m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
-}
-
 String displayString(const String&, const Node*);
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 6f328c1af..08bfd6970 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -242,7 +242,7 @@ void InlineBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset, Layo
     }
 }
 
-bool InlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
+bool InlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
 {
     // Hit test all phases of replaced elements atomically, as though the replaced element established its
     // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
@@ -322,7 +322,7 @@ RenderObject::SelectionState InlineBox::selectionState()
     return renderer()->selectionState();
 }
 
-bool InlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth)
+bool InlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth) const
 {
     // Non-replaced elements can always accommodate an ellipsis.
     if (!m_renderer || !m_renderer->isReplaced())
@@ -333,9 +333,10 @@ bool InlineBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidt
     return !(boxRect.intersects(ellipsisRect));
 }
 
-float InlineBox::placeEllipsisBox(bool, float, float, float, bool&)
+float InlineBox::placeEllipsisBox(bool, float, float, float, float& truncatedWidth, bool&)
 {
     // Use -1 to mean "we didn't set the position."
+    truncatedWidth += logicalWidth();
     return -1;
 }
 
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index 2ed9cd40b..a88820529 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -72,6 +72,13 @@ public:
     virtual bool isLineBreak() const { return false; }
 
     virtual void adjustPosition(float dx, float dy);
+    void adjustLogicalPosition(float deltaLogicalLeft, float deltaLogicalTop)
+    {
+        if (isHorizontal())
+            adjustPosition(deltaLogicalLeft, deltaLogicalTop);
+        else
+            adjustPosition(deltaLogicalTop, deltaLogicalLeft);
+    }
     void adjustLineDirectionPosition(float delta)
     {
         if (isHorizontal())
@@ -88,7 +95,7 @@ public:
     }
 
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
 
     // Overloaded new operator.
     void* operator new(size_t, RenderArena*);
@@ -261,9 +268,9 @@ public:
     
     virtual RenderObject::SelectionState selectionState();
 
-    virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
+    virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth) const;
     // visibleLeftEdge, visibleRightEdge are in the parent's coordinate system.
-    virtual float placeEllipsisBox(bool ltr, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, bool&);
+    virtual float placeEllipsisBox(bool ltr, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, float &truncatedWidth, bool&);
 
 #ifndef NDEBUG
     void setHasBadParent();
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index c10941875..dc45001af 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -119,7 +119,7 @@ void InlineFlowBox::addToLine(InlineBox* child)
             setHasTextDescendantsOnAncestors(this);
     }
 
-    if (descendantsHaveSameLineHeightAndBaseline() && !child->renderer()->isPositioned()) {
+    if (descendantsHaveSameLineHeightAndBaseline() && !child->renderer()->isOutOfFlowPositioned()) {
         RenderStyle* parentStyle = renderer()->style(isFirstLineStyle());
         RenderStyle* childStyle = child->renderer()->style(isFirstLineStyle());
         bool shouldClearDescendantsHaveSameLineHeightAndBaseline = false;
@@ -156,7 +156,7 @@ void InlineFlowBox::addToLine(InlineBox* child)
             clearDescendantsHaveSameLineHeightAndBaseline();
     }
 
-    if (!child->renderer()->isPositioned()) {
+    if (!child->renderer()->isOutOfFlowPositioned()) {
         if (child->isText()) {
             RenderStyle* childStyle = child->renderer()->style(isFirstLineStyle());
             if (childStyle->letterSpacing() < 0 || childStyle->textShadow() || childStyle->textEmphasisMark() != TextEmphasisMarkNone || childStyle->textStrokeWidth())
@@ -316,6 +316,11 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, bool isLogically
         // we know the inline began on this line (unless we are a continuation).
         RenderLineBoxList* lineBoxList = rendererLineBoxes();
         if (!lineBoxList->firstLineBox()->isConstructed() && !renderer()->isInlineElementContinuation()) {
+#if ENABLE(CSS_BOX_DECORATION_BREAK)
+            if (renderer()->style()->boxDecorationBreak() == DCLONE)
+                includeLeftEdge = includeRightEdge = true;
+            else
+#endif
             if (ltr && lineBoxList->firstLineBox() == this)
                 includeLeftEdge = true;
             else if (!ltr && lineBoxList->lastLineBox() == this)
@@ -330,7 +335,12 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, bool isLogically
             // (1) The next line was not created, or it is constructed. We check the previous line for rtl.
             // (2) The logicallyLastRun is not a descendant of this renderer.
             // (3) The logicallyLastRun is a descendant of this renderer, but it is the last child of this renderer and it does not wrap to the next line.
-            
+#if ENABLE(CSS_BOX_DECORATION_BREAK)
+            // (4) The decoration break is set to clone therefore there will be borders on every sides.
+            if (renderer()->style()->boxDecorationBreak() == DCLONE)
+                includeLeftEdge = includeRightEdge = true;
+            else
+#endif
             if (ltr) {
                 if (!nextLineBox()
                     && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
@@ -381,7 +391,7 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
             if (knownToHaveNoOverflow())
                 maxLogicalRight = max(logicalLeft, maxLogicalRight);
         } else {
-            if (curr->renderer()->isPositioned()) {
+            if (curr->renderer()->isOutOfFlowPositioned()) {
                 if (curr->renderer()->parent()->style()->isLeftToRightDirection())
                     curr->setLogicalLeft(logicalLeft);
                 else
@@ -435,7 +445,7 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
         return true;
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         if (curr->isInlineFlowBox()) {
@@ -468,7 +478,7 @@ void InlineFlowBox::adjustMaxAscentAndDescent(LayoutUnit& maxAscent, LayoutUnit&
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         // The computed lineheight needs to be extended for the
         // positioned elements
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
         if (curr->verticalAlign() == TOP || curr->verticalAlign() == BOTTOM) {
             LayoutUnit lineHeight = curr->lineHeight();
@@ -535,7 +545,7 @@ void InlineFlowBox::computeLogicalBoxHeights(RootInlineBox* rootBox, LayoutUnit&
         return;
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         InlineFlowBox* inlineFlowBox = curr->isInlineFlowBox() ? toInlineFlowBox(curr) : 0;
@@ -606,7 +616,7 @@ void InlineFlowBox::placeBoxesInBlockDirection(LayoutUnit top, LayoutUnit maxHei
     }
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
 
         if (descendantsHaveSameLineHeightAndBaseline()) {
@@ -726,7 +736,7 @@ void InlineFlowBox::flipLinesInBlockDirection(LayoutUnit lineTop, LayoutUnit lin
     setLogicalTop(lineBottom - (logicalTop() - lineTop) - logicalHeight());
     
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders aren't affected here.
         
         if (curr->isInlineFlowBox())
@@ -902,7 +912,7 @@ void InlineFlowBox::computeOverflow(LayoutUnit lineTop, LayoutUnit lineBottom, G
     addBorderOutsetVisualOverflow(logicalVisualOverflow);
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         if (curr->renderer()->isText()) {
@@ -961,18 +971,18 @@ void InlineFlowBox::setOverflowFromLogicalRects(const LayoutRect& logicalLayoutO
     setVisualOverflow(visualOverflow, lineTop, lineBottom);
 }
 
-bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
+bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
 {
     LayoutRect overflowRect(visualOverflowRect(lineTop, lineBottom));
     flipForWritingMode(overflowRect);
     overflowRect.moveBy(accumulatedOffset);
-    if (!overflowRect.intersects(result.rectForPoint(pointInContainer)))
+    if (!pointInContainer.intersects(overflowRect))
         return false;
 
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
         if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, pointInContainer, accumulatedOffset, lineTop, lineBottom)) {
-            renderer()->updateHitTestResult(result, pointInContainer - toLayoutSize(accumulatedOffset));
+            renderer()->updateHitTestResult(result, pointInContainer.point() - toLayoutSize(accumulatedOffset));
             return true;
         }
     }
@@ -994,18 +1004,18 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
         top = max(rootBox->lineTop(), top);
         logicalHeight = bottom - top;
     }
-    
+
     // Move x/y to our coordinates.
     LayoutRect rect(minX, minY, width, height);
     flipForWritingMode(rect);
     rect.moveBy(accumulatedOffset);
 
-    if (visibleToHitTesting() && rect.intersects(result.rectForPoint(pointInContainer))) {
-        renderer()->updateHitTestResult(result, flipForWritingMode(pointInContainer - toLayoutSize(accumulatedOffset))); // Don't add in m_x or m_y here, we want coords in the containing block's space.
+    if (visibleToHitTesting() && pointInContainer.intersects(rect)) {
+        renderer()->updateHitTestResult(result, flipForWritingMode(pointInContainer.point() - toLayoutSize(accumulatedOffset))); // Don't add in m_x or m_y here, we want coords in the containing block's space.
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), pointInContainer, rect))
             return true;
     }
-    
+
     return false;
 }
 
@@ -1102,6 +1112,13 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
     bool hasFillImage = img && img->canRender(renderer(), renderer()->style()->effectiveZoom());
     if ((!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
         boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, rect, BackgroundBleedNone, this, rect.size(), op);
+#if ENABLE(CSS_BOX_DECORATION_BREAK)
+    else if (renderer()->style()->boxDecorationBreak() == DCLONE) {
+        GraphicsContextStateSaver stateSaver(*paintInfo.context);
+        paintInfo.context->clip(LayoutRect(rect.x(), rect.y(), width(), height()));
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, rect, BackgroundBleedNone, this, rect.size(), op);
+    }
+#endif
     else {
         // We have a fill image that spans multiple lines.
         // We need to adjust tx and ty by the width of all previous lines.
@@ -1363,7 +1380,7 @@ RenderObject::SelectionState InlineFlowBox::selectionState()
     return RenderObject::SelectionNone;
 }
 
-bool InlineFlowBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth)
+bool InlineFlowBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth) const
 {
     for (InlineBox *box = firstChild(); box; box = box->nextOnLine()) {
         if (!box->canAccommodateEllipsis(ltr, blockEdge, ellipsisWidth))
@@ -1372,7 +1389,7 @@ bool InlineFlowBox::canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsis
     return true;
 }
 
-float InlineFlowBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool& foundBox)
+float InlineFlowBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, float &truncatedWidth, bool& foundBox)
 {
     float result = -1;
     // We iterate over all children, the foundBox variable tells us when we've found the
@@ -1386,7 +1403,7 @@ float InlineFlowBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float block
     int visibleRightEdge = blockRightEdge;
 
     while (box) {
-        int currResult = box->placeEllipsisBox(ltr, visibleLeftEdge, visibleRightEdge, ellipsisWidth, foundBox);
+        int currResult = box->placeEllipsisBox(ltr, visibleLeftEdge, visibleRightEdge, ellipsisWidth, truncatedWidth, foundBox);
         if (currResult != -1 && result == -1)
             result = currResult;
 
@@ -1412,7 +1429,7 @@ LayoutUnit InlineFlowBox::computeOverAnnotationAdjustment(LayoutUnit allowedPosi
 {
     LayoutUnit result = 0;
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
         if (curr->isInlineFlowBox())
@@ -1460,7 +1477,7 @@ LayoutUnit InlineFlowBox::computeUnderAnnotationAdjustment(LayoutUnit allowedPos
 {
     LayoutUnit result = 0;
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isPositioned())
+        if (curr->renderer()->isOutOfFlowPositioned())
             continue; // Positioned placeholders don't affect calculations.
 
         if (curr->isInlineFlowBox())
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 2068e7826..35df7846e 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -102,7 +102,7 @@ public:
     virtual void attachLineBoxToRenderObject();
     virtual void removeLineBoxFromRenderObject();
 
-    virtual void clearTruncation();
+    virtual void clearTruncation() OVERRIDE;
 
     IntRect roundedFrameRect() const;
     
@@ -112,7 +112,7 @@ public:
     void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, const LayoutRect&, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(const PaintInfo&, RenderStyle*, ShadowStyle, const LayoutRect&);
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) OVERRIDE;
 
     bool boxShadowCanBeAppliedToBackground(const FillLayer&) const;
 
@@ -189,8 +189,8 @@ public:
 
     virtual RenderObject::SelectionState selectionState();
 
-    virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth);
-    virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool&);
+    virtual bool canAccommodateEllipsis(bool ltr, int blockEdge, int ellipsisWidth) const OVERRIDE;
+    virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, float &truncatedWidth, bool&) OVERRIDE;
 
     bool hasTextChildren() const { return m_hasTextChildren; }
     bool hasTextDescendants() const { return m_hasTextDescendants; }
diff --git a/Source/WebCore/rendering/InlineIterator.h b/Source/WebCore/rendering/InlineIterator.h
index 85831b673..da24ef449 100755
--- a/Source/WebCore/rendering/InlineIterator.h
+++ b/Source/WebCore/rendering/InlineIterator.h
@@ -166,7 +166,7 @@ static inline void notifyObserverWillExitObject(Observer* observer, RenderObject
 static inline bool isIteratorTarget(RenderObject* object)
 {
     ASSERT(object); // The iterator will of course return 0, but its not an expected argument to this function.
-    return object->isText() || object->isFloating() || object->isPositioned() || object->isReplaced();
+    return object->isText() || object->isFloating() || object->isOutOfFlowPositioned() || object->isReplaced();
 }
 
 // This enum is only used for bidiNextShared()
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index 9e731d638..7d63031da 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -233,7 +233,7 @@ void InlineTextBox::attachLine()
     toRenderText(renderer())->attachTextBox(this);
 }
 
-float InlineTextBox::placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, bool& foundBox)
+float InlineTextBox::placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, float &truncatedWidth, bool& foundBox)
 {
     if (foundBox) {
         m_truncation = cFullTruncation;
@@ -275,6 +275,7 @@ float InlineTextBox::placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, flo
             // No characters should be rendered.  Set ourselves to full truncation and place the ellipsis at the min of our start
             // and the ellipsis edge.
             m_truncation = cFullTruncation;
+            truncatedWidth += ellipsisWidth;
             return min(ellipsisX, x());
         }
 
@@ -290,11 +291,13 @@ float InlineTextBox::placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, flo
         // box directionality.
         // e.g. In the case of an LTR inline box truncated in an RTL flow then we can
         // have a situation such as |Hello| -> |...He|
+        truncatedWidth += widthOfVisibleText + ellipsisWidth;
         if (flowIsLTR)
             return left() + widthOfVisibleText;
         else
             return right() - widthOfVisibleText - ellipsisWidth;
     }
+    truncatedWidth += logicalWidth();
     return -1;
 }
 
@@ -346,7 +349,7 @@ bool InlineTextBox::isLineBreak() const
     return renderer()->isBR() || (renderer()->style()->preserveNewline() && len() == 1 && (*textRenderer()->text())[start()] == '\n');
 }
 
-bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
+bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
 {
     if (isLineBreak())
         return false;
@@ -354,8 +357,8 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, co
     FloatPoint boxOrigin = locationIncludingFlipping();
     boxOrigin.moveBy(accumulatedOffset);
     FloatRect rect(boxOrigin, size());
-    if (m_truncation != cFullTruncation && visibleToHitTesting() && rect.intersects(result.rectForPoint(pointInContainer))) {
-        renderer()->updateHitTestResult(result, flipForWritingMode(pointInContainer - toLayoutSize(accumulatedOffset)));
+    if (m_truncation != cFullTruncation && visibleToHitTesting() && pointInContainer.intersects(rect)) {
+        renderer()->updateHitTestResult(result, flipForWritingMode(pointInContainer.point() - toLayoutSize(accumulatedOffset)));
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), pointInContainer, rect))
             return true;
     }
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index e1e8554bc..a3e7630e6 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -115,7 +115,7 @@ public:
 
 protected:
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) OVERRIDE;
 
 public:
     RenderText* textRenderer() const;
@@ -130,7 +130,7 @@ public:
 
 private:
     virtual void clearTruncation() { m_truncation = cNoTruncation; }
-    virtual float placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, bool& foundBox);
+    virtual float placeEllipsisBox(bool flowIsLTR, float visibleLeftEdge, float visibleRightEdge, float ellipsisWidth, float &truncatedWidth, bool& foundBox) OVERRIDE;
 
 public:
     virtual bool isLineBreak() const;
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index 5f780dca0..f750cb159 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -45,7 +45,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
 {
     ASSERT(m_next);
 
-    bool fixed = renderer->isPositioned() && renderer->style()->position() == FixedPosition;
+    bool fixed = renderer->isOutOfFlowPositioned() && renderer->style()->position() == FixedPosition;
     if (fixed) {
         // FIXME: This doesn't work correctly with transforms.
         FloatPoint fixedOffset = renderer->view()->localToAbsolute(FloatPoint(), true);
@@ -53,7 +53,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
     } else
         m_paintOffset = prev->m_paintOffset + offset;
 
-    if (renderer->isPositioned() && !fixed) {
+    if (renderer->isOutOfFlowPositioned() && !fixed) {
         if (RenderObject* container = renderer->container()) {
             if (container->isRelPositioned() && container->isRenderInline())
                 m_paintOffset += toRenderInline(container)->relativePositionedInlineOffset(renderer);
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 1fc2d80f9..fdb1c0384 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -162,7 +162,7 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, LayoutUnit beforeBorderP
     // if we had any border/padding (obviously), if we're the root or HTML elements, or if
     // we're positioned, floating, a table cell.
     RenderStyle* blockStyle = block->style();
-    m_canCollapseWithChildren = !block->isRenderView() && !block->isRoot() && !block->isPositioned()
+    m_canCollapseWithChildren = !block->isRenderView() && !block->isRoot() && !block->isOutOfFlowPositioned()
         && !block->isFloating() && !block->isTableCell() && !block->hasOverflowClip() && !block->isInlineBlockOrInlineTable()
         && !block->isWritingModeRoot() && blockStyle->hasAutoColumnCount() && blockStyle->hasAutoColumnWidth()
         && !blockStyle->columnSpan();
@@ -278,7 +278,7 @@ void RenderBlock::willBeDestroyed()
 void RenderBlock::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
     RenderStyle* oldStyle = style();
-    s_canPropagateFloatIntoSibling = oldStyle ? !isFloatingOrPositioned() && !avoidsFloats() : false;
+    s_canPropagateFloatIntoSibling = oldStyle ? !isFloatingOrOutOfFlowPositioned() && !avoidsFloats() : false;
 
     setReplaced(newStyle->isDisplayInlineType());
     
@@ -303,7 +303,7 @@ void RenderBlock::styleWillChange(StyleDifference diff, const RenderStyle* newSt
                 toRenderBlock(cb)->removePositionedObjects(this);
         }
 
-        if (containsFloats() && !isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
+        if (containsFloats() && !isFloating() && !isOutOfFlowPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
             markAllDescendantsWithFloatsForLayout();
     }
 
@@ -337,7 +337,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     // blocks, then we need to find the top most parent containing that overhanging float and
     // then mark its descendants with floats for layout and clear all floats from its next
     // sibling blocks that exist in our floating objects list. See bug 56299 and 62875.
-    bool canPropagateFloatIntoSibling = !isFloatingOrPositioned() && !avoidsFloats();
+    bool canPropagateFloatIntoSibling = !isFloatingOrOutOfFlowPositioned() && !avoidsFloats();
     if (diff == StyleDifferenceLayout && s_canPropagateFloatIntoSibling && !canPropagateFloatIntoSibling && hasOverhangingFloats()) {
         RenderBlock* parentBlock = this;
         const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
@@ -412,7 +412,7 @@ void RenderBlock::addChildToContinuation(RenderObject* newChild, RenderObject* b
             beforeChildParent = flow;
     }
 
-    if (newChild->isFloatingOrPositioned()) {
+    if (newChild->isFloatingOrOutOfFlowPositioned()) {
         beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
         return;
     }
@@ -459,7 +459,7 @@ void RenderBlock::addChildToAnonymousColumnBlocks(RenderObject* newChild, Render
         beforeChildParent = toRenderBlock(lastChild());
 
     // If the new child is floating or positioned it can just go in that block.
-    if (newChild->isFloatingOrPositioned()) {
+    if (newChild->isFloatingOrOutOfFlowPositioned()) {
         beforeChildParent->addChildIgnoringAnonymousColumnBlocks(newChild, beforeChild);
         return;
     }
@@ -508,7 +508,7 @@ RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
 {
     RenderBlock* firstChildIgnoringAnonymousWrappers = 0;
     for (RenderObject* curr = this; curr; curr = curr->parent()) {
-        if (!curr->isRenderBlock() || curr->isFloatingOrPositioned() || curr->isTableCell() || curr->isRoot() || curr->isRenderView() || curr->hasOverflowClip()
+        if (!curr->isRenderBlock() || curr->isFloatingOrOutOfFlowPositioned() || curr->isTableCell() || curr->isRoot() || curr->isRenderView() || curr->hasOverflowClip()
             || curr->isInlineBlockOrInlineTable())
             return 0;
 
@@ -568,14 +568,6 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     if (beforeChild && childrenInline())
         deleteLineBoxTree();
 
-    // We have to remove the descendant child from our positioned objects list
-    // before we do the split and move some of the children to cloneBlock. Since
-    // we are doing layout anyway, it is easier to blow away the entire list, than
-    // traversing down the subtree looking for positioned childs and then remove them
-    // from our positioned objects list.
-    if (beforeChild)
-        removePositionedObjects(0);
-
     // Now take all of the children from beforeChild to the end and remove
     // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
@@ -629,12 +621,6 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
             currChildNextSibling = 0; // We destroyed the last child, so now we need to update
                                       // the value of currChildNextSibling.
 
-        // It is possible that positioned objects under blockCurr are going to be moved to cloneBlock.
-        // Since we are doing layout anyway, it is easier to blow away the entire list, than
-        // traversing down the subtree looking for positioned children and then remove them
-        // from our positioned objects list.
-        blockCurr->removePositionedObjects(0);
-
         // Now we need to take all of the children starting from the first child
         // *after* currChild and append them all to the clone.
         blockCurr->moveChildrenTo(cloneBlock, currChildNextSibling, 0, true);
@@ -772,7 +758,7 @@ RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
     // This function currently supports (1) and (2).
     RenderBlock* columnsBlockAncestor = 0;
     if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
-        && !newChild->isFloatingOrPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
+        && !newChild->isFloatingOrOutOfFlowPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
         columnsBlockAncestor = containingColumnsBlock(false);
         if (columnsBlockAncestor) {
             // Make sure that none of the parent ancestors have a continuation.
@@ -899,7 +885,7 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     // A block has to either have all of its children inline, or all of its children as blocks.
     // So, if our children are currently inline and a block child has to be inserted, we move all our
     // inline children into anonymous block boxes.
-    if (childrenInline() && !newChild->isInline() && !newChild->isFloatingOrPositioned()) {
+    if (childrenInline() && !newChild->isInline() && !newChild->isFloatingOrOutOfFlowPositioned()) {
         // This is a block with inline content. Wrap the inline content in anonymous blocks.
         makeChildrenNonInline(beforeChild);
         madeBoxesNonInline = true;
@@ -909,7 +895,7 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
             ASSERT(beforeChild->isAnonymousBlock());
             ASSERT(beforeChild->parent() == this);
         }
-    } else if (!childrenInline() && (newChild->isFloatingOrPositioned() || newChild->isInline())) {
+    } else if (!childrenInline() && (newChild->isFloatingOrOutOfFlowPositioned() || newChild->isInline())) {
         // If we're inserting an inline child but all of our children are blocks, then we have to make sure
         // it is put into an anomyous block box. We try to use an existing anonymous box if possible, otherwise
         // a new one is created and inserted into our list of children in the appropriate position.
@@ -975,7 +961,7 @@ static void getInlineRun(RenderObject* start, RenderObject* boundary,
     RenderObject * curr = start;
     bool sawInline;
     do {
-        while (curr && !(curr->isInline() || curr->isFloatingOrPositioned()))
+        while (curr && !(curr->isInline() || curr->isFloatingOrOutOfFlowPositioned()))
             curr = curr->nextSibling();
         
         inlineRunStart = inlineRunEnd = curr;
@@ -986,7 +972,7 @@ static void getInlineRun(RenderObject* start, RenderObject* boundary,
         sawInline = curr->isInline();
         
         curr = curr->nextSibling();
-        while (curr && (curr->isInline() || curr->isFloatingOrPositioned()) && (curr != boundary)) {
+        while (curr && (curr->isInline() || curr->isFloatingOrOutOfFlowPositioned()) && (curr != boundary)) {
             inlineRunEnd = curr;
             if (curr->isInline())
                 sawInline = true;
@@ -1297,7 +1283,7 @@ bool RenderBlock::isSelfCollapsingBlock() const
         // Whether or not we collapse is dependent on whether all our normal flow children
         // are also self-collapsing.
         for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-            if (child->isFloatingOrPositioned())
+            if (child->isFloatingOrOutOfFlowPositioned())
                 continue;
             if (!child->isSelfCollapsingBlock())
                 return false;
@@ -1521,7 +1507,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
         if (oldHeight > newHeight && maxFloatLogicalBottom > newHeight && !childrenInline()) {
             // One of our children's floats may have become an overhanging float for us. We need to look for it.
             for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-                if (child->isBlockFlow() && !child->isFloatingOrPositioned()) {
+                if (child->isBlockFlow() && !child->isFloatingOrOutOfFlowPositioned()) {
                     RenderBlock* block = toRenderBlock(child);
                     if (block->lowestFloatLogicalBottom() + block->logicalTop() > newHeight)
                         addOverhangingFloats(block, false);
@@ -1652,7 +1638,7 @@ void RenderBlock::computeOverflow(LayoutUnit oldClientAfterEdge, bool recomputeF
 void RenderBlock::addOverflowFromBlockChildren()
 {
     for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-        if (!child->isFloatingOrPositioned())
+        if (!child->isFloatingOrOutOfFlowPositioned())
             addOverflowFromChild(child);
     }
 }
@@ -1704,7 +1690,7 @@ void RenderBlock::addVisualOverflowFromTheme()
 
 bool RenderBlock::expandsToEncloseOverhangingFloats() const
 {
-    return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isDeprecatedFlexibleBox())
+    return isInlineBlockOrInlineTable() || isFloatingOrOutOfFlowPositioned() || hasOverflowClip() || (parent() && parent()->isDeprecatedFlexibleBox())
            || hasColumns() || isTableCell() || isTableCaption() || isFieldset() || isWritingModeRoot() || isRoot();
 }
 
@@ -1770,7 +1756,7 @@ bool RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginI
 
 bool RenderBlock::handlePositionedChild(RenderBox* child, const MarginInfo& marginInfo)
 {
-    if (child->isPositioned()) {
+    if (child->isOutOfFlowPositioned()) {
         child->containingBlock()->insertPositionedObject(child);
         adjustPositionedBlock(child, marginInfo);
         return true;
@@ -1883,7 +1869,7 @@ void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
     if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn()))
         return;
 
-    if (curr->isAnonymous() || curr->isFloatingOrPositioned())
+    if (curr->isAnonymous() || curr->isFloatingOrOutOfFlowPositioned())
         return;
 
     RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
@@ -2040,6 +2026,17 @@ LayoutUnit RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo
         logicalTop = min(logicalTop, nextPageLogicalTop(beforeCollapseLogicalTop));
         setLogicalHeight(logicalHeight() + (logicalTop - oldLogicalTop));
     }
+
+    // If we have collapsed into a previous sibling and so reduced the height of the parent, ensure any floats that now
+    // overhang from the previous sibling are added to our parent. If the child's previous sibling itself is a float the child will avoid
+    // or clear it anyway, so don't worry about any floating children it may contain.
+    RenderObject* prev = child->previousSibling();
+    if (prev && prev->isBlockFlow() && !prev->isFloatingOrOutOfFlowPositioned()) {
+        RenderBlock* block = toRenderBlock(prev);
+        if (block->containsFloats() && block->lowestFloatLogicalBottom() > logicalTop) 
+            addOverhangingFloats(block, false);
+    }
+
     return logicalTop;
 }
 
@@ -2059,7 +2056,7 @@ LayoutUnit RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& margin
         // self-collapsing block's bottom margin.
         bool atBottomOfBlock = true;
         for (RenderBox* curr = child->nextSiblingBox(); curr && atBottomOfBlock; curr = curr->nextSiblingBox()) {
-            if (!curr->isFloatingOrPositioned())
+            if (!curr->isFloatingOrOutOfFlowPositioned())
                 atBottomOfBlock = false;
         }
         
@@ -2454,7 +2451,7 @@ void RenderBlock::simplifiedNormalFlowLayout()
         ListHashSet<RootInlineBox*> lineBoxes;
         for (InlineWalker walker(this); !walker.atEnd(); walker.advance()) {
             RenderObject* o = walker.current();
-            if (!o->isPositioned() && (o->isReplaced() || o->isFloating())) {
+            if (!o->isOutOfFlowPositioned() && (o->isReplaced() || o->isFloating())) {
                 o->layoutIfNeeded();
                 if (toRenderBox(o)->inlineBoxWrapper()) {
                     RootInlineBox* box = toRenderBox(o)->inlineBoxWrapper()->root();
@@ -2472,7 +2469,7 @@ void RenderBlock::simplifiedNormalFlowLayout()
         }
     } else {
         for (RenderBox* box = firstChildBox(); box; box = box->nextSiblingBox()) {
-            if (!box->isPositioned())
+            if (!box->isOutOfFlowPositioned())
                 box->layoutIfNeeded();
         }
     }
@@ -2874,7 +2871,7 @@ void RenderBlock::paintCaret(PaintInfo& paintInfo, const LayoutPoint& paintOffse
     bool isContentEditable;
     if (type == CursorCaret) {
         caretPainter = frame()->selection()->caretRenderer();
-        isContentEditable = frame()->selection()->isContentEditable();
+        isContentEditable = frame()->selection()->rendererIsEditable();
     } else {
         caretPainter = frame()->page()->dragCaretController()->caretRenderer();
         isContentEditable = frame()->page()->dragCaretController()->isContentEditable();
@@ -3136,9 +3133,9 @@ bool RenderBlock::isSelectionRoot() const
     if (isTable())
         return false;
         
-    if (isBody() || isRoot() || hasOverflowClip() || isRelPositioned() ||
-        isFloatingOrPositioned() || isTableCell() || isInlineBlockOrInlineTable() || hasTransform() ||
-        hasReflection() || hasMask() || isWritingModeRoot())
+    if (isBody() || isRoot() || hasOverflowClip() || isRelPositioned()
+        || isFloatingOrOutOfFlowPositioned() || isTableCell() || isInlineBlockOrInlineTable() || hasTransform()
+        || hasReflection() || hasMask() || isWritingModeRoot())
         return true;
     
     if (view() && view()->selectionStart()) {
@@ -3355,7 +3352,7 @@ GapRects RenderBlock::blockSelectionGaps(RenderBlock* rootBlock, const LayoutPoi
         if (childState == SelectionBoth || childState == SelectionEnd)
             sawSelectionEnd = true;
 
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue; // We must be a normal flow object in order to even be considered.
 
         if (curr->isRelPositioned() && curr->hasLayer()) {
@@ -3921,16 +3918,48 @@ HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
     return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
 
-#if !ASSERT_DISABLED
+bool RenderBlock::hasPercentHeightContainerMap()
+{
+    return gPercentHeightContainerMap;
+}
+
 bool RenderBlock::hasPercentHeightDescendant(RenderBox* descendant)
 {
-    ASSERT(descendant);
-    if (!gPercentHeightContainerMap)
-        return false;
-    HashSet<RenderBlock*>* containerSet = gPercentHeightContainerMap->take(descendant);
-    return containerSet && containerSet->size();
+    // We don't null check gPercentHeightContainerMap since the caller
+    // already ensures this and we need to call this function on every
+    // descendant in clearPercentHeightDescendantsFrom().
+    ASSERT(gPercentHeightContainerMap);
+    return gPercentHeightContainerMap->contains(descendant);
+}
+
+void RenderBlock::removePercentHeightDescendantIfNeeded(RenderBox* descendant)
+{
+    // We query the map directly, rather than looking at style's
+    // logicalHeight()/logicalMinHeight()/logicalMaxHeight() since those
+    // can change with writing mode/directional changes.
+    if (!hasPercentHeightContainerMap())
+        return;
+
+    if (!hasPercentHeightDescendant(descendant))
+        return;
+
+    removePercentHeightDescendant(descendant);
+}
+
+void RenderBlock::clearPercentHeightDescendantsFrom(RenderBox* parent)
+{
+    ASSERT(gPercentHeightContainerMap);
+    for (RenderObject* curr = parent->firstChild(); curr; curr = curr->nextInPreOrder(parent)) {
+        if (!curr->isBox())
+            continue;
+ 
+        RenderBox* box = toRenderBox(curr);
+        if (!hasPercentHeightDescendant(box))
+            continue;
+
+        removePercentHeightDescendant(box);
+    }
 }
-#endif
 
 template <RenderBlock::FloatingObject::Type FloatTypeValue>
 inline void RenderBlock::FloatIntervalSearchAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType& interval) const
@@ -4150,7 +4179,7 @@ void RenderBlock::clearFloats()
     }
 
     // Inline blocks are covered by the isReplaced() check in the avoidFloats method.
-    if (avoidsFloats() || isRoot() || isRenderView() || isFloatingOrPositioned() || isTableCell()) {
+    if (avoidsFloats() || isRoot() || isRenderView() || isFloatingOrOutOfFlowPositioned() || isTableCell()) {
         if (m_floatingObjects) {
             deleteAllValues(m_floatingObjects->set());
             m_floatingObjects->clear();
@@ -4188,7 +4217,7 @@ void RenderBlock::clearFloats()
     RenderBlock* parentBlock = toRenderBlock(parent());
     bool parentHasFloats = false;
     RenderObject* prev = previousSibling();
-    while (prev && (prev->isFloatingOrPositioned() || !prev->isBox() || !prev->isRenderBlock() || toRenderBlock(prev)->avoidsFloats())) {
+    while (prev && (prev->isFloatingOrOutOfFlowPositioned() || !prev->isBox() || !prev->isRenderBlock() || toRenderBlock(prev)->avoidsFloats())) {
         if (prev->isFloating())
             parentHasFloats = true;
         prev = prev->previousSibling();
@@ -4422,7 +4451,7 @@ void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove
     // Iterate over our children and mark them as needed.
     if (!childrenInline()) {
         for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-            if ((!floatToRemove && child->isFloatingOrPositioned()) || !child->isRenderBlock())
+            if ((!floatToRemove && child->isFloatingOrOutOfFlowPositioned()) || !child->isRenderBlock())
                 continue;
             RenderBlock* childBlock = toRenderBlock(child);
             if ((floatToRemove ? childBlock->containsFloat(floatToRemove) : childBlock->containsFloats()) || childBlock->shrinkToAvoidFloats())
@@ -4440,7 +4469,7 @@ void RenderBlock::markSiblingsWithFloatsForLayout(RenderBox* floatToRemove)
     FloatingObjectSetIterator end = floatingObjectSet.end();
 
     for (RenderObject* next = nextSibling(); next; next = next->nextSibling()) {
-        if (!next->isRenderBlock() || next->isFloatingOrPositioned() || toRenderBlock(next)->avoidsFloats())
+        if (!next->isRenderBlock() || next->isFloatingOrOutOfFlowPositioned() || toRenderBlock(next)->avoidsFloats())
             continue;
 
         RenderBlock* nextBlock = toRenderBlock(next);
@@ -4524,7 +4553,7 @@ bool RenderBlock::isPointInOverflowControl(HitTestResult& result, const LayoutPo
     return layer()->hitTestOverflowControls(result, roundedIntPoint(pointInContainer - toLayoutSize(accumulatedOffset)));
 }
 
-bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     LayoutPoint adjustedLocation(accumulatedOffset + location());
     LayoutSize localOffset = toLayoutSize(adjustedLocation);
@@ -4534,12 +4563,12 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         LayoutRect overflowBox = visualOverflowRect();
         flipForWritingMode(overflowBox);
         overflowBox.moveBy(adjustedLocation);
-        if (!overflowBox.intersects(result.rectForPoint(pointInContainer)))
+        if (!pointInContainer.intersects(overflowBox))
             return false;
     }
 
-    if ((hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) && isPointInOverflowControl(result, pointInContainer, adjustedLocation)) {
-        updateHitTestResult(result, pointInContainer - localOffset);
+    if ((hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) && isPointInOverflowControl(result, pointInContainer.point(), adjustedLocation)) {
+        updateHitTestResult(result, pointInContainer.point() - localOffset);
         // FIXME: isPointInOverflowControl() doesn't handle rect-based tests yet.
         if (!result.addNodeToRectBasedTestResult(node(), pointInContainer))
            return true;
@@ -4548,8 +4577,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     // If we have clipping, then we can't have any spillout.
     bool useOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     bool useClip = (hasControlClip() || useOverflowClip);
-    LayoutRect hitTestArea(result.rectForPoint(pointInContainer));
-    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(adjustedLocation).intersects(hitTestArea) : overflowClipRect(adjustedLocation, result.region(), IncludeOverlayScrollbarSize).intersects(hitTestArea));
+    bool checkChildren = !useClip || (hasControlClip() ? pointInContainer.intersects(controlClipRect(adjustedLocation)) : pointInContainer.intersects(overflowClipRect(adjustedLocation, result.region(), IncludeOverlayScrollbarSize)));
     if (checkChildren) {
         // Hit test descendants first.
         LayoutSize scrolledOffset(localOffset);
@@ -4559,13 +4587,13 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         // Hit test contents if we don't have columns.
         if (!hasColumns()) {
             if (hitTestContents(request, result, pointInContainer, toLayoutPoint(scrolledOffset), hitTestAction)) {
-                updateHitTestResult(result, pointInContainer - localOffset);
+                updateHitTestResult(result, pointInContainer.point() - localOffset);
                 return true;
             }
             if (hitTestAction == HitTestFloat && hitTestFloats(request, result, pointInContainer, toLayoutPoint(scrolledOffset)))
                 return true;
         } else if (hitTestColumns(request, result, pointInContainer, toLayoutPoint(scrolledOffset), hitTestAction)) {
-            updateHitTestResult(result, flipForWritingMode(pointInContainer - localOffset));
+            updateHitTestResult(result, flipForWritingMode(pointInContainer.point() - localOffset));
             return true;
         }
     }
@@ -4573,8 +4601,8 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     // Now hit test our background
     if (hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) {
         LayoutRect boundsRect(adjustedLocation, size());
-        if (visibleToHitTesting() && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
-            updateHitTestResult(result, flipForWritingMode(pointInContainer - localOffset));
+        if (visibleToHitTesting() && pointInContainer.intersects(boundsRect)) {
+            updateHitTestResult(result, flipForWritingMode(pointInContainer.point() - localOffset));
             if (!result.addNodeToRectBasedTestResult(node(), pointInContainer, boundsRect))
                 return true;
         }
@@ -4583,7 +4611,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     return false;
 }
 
-bool RenderBlock::hitTestFloats(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
+bool RenderBlock::hitTestFloats(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
 {
     if (!m_floatingObjects)
         return false;
@@ -4603,7 +4631,7 @@ bool RenderBlock::hitTestFloats(const HitTestRequest& request, HitTestResult& re
             LayoutUnit yOffset = yPositionForFloatIncludingMargin(floatingObject) - floatingObject->m_renderer->y();
             LayoutPoint childPoint = flipFloatForWritingModeForChild(floatingObject, adjustedLocation + LayoutSize(xOffset, yOffset));
             if (floatingObject->m_renderer->hitTest(request, result, pointInContainer, childPoint)) {
-                updateHitTestResult(result, pointInContainer - toLayoutSize(childPoint));
+                updateHitTestResult(result, pointInContainer.point() - toLayoutSize(childPoint));
                 return true;
             }
         }
@@ -4671,17 +4699,17 @@ private:
     LayoutRect m_colRect;
 };
 
-bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     // We need to do multiple passes, breaking up our hit testing into strips.
     if (!hasColumns())
         return false;
 
     for (ColumnRectIterator it(*this); it.hasMore(); it.advance()) {
-        LayoutRect hitRect = result.rectForPoint(pointInContainer);
+        LayoutRect hitRect = pointInContainer.boundingBox();
         LayoutRect colRect = it.columnRect();
         colRect.moveBy(accumulatedOffset);
-        if (colRect.intersects(hitRect)) {
+        if (pointInContainer.intersects(colRect)) {
             // The point is inside this column.
             // Adjust accumulatedOffset to change where we hit test.
             LayoutSize offset;
@@ -4708,7 +4736,7 @@ void RenderBlock::adjustForColumnRect(LayoutSize& offset, const LayoutPoint& poi
     }
 }
 
-bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     if (childrenInline() && !isTable()) {
         // We have to hit-test our line boxes.
@@ -4725,7 +4753,7 @@ bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult&
                 return true;
         }
     }
-    
+
     return false;
 }
 
@@ -4856,7 +4884,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const LayoutPoin
 
 static inline bool isChildHitTestCandidate(RenderBox* box)
 {
-    return box->height() && box->style()->visibility() == VISIBLE && !box->isFloatingOrPositioned();
+    return box->height() && box->style()->visibility() == VISIBLE && !box->isFloatingOrOutOfFlowPositioned();
 }
 
 VisiblePosition RenderBlock::positionForPoint(const LayoutPoint& point)
@@ -5389,7 +5417,7 @@ RenderObject* InlineMinMaxIterator::next()
     while (current || current == parent) {
         if (!oldEndOfInline &&
             (current == parent ||
-             (!current->isFloating() && !current->isReplaced() && !current->isPositioned())))
+             (!current->isFloating() && !current->isReplaced() && !current->isOutOfFlowPositioned())))
             result = current->firstChild();
         if (!result) {
             // We hit the end of our inline. (It was empty, e.g., <span></span>.)
@@ -5414,7 +5442,7 @@ RenderObject* InlineMinMaxIterator::next()
         if (!result)
             break;
 
-        if (!result->isPositioned() && (result->isText() || result->isFloating() || result->isReplaced() || result->isRenderInline()))
+        if (!result->isOutOfFlowPositioned() && (result->isText() || result->isFloating() || result->isReplaced() || result->isRenderInline()))
              break;
         
         current = result;
@@ -5740,7 +5768,7 @@ void RenderBlock::computeBlockPreferredLogicalWidths()
     LayoutUnit floatLeftWidth = 0, floatRightWidth = 0;
     while (child) {
         // Positioned children don't affect the min/max width
-        if (child->isPositioned()) {
+        if (child->isOutOfFlowPositioned()) {
             child = child->nextSibling();
             continue;
         }
@@ -5914,7 +5942,7 @@ LayoutUnit RenderBlock::firstLineBoxBaseline() const
     }
     else {
         for (RenderBox* curr = firstChildBox(); curr; curr = curr->nextSiblingBox()) {
-            if (!curr->isFloatingOrPositioned()) {
+            if (!curr->isFloatingOrOutOfFlowPositioned()) {
                 LayoutUnit result = curr->firstLineBoxBaseline();
                 if (result != -1)
                     return curr->logicalTop() + result; // Translate to our coordinate space.
@@ -5945,7 +5973,7 @@ LayoutUnit RenderBlock::lastLineBoxBaseline() const
     } else {
         bool haveNormalFlowChild = false;
         for (RenderBox* curr = lastChildBox(); curr; curr = curr->previousSiblingBox()) {
-            if (!curr->isFloatingOrPositioned()) {
+            if (!curr->isFloatingOrOutOfFlowPositioned()) {
                 haveNormalFlowChild = true;
                 LayoutUnit result = curr->lastLineBoxBaseline();
                 if (result != -1)
@@ -6180,7 +6208,7 @@ void RenderBlock::updateFirstLetter()
             break;
         if (currChild->isListMarker())
             currChild = currChild->nextSibling();
-        else if (currChild->isFloatingOrPositioned()) {
+        else if (currChild->isFloatingOrOutOfFlowPositioned()) {
             if (currChild->style()->styleType() == FIRST_LETTER) {
                 currChild = currChild->firstChild();
                 break;
@@ -6220,9 +6248,9 @@ void RenderBlock::updateFirstLetter()
 // (crawling into blocks).
 static bool shouldCheckLines(RenderObject* obj)
 {
-    return !obj->isFloatingOrPositioned() && !obj->isRunIn() &&
-            obj->isBlockFlow() && obj->style()->height().isAuto() &&
-            (!obj->isDeprecatedFlexibleBox() || obj->style()->boxOrient() == VERTICAL);
+    return !obj->isFloatingOrOutOfFlowPositioned() && !obj->isRunIn()
+            && obj->isBlockFlow() && obj->style()->height().isAuto()
+            && (!obj->isDeprecatedFlexibleBox() || obj->style()->boxOrient() == VERTICAL);
 }
 
 static RootInlineBox* getLineAtIndex(RenderBlock* block, int i, int& count)
@@ -6263,8 +6291,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
                     int result = getHeightForLineCount(toRenderBlock(obj), l, false, count);
                     if (result != -1)
                         return result + obj->y() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : ZERO_LAYOUT_UNIT);
-                }
-                else if (!obj->isFloatingOrPositioned() && !obj->isRunIn())
+                } else if (!obj->isFloatingOrOutOfFlowPositioned() && !obj->isRunIn())
                     normalFlowChildWithoutLines = obj;
             }
             if (normalFlowChildWithoutLines && l == 0)
@@ -6317,7 +6344,7 @@ void RenderBlock::adjustForBorderFit(LayoutUnit x, LayoutUnit& left, LayoutUnit&
         }
         else {
             for (RenderBox* obj = firstChildBox(); obj; obj = obj->nextSiblingBox()) {
-                if (!obj->isFloatingOrPositioned()) {
+                if (!obj->isFloatingOrOutOfFlowPositioned()) {
                     if (obj->isBlockFlow() && !obj->hasOverflowClip())
                         toRenderBlock(obj)->adjustForBorderFit(x + obj->x(), left, right);
                     else if (obj->style()->visibility() == VISIBLE) {
@@ -6641,7 +6668,7 @@ static bool inNormalFlow(RenderBox* child)
     while (curr && curr != renderView) {
         if (curr->hasColumns() || curr->isRenderFlowThread())
             return true;
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             return false;
         curr = curr->containingBlock();
     }
@@ -6820,7 +6847,7 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, Layout
         }
         LayoutUnit totalLogicalHeight = lineHeight + max(ZERO_LAYOUT_UNIT, logicalOffset);
         LayoutUnit pageLogicalHeightAtNewOffset = hasUniformPageLogicalHeight ? pageLogicalHeight : pageLogicalHeightForOffset(logicalOffset + remainingLogicalHeight);
-        if (lineBox == firstRootBox() && totalLogicalHeight < pageLogicalHeightAtNewOffset && !isPositioned() && !isTableCell())
+        if (lineBox == firstRootBox() && totalLogicalHeight < pageLogicalHeightAtNewOffset && !isOutOfFlowPositioned() && !isTableCell())
             setPaginationStrut(remainingLogicalHeight + max(ZERO_LAYOUT_UNIT, logicalOffset));
         else {
             delta += remainingLogicalHeight;
@@ -6877,7 +6904,7 @@ LayoutUnit RenderBlock::adjustBlockChildForPagination(LayoutUnit logicalTopAfter
     if (paginationStrut) {
         // We are willing to propagate out to our parent block as long as we were at the top of the block prior
         // to collapsing our margins, and as long as we didn't clear or move as a result of other pagination.
-        if (atBeforeSideOfBlock && oldTop == result && !isPositioned() && !isTableCell()) {
+        if (atBeforeSideOfBlock && oldTop == result && !isOutOfFlowPositioned() && !isTableCell()) {
             // FIXME: Should really check if we're exceeding the page height before propagating the strut, but we don't
             // have all the information to do so (the strut only has the remaining amount to push). Gecko gets this wrong too
             // and pushes to the next page anyway, so not too concerned about it.
@@ -7075,7 +7102,7 @@ const char* RenderBlock::renderName() const
     
     if (isFloating())
         return "RenderBlock (floating)";
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         return "RenderBlock (positioned)";
     if (isAnonymousColumnsBlock())
         return "RenderBlock (anonymous multi-column)";
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index ed80f8960..81a6ed740 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -104,13 +104,15 @@ public:
 
     typedef ListHashSet<RenderBox*, 4> PositionedObjectsListHashSet;
     PositionedObjectsListHashSet* positionedObjects() const { return m_positionedObjects.get(); }
+    bool hasPositionedObjects() const { return m_positionedObjects && !m_positionedObjects->isEmpty(); }
 
     void addPercentHeightDescendant(RenderBox*);
     static void removePercentHeightDescendant(RenderBox*);
     HashSet<RenderBox*>* percentHeightDescendants() const;
-#if !ASSERT_DISABLED
+    static bool hasPercentHeightContainerMap();
     static bool hasPercentHeightDescendant(RenderBox*);
-#endif
+    static void clearPercentHeightDescendantsFrom(RenderBox*);
+    static void removePercentHeightDescendantIfNeeded(RenderBox*);
 
     void setHasMarkupTruncation(bool b) { m_hasMarkupTruncation = b; }
     bool hasMarkupTruncation() const { return m_hasMarkupTruncation; }
@@ -245,7 +247,7 @@ public:
 
     static bool shouldSkipCreatingRunsForObject(RenderObject* obj)
     {
-        return obj->isFloating() || (obj->isPositioned() && !obj->style()->isOriginalDisplayInlineType() && !obj->container()->isRenderInline());
+        return obj->isFloating() || (obj->isOutOfFlowPositioned() && !obj->style()->isOriginalDisplayInlineType() && !obj->container()->isRenderInline());
     }
     
     static void appendRunsForObject(BidiRunList<BidiRun>&, int start, int end, RenderObject*, InlineBidiResolver&);
@@ -418,7 +420,7 @@ protected:
     virtual ETextAlign textAlignmentForLine(bool endsWithSoftBreak) const;
     virtual void adjustInlineDirectionLineBounds(int /* expansionOpportunityCount */, float& /* logicalLeft */, float& /* logicalWidth */) const { }
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual void computePreferredLogicalWidths();
 
@@ -756,9 +758,9 @@ private:
     LayoutUnit lowestFloatLogicalBottom(FloatingObject::Type = FloatingObject::FloatLeftRight) const; 
     LayoutUnit nextFloatLogicalBottomBelow(LayoutUnit) const;
     
-    virtual bool hitTestColumns(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
-    virtual bool hitTestContents(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
-    bool hitTestFloats(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset);
+    virtual bool hitTestColumns(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool hitTestContents(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    bool hitTestFloats(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset);
 
     virtual bool isPointInOverflowControl(HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset);
 
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 046ffef39..b1ce61101 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -617,7 +617,7 @@ void RenderBlock::setMarginsForRubyRun(BidiRun* run, RenderRubyRun* renderer, Re
     int endOverhang;
     RenderObject* nextObject = 0;
     for (BidiRun* runWithNextObject = run->next(); runWithNextObject; runWithNextObject = runWithNextObject->next()) {
-        if (!runWithNextObject->m_object->isPositioned() && !runWithNextObject->m_box->isLineBreak()) {
+        if (!runWithNextObject->m_object->isOutOfFlowPositioned() && !runWithNextObject->m_box->isLineBreak()) {
             nextObject = runWithNextObject->m_object;
             break;
         }
@@ -762,7 +762,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     RenderObject* previousObject = 0;
 
     for (BidiRun* r = firstRun; r; r = r->next()) {
-        if (!r->m_box || r->m_object->isPositioned() || r->m_box->isLineBreak())
+        if (!r->m_box || r->m_object->isOutOfFlowPositioned() || r->m_box->isLineBreak())
             continue; // Positioned objects are only participating to figure out their
                       // correct static x position.  They have no effect on the width.
                       // Similarly, line break boxes have no effect on the width.
@@ -826,7 +826,7 @@ void RenderBlock::computeBlockDirectionPositionsForLine(RootInlineBox* lineBox,
 
         // Align positioned boxes with the top of the line box.  This is
         // a reasonable approximation of an appropriate y position.
-        if (r->m_object->isPositioned())
+        if (r->m_object->isOutOfFlowPositioned())
             r->m_box->setLogicalTop(logicalHeight());
 
         // Position is used to properly position both replaced elements and
@@ -1478,7 +1478,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
             if (!hasInlineChild && o->isInline())
                 hasInlineChild = true;
 
-            if (o->isReplaced() || o->isFloating() || o->isPositioned()) {
+            if (o->isReplaced() || o->isFloating() || o->isOutOfFlowPositioned()) {
                 RenderBox* box = toRenderBox(o);
 
                 if (relayoutChildren || box->hasRelativeDimensions())
@@ -1488,7 +1488,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
                 if (relayoutChildren && box->needsPreferredWidthsRecalculation())
                     o->setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
 
-                if (o->isPositioned())
+                if (o->isOutOfFlowPositioned())
                     o->containingBlock()->insertPositionedObject(box);
                 else if (o->isFloating())
                     layoutState.floats().append(FloatWithRect(box));
@@ -1849,7 +1849,7 @@ static bool alwaysRequiresLineBox(RenderInline* flow)
 
 static bool requiresLineBox(const InlineIterator& it, const LineInfo& lineInfo = LineInfo(), WhitespacePosition whitespacePosition = LeadingWhitespace)
 {
-    if (it.m_obj->isFloatingOrPositioned())
+    if (it.m_obj->isFloatingOrOutOfFlowPositioned())
         return false;
 
     if (it.m_obj->isRenderInline() && !alwaysRequiresLineBox(toRenderInline(it.m_obj)) && !requiresLineBoxForContent(toRenderInline(it.m_obj), lineInfo))
@@ -1885,7 +1885,7 @@ void RenderBlock::LineBreaker::skipTrailingWhitespace(InlineIterator& iterator,
 {
     while (!iterator.atEnd() && !requiresLineBox(iterator, lineInfo, TrailingWhitespace)) {
         RenderObject* object = iterator.m_obj;
-        if (object->isPositioned())
+        if (object->isOutOfFlowPositioned())
             setStaticPositions(m_block, toRenderBox(object));
         else if (object->isFloating())
             m_block->insertFloatingObject(toRenderBox(object));
@@ -1898,7 +1898,7 @@ void RenderBlock::LineBreaker::skipLeadingWhitespace(InlineBidiResolver& resolve
 {
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), lineInfo, LeadingWhitespace)) {
         RenderObject* object = resolver.position().m_obj;
-        if (object->isPositioned()) {
+        if (object->isOutOfFlowPositioned()) {
             setStaticPositions(m_block, toRenderBox(object));
             if (object->style()->isOriginalDisplayInlineType()) {
                 resolver.runs().addRun(createRun(0, 1, object, resolver));
@@ -2192,7 +2192,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
             goto end;
         }
 
-        if (current.m_obj->isPositioned()) {
+        if (current.m_obj->isOutOfFlowPositioned()) {
             // If our original display wasn't an inline type, then we can
             // go ahead and determine our static inline position now.
             RenderBox* box = toRenderBox(current.m_obj);
@@ -2599,7 +2599,7 @@ InlineIterator RenderBlock::LineBreaker::nextLineBreak(InlineBidiResolver& resol
                 goto end;
         }
 
-        if (!current.m_obj->isFloatingOrPositioned()) {
+        if (!current.m_obj->isFloatingOrOutOfFlowPositioned()) {
             last = current.m_obj;
             if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || toRenderListMarker(last)->isInside())) {
                 width.commit();
@@ -2675,8 +2675,26 @@ void RenderBlock::addOverflowFromInlineChildren()
 
 void RenderBlock::deleteEllipsisLineBoxes()
 {
-    for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox())
-        curr->clearTruncation();
+    ETextAlign textAlign = style()->textAlign();
+    bool ltr = style()->isLeftToRightDirection();
+    bool firstLine = true;
+    for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
+        if (curr->hasEllipsisBox()) {
+            curr->clearTruncation();
+
+            // Shift the line back where it belongs if we cannot accomodate an ellipsis.
+            float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(curr->lineTop(), firstLine);
+            float availableLogicalWidth = logicalRightOffsetForLine(curr->lineTop(), false) - logicalLeft;
+            float totalLogicalWidth = curr->logicalWidth();
+            updateLogicalWidthForAlignment(textAlign, 0, logicalLeft, totalLogicalWidth, availableLogicalWidth, 0);
+
+            if (ltr)
+                curr->adjustLogicalPosition((logicalLeft - curr->logicalLeft()), 0);
+            else
+                curr->adjustLogicalPosition(-(curr->logicalLeft() - logicalLeft), 0);
+        }
+        firstLine = false;
+    }
 }
 
 void RenderBlock::checkLinesForTextOverflow()
@@ -2694,20 +2712,33 @@ void RenderBlock::checkLinesForTextOverflow()
     // check the left edge of the line box to see if it is less
     // Include the scrollbar for overflow blocks, which means we want to use "contentWidth()"
     bool ltr = style()->isLeftToRightDirection();
+    ETextAlign textAlign = style()->textAlign();
+    bool firstLine = true;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        LayoutUnit blockRightEdge = logicalRightOffsetForLine(curr->y(), curr == firstRootBox());
-        LayoutUnit blockLeftEdge = logicalLeftOffsetForLine(curr->y(), curr == firstRootBox());
+        LayoutUnit blockRightEdge = logicalRightOffsetForLine(curr->lineTop(), firstLine);
+        LayoutUnit blockLeftEdge = logicalLeftOffsetForLine(curr->lineTop(), firstLine);
         LayoutUnit lineBoxEdge = ltr ? curr->x() + curr->logicalWidth() : curr->x();
         if ((ltr && lineBoxEdge > blockRightEdge) || (!ltr && lineBoxEdge < blockLeftEdge)) {
             // This line spills out of our box in the appropriate direction.  Now we need to see if the line
             // can be truncated.  In order for truncation to be possible, the line must have sufficient space to
             // accommodate our truncation string, and no replaced elements (images, tables) can overlap the ellipsis
             // space.
-            LayoutUnit width = curr == firstRootBox() ? firstLineEllipsisWidth : ellipsisWidth;
+
+            LayoutUnit width = firstLine ? firstLineEllipsisWidth : ellipsisWidth;
             LayoutUnit blockEdge = ltr ? blockRightEdge : blockLeftEdge;
-            if (curr->lineCanAccommodateEllipsis(ltr, blockEdge, lineBoxEdge, width))
-                curr->placeEllipsis(ellipsisStr, ltr, blockLeftEdge, blockRightEdge, width);
+            if (curr->lineCanAccommodateEllipsis(ltr, blockEdge, lineBoxEdge, width)) {
+                float totalLogicalWidth = curr->placeEllipsis(ellipsisStr, ltr, blockLeftEdge, blockRightEdge, width);
+
+                float logicalLeft = 0; // We are only intersted in the delta from the base position.
+                float truncatedWidth = pixelSnappedLogicalRightOffsetForLine(curr->lineTop(), firstLine);
+                updateLogicalWidthForAlignment(textAlign, 0, logicalLeft, totalLogicalWidth, truncatedWidth, 0);
+                if (ltr)
+                    curr->adjustLogicalPosition(logicalLeft, 0);
+                else
+                    curr->adjustLogicalPosition(-(truncatedWidth - (logicalLeft + totalLogicalWidth)), 0);
+            }
         }
+        firstLine = false;
     }
 }
 
@@ -2776,7 +2807,7 @@ LayoutUnit RenderBlock::startAlignedOffsetForLine(RenderBox* child, LayoutUnit p
     logicalLeft = logicalLeftOffsetForLine(logicalHeight(), false);
     availableLogicalWidth = logicalRightOffsetForLine(logicalHeight(), false) - logicalLeft;
     float totalLogicalWidth = logicalWidthForChild(child);
-    updateLogicalWidthForAlignment(textAlign, 0l, logicalLeft, totalLogicalWidth, availableLogicalWidth, 0);
+    updateLogicalWidthForAlignment(textAlign, 0, logicalLeft, totalLogicalWidth, availableLogicalWidth, 0);
 
     if (!style()->isLeftToRightDirection())
         return logicalWidth() - (logicalLeft + totalLogicalWidth);
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index ddca07dd2..524082e26 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -134,30 +134,23 @@ void RenderBox::willBeDestroyed()
 {
     clearOverrideSize();
 
-    RenderStyle* styleToUse = style();
-    if (styleToUse && (styleToUse->logicalHeight().isPercent() || styleToUse->logicalMinHeight().isPercent() || styleToUse->logicalMaxHeight().isPercent()))
-        RenderBlock::removePercentHeightDescendant(this);
+    if (style()) {
+        RenderBlock::removePercentHeightDescendantIfNeeded(this);
 
-    if (styleToUse) {
         if (RenderView* view = this->view()) {
             if (FrameView* frameView = view->frameView()) {
-                if (styleToUse->position() == FixedPosition)
+                if (style()->position() == FixedPosition)
                     frameView->removeFixedObject(this);
             }
         }
     }
 
-    // If the following assertion fails, logicalHeight()/logicalMinHeight()/
-    // logicalMaxHeight() values are changed from a percent value to a non-percent
-    // value during laying out. It causes a use-after-free bug.
-    ASSERT(!RenderBlock::hasPercentHeightDescendant(this));
-
     RenderBoxModelObject::willBeDestroyed();
 }
 
 void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
 {
-    ASSERT(isFloatingOrPositioned());
+    ASSERT(isFloatingOrOutOfFlowPositioned());
 
     if (documentBeingDestroyed())
         return;
@@ -182,7 +175,7 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
         }
     }
 
-    if (isPositioned()) {
+    if (isOutOfFlowPositioned()) {
         for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
             if (curr->isRenderBlock())
                 toRenderBlock(curr)->removePositionedObject(this);
@@ -208,9 +201,9 @@ void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyl
             markContainingBlocksForLayout();
             if (oldStyle->position() == StaticPosition)
                 repaint();
-            else if (newStyle->isPositioned())
+            else if (newStyle->isOutOfFlowPositioned())
                 parent()->setChildNeedsLayout(true);
-            if (isFloating() && !isPositioned() && newStyle->isPositioned())
+            if (isFloating() && !isOutOfFlowPositioned() && newStyle->isOutOfFlowPositioned())
                 removeFloatingOrPositionedChildFromBlockLists();
         }
     } else if (newStyle && isBody())
@@ -232,21 +225,29 @@ void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyl
 
 void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    // Horizontal writing mode definition is updated in RenderBoxModelObject::updateBoxModelInfoFromStyle,
+    // (as part of the RenderBoxModelObject::styleDidChange call below). So, we can safely cache the horizontal
+    // writing mode value before style change here.
+    bool oldHorizontalWritingMode = isHorizontalWritingMode();
+
     RenderBoxModelObject::styleDidChange(diff, oldStyle);
 
     RenderStyle* newStyle = style();
     if (needsLayout() && oldStyle) {
-        if (oldStyle && (oldStyle->logicalHeight().isPercent() || oldStyle->logicalMinHeight().isPercent() || oldStyle->logicalMaxHeight().isPercent()))
-            RenderBlock::removePercentHeightDescendant(this);
+        RenderBlock::removePercentHeightDescendantIfNeeded(this);
 
         // Normally we can do optimized positioning layout for absolute/fixed positioned objects. There is one special case, however, which is
         // when the positioned object's margin-before is changed. In this case the parent has to get a layout in order to run margin collapsing
         // to determine the new static position.
-        if (isPositioned() && newStyle->hasStaticBlockPosition(isHorizontalWritingMode()) && oldStyle->marginBefore() != newStyle->marginBefore()
+        if (isOutOfFlowPositioned() && newStyle->hasStaticBlockPosition(isHorizontalWritingMode()) && oldStyle->marginBefore() != newStyle->marginBefore()
             && parent() && !parent()->normalChildNeedsLayout())
             parent()->setChildNeedsLayout(true);
     }
 
+    if (RenderBlock::hasPercentHeightContainerMap() && firstChild()
+        && oldHorizontalWritingMode != isHorizontalWritingMode())
+        RenderBlock::clearPercentHeightDescendantsFrom(this);
+
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
     if (hasOverflowClip() && oldStyle && newStyle && oldStyle->effectiveZoom() != newStyle->effectiveZoom()) {
@@ -304,8 +305,8 @@ void RenderBox::updateBoxModelInfoFromStyle()
     if (isRootObject || isViewObject)
         setHasBoxDecorations(true);
 
-    setPositioned(styleToUse->isPositioned());
-    setFloating(!isPositioned() && styleToUse->isFloating());
+    setPositioned(styleToUse->isOutOfFlowPositioned());
+    setFloating(!isOutOfFlowPositioned() && styleToUse->isFloating());
 
     // We also handle <body> and <html>, whose overflow applies to the viewport.
     if (styleToUse->overflowX() != OVISIBLE && !isRootObject && (isRenderBlock() || isTableRow() || isTableSection())) {
@@ -740,14 +741,14 @@ LayoutUnit RenderBox::computeContentBoxLogicalHeight(LayoutUnit height) const
 }
 
 // Hit Testing
-bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     LayoutPoint adjustedLocation = accumulatedOffset + location();
 
     // Check kids first.
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
         if (!child->hasLayer() && child->nodeAtPoint(request, result, pointInContainer, adjustedLocation, action)) {
-            updateHitTestResult(result, pointInContainer - toLayoutSize(adjustedLocation));
+            updateHitTestResult(result, pointInContainer.point() - toLayoutSize(adjustedLocation));
             return true;
         }
     }
@@ -756,8 +757,8 @@ bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result
     // foreground phase (which is true for replaced elements like images).
     LayoutRect boundsRect = borderBoxRectInRegion(result.region());
     boundsRect.moveBy(adjustedLocation);
-    if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
-        updateHitTestResult(result, pointInContainer - toLayoutSize(adjustedLocation));
+    if (visibleToHitTesting() && action == HitTestForeground && pointInContainer.intersects(boundsRect)) {
+        updateHitTestResult(result, pointInContainer.point() - toLayoutSize(adjustedLocation));
         if (!result.addNodeToRectBasedTestResult(node(), pointInContainer, boundsRect))
             return true;
     }
@@ -1387,7 +1388,7 @@ LayoutSize RenderBox::offsetFromContainer(RenderObject* o, const LayoutPoint& po
         offset += relativePositionOffset();
 
     if (!isInline() || isReplaced()) {
-        if (!style()->isPositioned() && o->hasColumns()) {
+        if (!style()->isOutOfFlowPositioned() && o->hasColumns()) {
             RenderBlock* block = toRenderBlock(o);
             LayoutRect columnRect(frameRect());
             block->adjustStartEdgeForWritingModeIncludingColumns(columnRect);
@@ -1430,7 +1431,7 @@ void RenderBox::dirtyLineBoxes(bool fullLayout)
 
 void RenderBox::positionLineBox(InlineBox* box)
 {
-    if (isPositioned()) {
+    if (isOutOfFlowPositioned()) {
         // Cache the x position only if we were an INLINE type originally.
         bool wasInline = style()->isOriginalDisplayInlineType();
         if (wasInline) {
@@ -1545,7 +1546,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
     if (!o)
         return;
 
-    if (isWritingModeRoot() && !isPositioned())
+    if (isWritingModeRoot() && !isOutOfFlowPositioned())
         flipForWritingMode(rect);
 
     LayoutPoint topLeft = rect.location();
@@ -1636,7 +1637,7 @@ void RenderBox::computeLogicalWidth()
 
 void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
-    if (isPositioned()) {
+    if (isOutOfFlowPositioned()) {
         // FIXME: This calculation is not patched for block-flow yet.
         // https://bugs.webkit.org/show_bug.cgi?id=46500
         computePositionedLogicalWidth(region, offsetFromLogicalTopOfFirstPage);
@@ -1744,20 +1745,25 @@ LayoutUnit RenderBox::computeLogicalWidthInRegionUsing(LogicalWidthType widthTyp
         LayoutUnit marginEnd = minimumValueForLength(styleToUse->marginEnd(), availableLogicalWidth, renderView);
         logicalWidthResult = availableLogicalWidth - marginStart - marginEnd;
 
+        // shrinkToAvoidFloats() is only true for width: auto so the below code works correctly for
+        // width: fill-available since no case matches and it returns the logicalWidthResult from above.
         if (shrinkToAvoidFloats() && cb->containsFloats())
             logicalWidthResult = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, region, offsetFromLogicalTopOfFirstPage);
 
-        if (sizesToIntrinsicLogicalWidth(widthType)) {
-            logicalWidthResult = max(logicalWidthResult, minPreferredLogicalWidth());
-            logicalWidthResult = min(logicalWidthResult, maxPreferredLogicalWidth());
-        }
+        if (logicalWidth.type() == MinContent)
+            logicalWidthResult = minPreferredLogicalWidth();
+        else if (logicalWidth.type() == MaxContent)
+            logicalWidthResult = maxPreferredLogicalWidth();
+        else if (logicalWidth.type() == FitContent || (logicalWidth.type() != FillAvailable && sizesLogicalWidthToFitContent(widthType)))
+            logicalWidthResult = max(minPreferredLogicalWidth(), min(maxPreferredLogicalWidth(), logicalWidthResult));
+
     } else // FIXME: If the containing block flow is perpendicular to our direction we need to use the available logical height instead.
         logicalWidthResult = computeBorderBoxLogicalWidth(valueForLength(logicalWidth, availableLogicalWidth, view())); 
 
     return logicalWidthResult;
 }
 
-bool RenderBox::sizesToIntrinsicLogicalWidth(LogicalWidthType widthType) const
+bool RenderBox::sizesLogicalWidthToFitContent(LogicalWidthType widthType) const
 {
     // Marquees in WinIE are like a mixture of blocks and inline-blocks.  They size as though they're blocks,
     // but they allow text to sit on the same line as the marquee.
@@ -1832,8 +1838,12 @@ void RenderBox::computeInlineDirectionMargins(RenderBlock* containingBlock, Layo
     // Case One: The object is being centered in the containing block's available logical width.
     if ((marginStartLength.isAuto() && marginEndLength.isAuto() && childWidth < containerWidth)
         || (!marginStartLength.isAuto() && !marginEndLength.isAuto() && containingBlock->style()->textAlign() == WEBKIT_CENTER)) {
-        containingBlock->setMarginStartForChild(this, max<LayoutUnit>(0, (containerWidth - childWidth) / 2));
-        containingBlock->setMarginEndForChild(this, containerWidth - childWidth - containingBlock->marginStartForChild(this));
+        // Other browsers center the margin box for align=center elements so we match them here.
+        LayoutUnit marginStartWidth = minimumValueForLength(marginStartLength, containerWidth, renderView);
+        LayoutUnit marginEndWidth = minimumValueForLength(marginEndLength, containerWidth, renderView);
+        LayoutUnit centeredMarginBoxStart = max<LayoutUnit>(0, (containerWidth - childWidth - marginStartWidth - marginEndWidth) / 2);
+        containingBlock->setMarginStartForChild(this, centeredMarginBoxStart + marginStartWidth);
+        containingBlock->setMarginEndForChild(this, containerWidth - childWidth - containingBlock->marginStartForChild(this) + marginEndWidth);
         return;
     } 
     
@@ -1907,10 +1917,10 @@ RenderBoxRegionInfo* RenderBox::renderBoxRegionInfo(RenderRegion* region, Layout
     LayoutUnit logicalWidthInRegion = logicalWidth();
     LayoutUnit logicalLeftInRegion = logicalLeft();
     LayoutUnit widthDelta = logicalWidthInRegion - oldLogicalWidth;
-    LayoutUnit logicalLeftDelta = isPositioned() ? logicalLeftInRegion - oldLogicalLeft : startMarginDelta;
+    LayoutUnit logicalLeftDelta = isOutOfFlowPositioned() ? logicalLeftInRegion - oldLogicalLeft : startMarginDelta;
     LayoutUnit logicalRightInRegion = containingBlockLogicalWidthInRegion - (logicalLeftInRegion + logicalWidthInRegion);
     LayoutUnit oldLogicalRight = containingBlockLogicalWidth - (oldLogicalLeft + oldLogicalWidth);
-    LayoutUnit logicalRightDelta = isPositioned() ? logicalRightInRegion - oldLogicalRight : startMarginDelta;
+    LayoutUnit logicalRightDelta = isOutOfFlowPositioned() ? logicalRightInRegion - oldLogicalRight : startMarginDelta;
 
     // Set our values back.
     mutableBox->setLogicalWidth(oldLogicalWidth);
@@ -1920,7 +1930,7 @@ RenderBoxRegionInfo* RenderBox::renderBoxRegionInfo(RenderRegion* region, Layout
 
     LayoutUnit logicalLeftOffset = 0;
     
-    if (!isPositioned() && avoidsFloats() && cb->containsFloats()) {
+    if (!isOutOfFlowPositioned() && avoidsFloats() && cb->containsFloats()) {
         LayoutUnit startPositionDelta = cb->computeStartPositionDeltaForChildAvoidingFloats(this, marginStartInRegion, region, offsetFromLogicalTopOfFirstPage);
         if (cb->style()->isLeftToRightDirection())
             logicalLeftDelta += startPositionDelta;
@@ -1951,7 +1961,7 @@ void RenderBox::computeLogicalHeight()
         return;
 
     Length h;
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         computePositionedLogicalHeight();
     else {
         RenderBlock* cb = containingBlock();
@@ -2083,7 +2093,7 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
     // only at explicit containers.
     bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
-    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
+    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isOutOfFlowPositioned() && cb->style()->logicalHeight().isAuto()) {
         if (!document()->inQuirksMode() && !cb->isAnonymousBlock())
             break;
         skippedAutoHeightContainingBlock = true;
@@ -2097,7 +2107,7 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
     // explicitly specified that can be used for any percentage computations.
     // FIXME: We can't just check top/bottom here.
     // https://bugs.webkit.org/show_bug.cgi?id=46500
-    bool isPositionedWithSpecifiedHeight = cb->isPositioned() && (!cbstyle->logicalHeight().isAuto() || (!cbstyle->top().isAuto() && !cbstyle->bottom().isAuto()));
+    bool isOutOfFlowPositionedWithSpecifiedHeight = cb->isOutOfFlowPositioned() && (!cbstyle->logicalHeight().isAuto() || (!cbstyle->top().isAuto() && !cbstyle->bottom().isAuto()));
 
     bool includeBorderPadding = isTable();
 
@@ -2127,19 +2137,19 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
     // height.
     else if (cbstyle->logicalHeight().isFixed())
         result = cb->computeContentBoxLogicalHeight(cbstyle->logicalHeight().value());
-    else if (cbstyle->logicalHeight().isPercent() && !isPositionedWithSpecifiedHeight) {
+    else if (cbstyle->logicalHeight().isPercent() && !isOutOfFlowPositionedWithSpecifiedHeight) {
         // We need to recur and compute the percentage height for our containing block.
         result = cb->computePercentageLogicalHeight(cbstyle->logicalHeight());
         if (result != -1)
             result = cb->computeContentBoxLogicalHeight(result);
-    } else if (cb->isRenderView() || (cb->isBody() && document()->inQuirksMode()) || isPositionedWithSpecifiedHeight) {
+    } else if (cb->isRenderView() || (cb->isBody() && document()->inQuirksMode()) || isOutOfFlowPositionedWithSpecifiedHeight) {
         // Don't allow this to affect the block' height() member variable, since this
         // can get called while the block is still laying out its kids.
         LayoutUnit oldHeight = cb->logicalHeight();
         cb->computeLogicalHeight();
         result = cb->contentLogicalHeight();
         cb->setLogicalHeight(oldHeight);
-    } else if (cb->isRoot() && isPositioned())
+    } else if (cb->isRoot() && isOutOfFlowPositioned())
         // Match the positioned objects behavior, which is that positioned objects will fill their viewport
         // always.  Note we could only hit this case by recurring into computePercentageLogicalHeight on a positioned containing block.
         result = cb->computeContentBoxLogicalHeight(cb->availableLogicalHeight());
@@ -2183,7 +2193,7 @@ LayoutUnit RenderBox::computeReplacedLogicalWidthUsing(Length logicalWidth) cons
             // FIXME: containingBlockLogicalWidthForContent() is wrong if the replaced element's block-flow is perpendicular to the
             // containing block's block-flow.
             // https://bugs.webkit.org/show_bug.cgi?id=46496
-            const LayoutUnit cw = isPositioned() ? containingBlockLogicalWidthForPositioned(toRenderBoxModelObject(container())) : containingBlockLogicalWidthForContent();
+            const LayoutUnit cw = isOutOfFlowPositioned() ? containingBlockLogicalWidthForPositioned(toRenderBoxModelObject(container())) : containingBlockLogicalWidthForContent();
             if (cw > 0)
                 return computeContentBoxLogicalWidth(minimumValueForLength(logicalWidth, cw));
         }
@@ -2213,7 +2223,7 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(Length logicalHeight) co
         case Percent:
         case Calculated:
         {
-            RenderObject* cb = isPositioned() ? container() : containingBlock();
+            RenderObject* cb = isOutOfFlowPositioned() ? container() : containingBlock();
             while (cb->isAnonymous()) {
                 cb = cb->containingBlock();
                 toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
@@ -2221,7 +2231,7 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(Length logicalHeight) co
 
             // FIXME: This calculation is not patched for block-flow yet.
             // https://bugs.webkit.org/show_bug.cgi?id=46500
-            if (cb->isPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
+            if (cb->isOutOfFlowPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
                 ASSERT(cb->isRenderBlock());
                 RenderBlock* block = toRenderBlock(cb);
                 LayoutUnit oldHeight = block->height();
@@ -2235,7 +2245,7 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(Length logicalHeight) co
             // containing block's block-flow.
             // https://bugs.webkit.org/show_bug.cgi?id=46496
             LayoutUnit availableHeight;
-            if (isPositioned())
+            if (isOutOfFlowPositioned())
                 availableHeight = containingBlockLogicalHeightForPositioned(toRenderBoxModelObject(cb));
             else {
                 availableHeight =  toRenderBox(cb)->availableLogicalHeight();
@@ -2290,7 +2300,7 @@ LayoutUnit RenderBox::availableLogicalHeightUsing(const Length& h) const
         // https://bugs.webkit.org/show_bug.cgi?id=64046
         // For absolutely positioned elements whose containing block is based on a block-level element,
         // the percentage is calculated with respect to the height of the padding box of that element
-        if (isPositioned())
+        if (isOutOfFlowPositioned())
             availableHeight = containingBlockLogicalHeightForPositioned(containingBlock());
         else
             availableHeight = containingBlock()->availableLogicalHeight();
@@ -2299,7 +2309,7 @@ LayoutUnit RenderBox::availableLogicalHeightUsing(const Length& h) const
 
     // FIXME: We can't just check top/bottom here.
     // https://bugs.webkit.org/show_bug.cgi?id=46500
-    if (isRenderBlock() && isPositioned() && style()->height().isAuto() && !(style()->top().isAuto() || style()->bottom().isAuto())) {
+    if (isRenderBlock() && isOutOfFlowPositioned() && style()->height().isAuto() && !(style()->top().isAuto() || style()->bottom().isAuto())) {
         RenderBlock* block = const_cast<RenderBlock*>(toRenderBlock(this));
         LayoutUnit oldHeight = block->logicalHeight();
         block->computeLogicalHeight();
@@ -3669,7 +3679,7 @@ static bool percentageLogicalHeightIsResolvable(const RenderBox* box)
     // block has an auto height. We still skip anonymous containing blocks in both modes, though, and look
     // only at explicit containers.
     const RenderBlock* cb = box->containingBlock();
-    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
+    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isOutOfFlowPositioned() && cb->style()->logicalHeight().isAuto()) {
         if (!box->document()->inQuirksMode() && !cb->isAnonymousBlock())
             break;
         cb = cb->containingBlock();
@@ -3679,7 +3689,7 @@ static bool percentageLogicalHeightIsResolvable(const RenderBox* box)
     // explicitly specified that can be used for any percentage computations.
     // FIXME: We can't just check top/bottom here.
     // https://bugs.webkit.org/show_bug.cgi?id=46500
-    bool isPositionedWithSpecifiedHeight = cb->isPositioned() && (!cb->style()->logicalHeight().isAuto() || (!cb->style()->top().isAuto() && !cb->style()->bottom().isAuto()));
+    bool isOutOfFlowPositionedWithSpecifiedHeight = cb->isOutOfFlowPositioned() && (!cb->style()->logicalHeight().isAuto() || (!cb->style()->top().isAuto() && !cb->style()->bottom().isAuto()));
 
     // Table cells violate what the CSS spec says to do with heights.  Basically we
     // don't care if the cell specified a height or not.  We just always make ourselves
@@ -3691,11 +3701,11 @@ static bool percentageLogicalHeightIsResolvable(const RenderBox* box)
     // height.
     if (cb->style()->logicalHeight().isFixed())
         return true;
-    if (cb->style()->logicalHeight().isPercent() && !isPositionedWithSpecifiedHeight)
+    if (cb->style()->logicalHeight().isPercent() && !isOutOfFlowPositionedWithSpecifiedHeight)
         return percentageLogicalHeightIsResolvable(cb);
-    if (cb->isRenderView() || (cb->isBody() && box->document()->inQuirksMode()) || isPositionedWithSpecifiedHeight)
+    if (cb->isRenderView() || (cb->isBody() && box->document()->inQuirksMode()) || isOutOfFlowPositionedWithSpecifiedHeight)
         return true;
-    if (cb->isRoot() && box->isPositioned()) {
+    if (cb->isRoot() && box->isOutOfFlowPositioned()) {
         // Match the positioned objects behavior, which is that positioned objects will fill their viewport
         // always.  Note we could only hit this case by recurring into computePercentageLogicalHeight on a positioned containing block.
         return true;
@@ -3969,7 +3979,7 @@ RenderObject* RenderBox::splitAnonymousBoxesAroundChild(RenderObject* beforeChil
             postBox->setChildrenInline(boxToSplit->childrenInline());
             RenderBox* parentBox = toRenderBox(boxToSplit->parent());
             parentBox->virtualChildren()->insertChildNode(parentBox, postBox, boxToSplit->nextSibling());
-            boxToSplit->moveChildrenTo(postBox, beforeChild, 0, boxToSplit->hasLayer());
+            boxToSplit->moveChildrenTo(postBox, beforeChild, 0, true);
 
             markBoxForRelayoutAfterSplit(boxToSplit);
             markBoxForRelayoutAfterSplit(postBox);
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 4bebf7eab..9f0577e82 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -42,7 +42,7 @@ public:
     RenderBox(Node*);
     virtual ~RenderBox();
 
-    virtual bool requiresLayer() const OVERRIDE { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasHiddenBackface() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    virtual bool requiresLayer() const OVERRIDE { return isRoot() || isOutOfFlowPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasHiddenBackface() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
 
     // Use this with caution! No type checking is done!
     RenderBox* firstChildBox() const;
@@ -263,7 +263,7 @@ public:
 
     virtual void layout();
     virtual void paint(PaintInfo&, const LayoutPoint&);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual LayoutUnit minPreferredLogicalWidth() const;
     virtual LayoutUnit maxPreferredLogicalWidth() const;
@@ -326,7 +326,7 @@ public:
 
     bool stretchesToViewport() const
     {
-        return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody()) && !document()->shouldDisplaySeamlesslyWithParent();
+        return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrOutOfFlowPositioned() && (isRoot() || isBody()) && !document()->shouldDisplaySeamlesslyWithParent();
     }
 
     virtual IntSize intrinsicSize() const { return IntSize(); }
@@ -335,7 +335,7 @@ public:
 
     // Whether or not the element shrinks to its intrinsic width (rather than filling the width
     // of a containing block).  HTML4 buttons, <select>s, <input>s, legends, and floating/compact elements do this.
-    bool sizesToIntrinsicLogicalWidth(LogicalWidthType) const;
+    bool sizesLogicalWidthToFitContent(LogicalWidthType) const;
     virtual bool stretchesToMinIntrinsicLogicalWidth() const { return false; }
 
     LayoutUnit shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
@@ -427,7 +427,7 @@ public:
 
     bool isWritingModeRoot() const { return !parent() || parent()->style()->writingMode() != style()->writingMode(); }
 
-    bool isDeprecatedFlexItem() const { return !isInline() && !isFloatingOrPositioned() && parent() && parent()->isDeprecatedFlexibleBox(); }
+    bool isDeprecatedFlexItem() const { return !isInline() && !isFloatingOrOutOfFlowPositioned() && parent() && parent()->isDeprecatedFlexibleBox(); }
     
     virtual LayoutUnit lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index d40fba151..b77438d96 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -517,11 +517,11 @@ LayoutSize RenderBoxModelObject::relativePositionOffset() const
 
 LayoutPoint RenderBoxModelObject::adjustedPositionRelativeToOffsetParent(const LayoutPoint& startPoint) const
 {
-    // If the element is the HTML body element or does not have an associated box
+    // If the element is the HTML body element or doesn't have a parent
     // return 0 and stop this algorithm.
-    if (isBody())
+    if (isBody() || !parent())
         return LayoutPoint();
-    
+
     LayoutPoint referencePoint = startPoint;
     referencePoint.move(parent()->offsetForColumns(referencePoint));
     
@@ -531,7 +531,7 @@ LayoutPoint RenderBoxModelObject::adjustedPositionRelativeToOffsetParent(const L
     if (const RenderBoxModelObject* offsetParent = this->offsetParent()) {
         if (offsetParent->isBox() && !offsetParent->isBody())
             referencePoint.move(-toRenderBox(offsetParent)->borderLeft(), -toRenderBox(offsetParent)->borderTop());
-        if (!isPositioned()) {
+        if (!isOutOfFlowPositioned()) {
             if (isRelPositioned())
                 referencePoint.move(relativePositionOffset());
             const RenderObject* curr = parent();
@@ -542,7 +542,7 @@ LayoutPoint RenderBoxModelObject::adjustedPositionRelativeToOffsetParent(const L
                 referencePoint.move(curr->parent()->offsetForColumns(referencePoint));
                 curr = curr->parent();
             }
-            if (offsetParent->isBox() && offsetParent->isBody() && !offsetParent->isRelPositioned() && !offsetParent->isPositioned())
+            if (offsetParent->isBox() && offsetParent->isBody() && !offsetParent->isRelPositioned() && !offsetParent->isOutOfFlowPositioned())
                 referencePoint.moveBy(toRenderBox(offsetParent)->topLeftLocation());
         }
     }
@@ -2740,7 +2740,7 @@ void RenderBoxModelObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransform
 
     LayoutSize containerOffset = offsetFromContainer(o, LayoutPoint());
 
-    if (!style()->isPositioned() && o->hasColumns()) {
+    if (!style()->isOutOfFlowPositioned() && o->hasColumns()) {
         RenderBlock* block = static_cast<RenderBlock*>(o);
         LayoutPoint point(roundedLayoutPoint(transformState.mappedPoint()));
         point -= containerOffset;
@@ -2758,6 +2758,11 @@ void RenderBoxModelObject::mapAbsoluteToLocalPoint(bool fixed, bool useTransform
 
 void RenderBoxModelObject::moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
 {
+    // FIXME: We need a performant way to handle clearing positioned objects from our list that are
+    // in |child|'s subtree so we could just clear them here. Because of this, we assume that callers
+    // have cleared their positioned objects list for child moves (!fullRemoveInsert) to avoid any badness.
+    ASSERT(!fullRemoveInsert || !isRenderBlock() || !toRenderBlock(this)->hasPositionedObjects());
+
     ASSERT(this == child->parent());
     ASSERT(!beforeChild || toBoxModelObject == beforeChild->parent());
     if (fullRemoveInsert && (toBoxModelObject->isRenderBlock() || toBoxModelObject->isRenderInline())) {
@@ -2770,6 +2775,15 @@ void RenderBoxModelObject::moveChildTo(RenderBoxModelObject* toBoxModelObject, R
 
 void RenderBoxModelObject::moveChildrenTo(RenderBoxModelObject* toBoxModelObject, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
 {
+    // This condition is rarely hit since this function is usually called on
+    // anonymous blocks which can no longer carry positioned objects (see r120761)
+    // or when fullRemoveInsert is false.
+    if (fullRemoveInsert && isRenderBlock()) {
+        RenderBlock* block = toRenderBlock(this);
+        if (block->hasPositionedObjects())
+            block->removePositionedObjects(0);
+    }
+
     ASSERT(!beforeChild || toBoxModelObject == beforeChild->parent());
     for (RenderObject* child = startChild; child && child != endChild; ) {
         // Save our next sibling as moveChildTo will clear it.
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 6c0bcca64..b14f53d21 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -79,7 +79,7 @@ public:
 
     bool hasSelfPaintingLayer() const;
     RenderLayer* layer() const { return m_layer; }
-    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasTransform() || hasHiddenBackface() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    virtual bool requiresLayer() const { return isRoot() || isOutOfFlowPositioned() || isRelPositioned() || isTransparent() || hasTransform() || hasHiddenBackface() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
 
     // This will work on inlines to return the bounding box of all of the lines' border boxes.
     virtual IntRect borderBoundingBox() const = 0;
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index a4c4b8910..aeeed10d3 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -147,7 +147,7 @@ static LayoutUnit marginWidthForChild(RenderBox* child)
 static bool childDoesNotAffectWidthOrFlexing(RenderObject* child)
 {
     // Positioned children and collapsed children don't affect the min/max width.
-    return child->isPositioned() || child->style()->visibility() == COLLAPSE;
+    return child->isOutOfFlowPositioned() || child->style()->visibility() == COLLAPSE;
 }
 
 void RenderDeprecatedFlexibleBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
@@ -285,7 +285,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     computeRegionRangeForBlock();
 
-    if (!isFloatingOrPositioned() && height() == 0) {
+    if (!isFloatingOrOutOfFlowPositioned() && height() == 0) {
         // We are a block with no border and padding and a computed height
         // of 0.  The CSS spec states that zero-height blocks collapse their margins
         // together.
@@ -382,7 +382,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             if (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent())))
                 child->setChildNeedsLayout(true, MarkOnlyThis);
 
-            if (child->isPositioned())
+            if (child->isOutOfFlowPositioned())
                 continue;
 
             // Compute the child's vertical margins.
@@ -430,7 +430,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         // Now that our height is actually known, we can place our boxes.
         m_stretchingChildren = (style()->boxAlign() == BSTRETCH);
         for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-            if (child->isPositioned()) {
+            if (child->isOutOfFlowPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
                 childLayer->setStaticInlinePosition(xPos); // FIXME: Not right for regions.
@@ -440,7 +440,9 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                         child->setChildNeedsLayout(true, MarkOnlyThis);
                 }
                 continue;
-            } else if (child->style()->visibility() == COLLAPSE) {
+            }
+            
+            if (child->style()->visibility() == COLLAPSE) {
                 // visibility: collapsed children do not participate in our positioning.
                 // But we need to lay them down.
                 child->layoutIfNeeded();
@@ -671,7 +673,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (!haveLineClamp && (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))))
                 child->setChildNeedsLayout(true, MarkOnlyThis);
 
-            if (child->isPositioned()) {
+            if (child->isOutOfFlowPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
                 childLayer->setStaticInlinePosition(borderStart() + paddingStart()); // FIXME: Not right for regions.
@@ -681,7 +683,9 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                         child->setChildNeedsLayout(true, MarkOnlyThis);
                 }
                 continue;
-            } else if (child->style()->visibility() == COLLAPSE) {
+            }
+            
+            if (child->style()->visibility() == COLLAPSE) {
                 // visibility: collapsed children do not participate in our positioning.
                 // But we need to lay them down.
                 child->layoutIfNeeded();
@@ -979,6 +983,7 @@ void RenderDeprecatedFlexibleBox::applyLineClamp(FlexBoxIterator& iterator, bool
             continue;
 
         // Let the truncation code kick in.
+        // FIXME: the text alignment should be recomputed after the width changes due to truncation.
         lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, leftToRight, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
         destBlock->setHasMarkupTruncation(true);
     }
@@ -1077,7 +1082,7 @@ const char *RenderDeprecatedFlexibleBox::renderName() const
 {
     if (isFloating())
         return "RenderDeprecatedFlexibleBox (floating)";
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         return "RenderDeprecatedFlexibleBox (positioned)";
     if (isAnonymous())
         return "RenderDeprecatedFlexibleBox (generated)";
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index 315c16f8a..a3657fae3 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -263,7 +263,7 @@ void RenderEmbeddedObject::viewCleared()
     }
 }
 
-bool RenderEmbeddedObject::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderEmbeddedObject::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     if (!RenderPart::nodeAtPoint(request, result, pointInContainer, accumulatedOffset, hitTestAction))
         return false;
@@ -272,7 +272,7 @@ bool RenderEmbeddedObject::nodeAtPoint(const HitTestRequest& request, HitTestRes
         return true;
 
     PluginViewBase* view = static_cast<PluginViewBase*>(widget());
-    IntPoint roundedPoint = roundedIntPoint(pointInContainer);
+    IntPoint roundedPoint = pointInContainer.roundedPoint();
 
     if (Scrollbar* horizontalScrollbar = view->horizontalScrollbar()) {
         if (horizontalScrollbar->shouldParticipateInHitTesting() && horizontalScrollbar->frameRect().contains(roundedPoint)) {
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.h b/Source/WebCore/rendering/RenderEmbeddedObject.h
index 1e0bffb30..7da6fc88f 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.h
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.h
@@ -69,7 +69,7 @@ private:
     virtual void layout();
     virtual void viewCleared();
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier, Node** stopNode);
     virtual bool logicalScroll(ScrollLogicalDirection, ScrollGranularity, float multiplier, Node** stopNode);
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 3138f22fc..c180c8536 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -126,7 +126,7 @@ RenderObject* RenderFieldset::layoutSpecialExcludedChild(bool relayoutChildren)
 RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
-        if (!legend->isFloatingOrPositioned() && legend->node() && (legend->node()->hasTagName(legendTag)))
+        if (!legend->isFloatingOrOutOfFlowPositioned() && legend->node() && (legend->node()->hasTagName(legendTag)))
             return toRenderBox(legend);
     }
     return 0;
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 8aba6d9a0..47289cf22 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -161,7 +161,7 @@ void RenderFlexibleBox::computePreferredLogicalWidths()
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = 0;
 
         for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-            if (child->isPositioned())
+            if (child->isOutOfFlowPositioned())
                 continue;
 
             LayoutUnit margin = marginLogicalWidthForChild(child, style());
@@ -642,7 +642,7 @@ LayoutUnit RenderFlexibleBox::autoMarginOffsetInMainAxis(const OrderedFlexItemLi
     bool isHorizontal = isHorizontalFlow();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
-        if (child->isPositioned())
+        if (child->isOutOfFlowPositioned())
             continue;
         if (isHorizontal) {
             if (child->style()->marginLeft().isAuto())
@@ -689,7 +689,7 @@ bool RenderFlexibleBox::hasAutoMarginsInCrossAxis(RenderBox* child)
 LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox* child)
 {
     LayoutUnit childCrossExtent = 0;
-    if (!child->isPositioned())
+    if (!child->isOutOfFlowPositioned())
         childCrossExtent = crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child);
     return lineCrossAxisExtent - childCrossExtent;
 }
@@ -743,7 +743,7 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Ord
     for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
         orderValues.add(child->style()->order());
 
-        if (child->isPositioned())
+        if (child->isOutOfFlowPositioned())
             continue;
 
         child->clearOverrideSize();
@@ -808,7 +808,7 @@ bool RenderFlexibleBox::computeNextFlexLine(OrderIterator& iterator, OrderedFlex
     LayoutUnit lineBreak = lineBreakLength();
 
     for (RenderBox* child = iterator.currentChild(); child; child = iterator.next()) {
-        if (child->isPositioned()) {
+        if (child->isOutOfFlowPositioned()) {
             orderedChildren.append(child);
             continue;
         }
@@ -854,7 +854,7 @@ bool RenderFlexibleBox::resolveFlexibleLengths(FlexSign flexSign, const OrderedF
     WTF::Vector<Violation> maxViolations;
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
-        if (child->isPositioned()) {
+        if (child->isOutOfFlowPositioned()) {
             childSizes.append(0);
             continue;
         }
@@ -926,7 +926,7 @@ void RenderFlexibleBox::setLogicalOverrideSize(RenderBox* child, LayoutUnit chil
 
 void RenderFlexibleBox::prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset, PositionedLayoutMode layoutMode)
 {
-    ASSERT(child->isPositioned());
+    ASSERT(child->isOutOfFlowPositioned());
     child->containingBlock()->insertPositionedObject(child);
     RenderLayer* childLayer = child->layer();
     LayoutUnit inlinePosition = isColumnFlow() ? crossAxisOffset : mainAxisOffset;
@@ -974,7 +974,7 @@ void RenderFlexibleBox::layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, cons
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
-        if (child->isPositioned()) {
+        if (child->isOutOfFlowPositioned()) {
             prepareChildForPositionedLayout(child, mainAxisOffset, crossAxisOffset, FlipForRowReverse);
             mainAxisOffset += justifyContentSpaceBetweenChildren(availableFreeSpace, style()->justifyContent(), childSizes.size());
             continue;
@@ -1040,7 +1040,7 @@ void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children,
 
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
-        if (child->isPositioned()) {
+        if (child->isOutOfFlowPositioned()) {
             child->layer()->setStaticBlockPosition(mainAxisOffset);
             mainAxisOffset -= justifyContentSpaceBetweenChildren(availableFreeSpace, style()->justifyContent(), childSizes.size());
             continue;
@@ -1108,7 +1108,7 @@ void RenderFlexibleBox::alignFlexLines(OrderIterator& iterator, WTF::Vector<Line
 
 void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit delta)
 {
-    if (child->isPositioned()) {
+    if (child->isOutOfFlowPositioned()) {
         LayoutUnit staticInlinePosition = child->layer()->staticInlinePosition();
         LayoutUnit staticBlockPosition = child->layer()->staticBlockPosition();
         LayoutUnit mainAxis = isColumnFlow() ? staticBlockPosition : staticInlinePosition;
@@ -1227,7 +1227,7 @@ void RenderFlexibleBox::flipForRightToLeftColumn(OrderIterator& iterator)
 
     LayoutUnit crossExtent = crossAxisExtent();
     for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        if (child->isPositioned())
+        if (child->isOutOfFlowPositioned())
             continue;
         LayoutPoint location = flowAwareLocationForChild(child);
         location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index fdc2e6bff..669d46d4d 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -299,24 +299,24 @@ void RenderFlowThread::paintIntoRegion(PaintInfo& paintInfo, RenderRegion* regio
     }
 }
 
-bool RenderFlowThread::hitTestRegion(RenderRegion* region, const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
+bool RenderFlowThread::hitTestRegion(RenderRegion* region, const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
 {
     LayoutRect regionRect(region->regionRect());
     LayoutRect regionOverflowRect = region->regionOverflowRect();
     LayoutRect regionClippingRect(accumulatedOffset + (regionOverflowRect.location() - regionRect.location()), regionOverflowRect.size());
-    if (!regionClippingRect.contains(pointInContainer))
+    if (!regionClippingRect.contains(pointInContainer.point()))
         return false;
-    
-    LayoutPoint renderFlowThreadOffset;
+
+    LayoutSize renderFlowThreadOffset;
     if (style()->isFlippedBlocksWritingMode()) {
         LayoutRect flippedRegionRect(regionRect);
         flipForWritingMode(flippedRegionRect);
-        renderFlowThreadOffset = LayoutPoint(accumulatedOffset - flippedRegionRect.location());
+        renderFlowThreadOffset = accumulatedOffset - flippedRegionRect.location();
     } else
-        renderFlowThreadOffset = LayoutPoint(accumulatedOffset - regionRect.location());
+        renderFlowThreadOffset = accumulatedOffset - regionRect.location();
+
+    LayoutPoint transformedPoint = pointInContainer.point() - renderFlowThreadOffset;
 
-    LayoutPoint transformedPoint(pointInContainer.x() - renderFlowThreadOffset.x(), pointInContainer.y() - renderFlowThreadOffset.y());
-    
     // Always ignore clipping, since the RenderFlowThread has nothing to do with the bounds of the FrameView.
     HitTestRequest newRequest(request.type() | HitTestRequest::IgnoreClipping);
 
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index aea741ec1..c76ee0870 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -77,7 +77,7 @@ public:
     void computeLogicalHeight();
 
     void paintIntoRegion(PaintInfo&, RenderRegion*, const LayoutPoint& paintOffset);
-    bool hitTestRegion(RenderRegion*, const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset);
+    bool hitTestRegion(RenderRegion*, const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset);
 
     bool hasRegions() const { return m_regionList.size(); }
     bool hasValidRegions() const { ASSERT(!m_regionsInvalidated); return m_hasValidRegions; }
diff --git a/Source/WebCore/rendering/RenderFrameSet.cpp b/Source/WebCore/rendering/RenderFrameSet.cpp
index 7c89d8db8..c89547863 100644
--- a/Source/WebCore/rendering/RenderFrameSet.cpp
+++ b/Source/WebCore/rendering/RenderFrameSet.cpp
@@ -158,7 +158,7 @@ void RenderFrameSet::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 }
 
 bool RenderFrameSet::nodeAtPoint(const HitTestRequest& request, HitTestResult& result,
-    const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+    const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     if (action != HitTestForeground)
         return false;
diff --git a/Source/WebCore/rendering/RenderFrameSet.h b/Source/WebCore/rendering/RenderFrameSet.h
index 97be97428..7d69770e7 100644
--- a/Source/WebCore/rendering/RenderFrameSet.h
+++ b/Source/WebCore/rendering/RenderFrameSet.h
@@ -96,7 +96,7 @@ private:
     virtual bool isFrameSet() const { return true; }
 
     virtual void layout();
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
     virtual CursorDirective getCursor(const LayoutPoint&, Cursor&) const;
diff --git a/Source/WebCore/rendering/RenderGeometryMap.cpp b/Source/WebCore/rendering/RenderGeometryMap.cpp
index 77e04855d..af19ba4e2 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.cpp
+++ b/Source/WebCore/rendering/RenderGeometryMap.cpp
@@ -26,12 +26,13 @@
 #include "config.h"
 #include "RenderGeometryMap.h"
 
+#include "RenderLayer.h"
 #include "RenderView.h"
 #include "TransformState.h"
+#include <wtf/TemporaryChange.h>
 
 namespace WebCore {
 
-
 // Stores data about how to map from one renderer to its container.
 class RenderGeometryMapStep {
     WTF_MAKE_NONCOPYABLE(RenderGeometryMapStep);
@@ -170,18 +171,33 @@ void RenderGeometryMap::mapToAbsolute(TransformState& transformState) const
     transformState.flatten();    
 }
 
-void RenderGeometryMap::pushMappingsToAncestor(const RenderObject* renderer, const RenderBoxModelObject* ancestor)
+void RenderGeometryMap::pushMappingsToAncestor(const RenderObject* renderer, const RenderBoxModelObject* ancestorRenderer)
 {
-    const RenderObject* currRenderer = renderer;
-    
     // We need to push mappings in reverse order here, so do insertions rather than appends.
-    m_insertionPosition = m_mapping.size();
-    
+    TemporaryChange<size_t> positionChange(m_insertionPosition, m_mapping.size());
     do {
-        currRenderer = currRenderer->pushMappingToContainer(ancestor, *this);
-    } while (currRenderer && currRenderer != ancestor);
-    
-    m_insertionPosition = notFound;
+        renderer = renderer->pushMappingToContainer(ancestorRenderer, *this);
+    } while (renderer && renderer != ancestorRenderer);
+}
+
+void RenderGeometryMap::pushMappingsToAncestor(const RenderLayer* layer, const RenderLayer* ancestorLayer)
+{
+    const RenderObject* renderer = layer->renderer();
+
+    // The simple case can be handled fast in the layer tree.
+    bool canConvertInLayerTree = ancestorLayer && renderer->style()->position() != FixedPosition && !renderer->style()->isFlippedBlocksWritingMode();
+    for (const RenderLayer* current = layer; current != ancestorLayer && canConvertInLayerTree; current = current->parent())
+        canConvertInLayerTree = current->canUseConvertToLayerCoords();
+
+    if (canConvertInLayerTree) {
+        TemporaryChange<size_t> positionChange(m_insertionPosition, m_mapping.size());
+        LayoutPoint layerOffset;
+        layer->convertToLayerCoords(ancestorLayer, layerOffset);
+        push(renderer, toLayoutSize(layerOffset), /*accumulatingTransform*/ true, /*isNonUniform*/ false, /*isFixedPosition*/ false, /*hasTransform*/ false);
+        return;
+    }
+    const RenderBoxModelObject* ancestorRenderer = ancestorLayer ? ancestorLayer->renderer() : 0;
+    pushMappingsToAncestor(renderer, ancestorRenderer);
 }
 
 void RenderGeometryMap::push(const RenderObject* renderer, const LayoutSize& offsetFromContainer, bool accumulatingTransform, bool isNonUniform, bool isFixedPosition, bool hasTransform)
@@ -220,16 +236,22 @@ void RenderGeometryMap::pushView(const RenderView* view, const LayoutSize& scrol
     m_mapping.insert(m_insertionPosition, step.release());
 }
 
-void RenderGeometryMap::popMappingsToAncestor(const RenderBoxModelObject* ancestor)
+void RenderGeometryMap::popMappingsToAncestor(const RenderBoxModelObject* ancestorRenderer)
 {
     ASSERT(m_mapping.size());
 
-    while (m_mapping.size() && m_mapping.last()->m_renderer != ancestor) {
+    while (m_mapping.size() && m_mapping.last()->m_renderer != ancestorRenderer) {
         stepRemoved(*m_mapping.last().get());
         m_mapping.removeLast();
     }
 }
 
+void RenderGeometryMap::popMappingsToAncestor(const RenderLayer* ancestorLayer)
+{
+    const RenderBoxModelObject* ancestorRenderer = ancestorLayer ? ancestorLayer->renderer() : 0;
+    popMappingsToAncestor(ancestorRenderer);
+}
+
 void RenderGeometryMap::stepInserted(const RenderGeometryMapStep& step)
 {
     // Offset on the first step is the RenderView's offset, which is only applied when we have fixed-position.s
diff --git a/Source/WebCore/rendering/RenderGeometryMap.h b/Source/WebCore/rendering/RenderGeometryMap.h
index 6a6120333..68002a837 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.h
+++ b/Source/WebCore/rendering/RenderGeometryMap.h
@@ -36,6 +36,7 @@
 namespace WebCore {
 
 class RenderGeometryMapStep;
+class RenderLayer;
 
 // Can be used while walking the Renderer tree to cache data about offsets and transforms.
 class RenderGeometryMap {
@@ -47,7 +48,9 @@ public:
     FloatRect absoluteRect(const FloatRect&) const;
     
     // Called by code walking the renderer or layer trees.
-    void pushMappingsToAncestor(const RenderObject*, const RenderBoxModelObject* ancestor);
+    void pushMappingsToAncestor(const RenderLayer*, const RenderLayer* ancestorLayer);
+    void popMappingsToAncestor(const RenderLayer*);
+    void pushMappingsToAncestor(const RenderObject*, const RenderBoxModelObject* ancestorRenderer);
     void popMappingsToAncestor(const RenderBoxModelObject*);
     
     // The following methods should only be called by renderers inside a call to pushMappingsToAncestor().
@@ -70,8 +73,8 @@ private:
     bool hasTransformStep() const { return m_transformedStepsCount; }
     bool hasFixedPositionStep() const { return m_fixedStepsCount; }
     
-    typedef Vector<OwnPtr<RenderGeometryMapStep> > RenderGeometryMapSteps; // FIXME: inline capacity?
-    
+    typedef Vector<OwnPtr<RenderGeometryMapStep>, 32> RenderGeometryMapSteps;
+
     size_t m_insertionPosition;
     int m_nonUniformStepsCount;
     int m_transformedStepsCount;
diff --git a/Source/WebCore/rendering/RenderGrid.cpp b/Source/WebCore/rendering/RenderGrid.cpp
new file mode 100644
index 000000000..883e1710b
--- /dev/null
+++ b/Source/WebCore/rendering/RenderGrid.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "RenderGrid.h"
+
+namespace WebCore {
+
+RenderGrid::RenderGrid(Node* node)
+    : RenderBlock(node)
+{
+    // All of our children must be block level.
+    setChildrenInline(false);
+}
+
+RenderGrid::~RenderGrid()
+{
+}
+
+void RenderGrid::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight)
+{
+    // For now just call the base class.
+    RenderBlock::layoutBlock(relayoutChildren, pageLogicalHeight);
+}
+
+const char* RenderGrid::renderName() const
+{
+    if (isFloating())
+        return "RenderGrid (floating)";
+    if (isOutOfFlowPositioned())
+        return "RenderGrid (positioned)";
+    if (isAnonymous())
+        return "RenderGrid (generated)";
+    if (isRelPositioned())
+        return "RenderGrid (relative positioned)";
+    return "RenderGrid";
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderGrid.h b/Source/WebCore/rendering/RenderGrid.h
new file mode 100644
index 000000000..28498fe43
--- /dev/null
+++ b/Source/WebCore/rendering/RenderGrid.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderGrid_h
+#define RenderGrid_h
+
+#include "RenderBlock.h"
+
+namespace WebCore {
+
+class RenderGrid : public RenderBlock {
+public:
+    RenderGrid(Node*);
+    virtual ~RenderGrid();
+
+    virtual const char* renderName() const OVERRIDE;
+
+    virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0) OVERRIDE;
+
+    virtual bool avoidsFloats() const OVERRIDE { return true; }
+};
+
+} // namespace WebCore
+
+#endif // RenderGrid_h
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 093880e99..e3aea912d 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -140,6 +140,7 @@ void RenderImage::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     if (diff == StyleDifferenceLayout
         && (oldStyle->imageResolution() != style()->imageResolution()
+            || oldStyle->imageResolutionSnap() != style()->imageResolutionSnap()
             || oldStyle->imageResolutionSource() != style()->imageResolutionSource()))
         imageDimensionsChanged(true /* imageSizeChanged */);
 #endif
@@ -198,7 +199,12 @@ bool RenderImage::updateIntrinsicSizeIfNeeded(const IntSize& newSize, bool image
 void RenderImage::imageDimensionsChanged(bool imageSizeChanged, const IntRect* rect)
 {
 #if ENABLE(CSS_IMAGE_RESOLUTION)
-    bool intrinsicSizeChanged = updateIntrinsicSizeIfNeeded(m_imageResource->imageSize(style()->effectiveZoom() / style()->imageResolution()), imageSizeChanged);
+    double scale = style()->imageResolution();
+    if (style()->imageResolutionSnap() == ImageResolutionSnapPixels)
+        scale = roundForImpreciseConversion<int>(scale);
+    if (scale <= 0)
+        scale = 1;
+    bool intrinsicSizeChanged = updateIntrinsicSizeIfNeeded(m_imageResource->imageSize(style()->effectiveZoom() / scale), imageSizeChanged);
 #else
     bool intrinsicSizeChanged = updateIntrinsicSizeIfNeeded(m_imageResource->imageSize(style()->effectiveZoom()), imageSizeChanged);
 #endif
@@ -484,18 +490,18 @@ HTMLMapElement* RenderImage::imageMap() const
     return i ? i->treeScope()->getImageMap(i->fastGetAttribute(usemapAttr)) : 0;
 }
 
-bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
-    HitTestResult tempResult(result.point(), result.topPadding(), result.rightPadding(), result.bottomPadding(), result.leftPadding(), result.shadowContentFilterPolicy());
+    HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
     bool inside = RenderReplaced::nodeAtPoint(request, tempResult, pointInContainer, accumulatedOffset, hitTestAction);
 
     if (tempResult.innerNode() && node()) {
         if (HTMLMapElement* map = imageMap()) {
             LayoutRect contentBox = contentBoxRect();
             float scaleFactor = 1 / style()->effectiveZoom();
-            LayoutPoint mapLocation(pointInContainer.x() - accumulatedOffset.x() - this->x() - contentBox.x(), pointInContainer.y() - accumulatedOffset.y() - this->y() - contentBox.y());
+            LayoutPoint mapLocation = pointInContainer.point() - toLayoutSize(accumulatedOffset) - LayoutSize(this->x(), this->y()) - toLayoutSize(contentBox.location());
             mapLocation.scale(scaleFactor, scaleFactor);
-            
+
             if (map->mapMouseEvent(mapLocation, contentBox.size(), tempResult))
                 tempResult.setInnerNonSharedNode(node());
         }
@@ -535,7 +541,7 @@ void RenderImage::computeIntrinsicRatioInformation(FloatSize& intrinsicSize, dou
 
     // Our intrinsicSize is empty if we're rendering generated images with relative width/height. Figure out the right intrinsic size to use.
     if (intrinsicSize.isEmpty() && (m_imageResource->imageHasRelativeWidth() || m_imageResource->imageHasRelativeHeight())) {
-        RenderObject* containingBlock = isPositioned() ? container() : this->containingBlock();
+        RenderObject* containingBlock = isOutOfFlowPositioned() ? container() : this->containingBlock();
         if (containingBlock->isBox()) {
             RenderBox* box = toRenderBox(containingBlock);
             intrinsicSize.setWidth(box->availableLogicalWidth());
diff --git a/Source/WebCore/rendering/RenderImage.h b/Source/WebCore/rendering/RenderImage.h
index 11197cce1..e7092e11c 100644
--- a/Source/WebCore/rendering/RenderImage.h
+++ b/Source/WebCore/rendering/RenderImage.h
@@ -89,7 +89,7 @@ private:
     virtual int minimumReplacedHeight() const;
 
     virtual void notifyFinished(CachedResource*);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     IntSize imageSizeForError(CachedImage*) const;
     void imageDimensionsChanged(bool imageSizeChanged, const IntRect* = 0);
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 0e0b45321..a4b1c7931 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -302,7 +302,7 @@ void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderOb
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
 
-    if (!newChild->isInline() && !newChild->isFloatingOrPositioned()) {
+    if (!newChild->isInline() && !newChild->isFloatingOrOutOfFlowPositioned()) {
         // We are placing a block inside an inline. We have to perform a split of this
         // inline into continuations.  This involves creating an anonymous block box to hold
         // |newChild|.  We then make that block box a continuation of this inline.  We take all of
@@ -504,7 +504,7 @@ void RenderInline::addChildToContinuation(RenderObject* newChild, RenderObject*
             beforeChildParent = flow;
     }
 
-    if (newChild->isFloatingOrPositioned())
+    if (newChild->isFloatingOrOutOfFlowPositioned())
         return beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
 
     // A continuation always consists of two potential candidates: an inline or an anonymous
@@ -555,7 +555,7 @@ void RenderInline::generateCulledLineBoxRects(GeneratorContext yield, const Rend
     bool isHorizontal = style()->isHorizontalWritingMode();
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue;
             
         // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
@@ -753,7 +753,7 @@ const char* RenderInline::renderName() const
 }
 
 bool RenderInline::nodeAtPoint(const HitTestRequest& request, HitTestResult& result,
-                                const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+                                const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     return m_lineBoxes.hitTest(this, request, result, pointInContainer, accumulatedOffset, hitTestAction);
 }
@@ -837,7 +837,7 @@ IntRect RenderInline::linesBoundingBox() const
 InlineBox* RenderInline::culledInlineFirstLineBox() const
 {
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue;
             
         // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
@@ -861,7 +861,7 @@ InlineBox* RenderInline::culledInlineFirstLineBox() const
 InlineBox* RenderInline::culledInlineLastLineBox() const
 {
     for (RenderObject* curr = lastChild(); curr; curr = curr->previousSibling()) {
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue;
             
         // We want to get the margin box in the inline direction, and then use our font ascent/descent in the block
@@ -889,7 +889,7 @@ LayoutRect RenderInline::culledInlineVisualOverflowBoundingBox() const
     LayoutRect result(enclosingLayoutRect(floatResult));
     bool isHorizontal = style()->isHorizontalWritingMode();
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue;
             
         // For overflow we just have to propagate by hand and recompute it all.
@@ -1044,7 +1044,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
 
     LayoutPoint topLeft = rect.location();
 
-    if (o->isBlockFlow() && !style()->isPositioned()) {
+    if (o->isBlockFlow() && !style()->isOutOfFlowPositioned()) {
         RenderBlock* cb = toRenderBlock(o);
         if (cb->hasColumns()) {
             LayoutRect repaintRect(topLeft, rect.size());
@@ -1243,7 +1243,7 @@ void RenderInline::dirtyLineBoxes(bool fullLayout)
     if (!alwaysCreateLineBoxes()) {
         // We have to grovel into our children in order to dirty the appropriate lines.
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
-            if (curr->isFloatingOrPositioned())
+            if (curr->isFloatingOrOutOfFlowPositioned())
                 continue;
             if (curr->isBox() && !curr->needsLayout()) {
                 RenderBox* currBox = toRenderBox(curr);
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index a707a64df..722300ab8 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -122,7 +122,7 @@ private:
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual bool requiresLayer() const { return isRelPositioned() || isTransparent() || hasMask() || hasFilter(); }
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 94a837800..12c3b9267 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -125,6 +125,11 @@ using namespace HTMLNames;
 const int MinimumWidthWhileResizing = 100;
 const int MinimumHeightWhileResizing = 40;
 
+bool ClipRect::intersects(const HitTestPoint& hitTestPoint)
+{
+    return hitTestPoint.intersects(m_rect);
+}
+
 RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     : m_inResizeMode(false)
     , m_scrollDimensionsDirty(true)
@@ -601,7 +606,7 @@ static bool checkContainingBlockChainForPagination(RenderBoxModelObject* rendere
         return false;
         
     // If the previous block is absolutely positioned, then we can't be paginated by the columns block.
-    if (prevBlock->isPositioned())
+    if (prevBlock->isOutOfFlowPositioned())
         return false;
         
     // Otherwise we are paginated by the columns block.
@@ -802,7 +807,7 @@ void RenderLayer::updateLayerPosition()
     // Clear our cached clip rect information.
     clearClipRects();
  
-    if (!renderer()->isPositioned() && renderer()->parent()) {
+    if (!renderer()->isOutOfFlowPositioned() && renderer()->parent()) {
         // We must adjust our position by walking up the render tree looking for the
         // nearest enclosing object with a layer.
         RenderObject* curr = renderer()->parent();
@@ -821,14 +826,14 @@ void RenderLayer::updateLayerPosition()
     }
     
     // Subtract our parent's scroll offset.
-    if (renderer()->isPositioned() && enclosingPositionedAncestor()) {
+    if (renderer()->isOutOfFlowPositioned() && enclosingPositionedAncestor()) {
         RenderLayer* positionedParent = enclosingPositionedAncestor();
 
         // For positioned layers, we subtract out the enclosing positioned layer's scroll offset.
         LayoutSize offset = positionedParent->scrolledContentOffset();
         localPoint -= offset;
         
-        if (renderer()->isPositioned() && positionedParent->renderer()->isRelPositioned() && positionedParent->renderer()->isRenderInline()) {
+        if (renderer()->isOutOfFlowPositioned() && positionedParent->renderer()->isRelPositioned() && positionedParent->renderer()->isRenderInline()) {
             LayoutSize offset = toRenderInline(positionedParent->renderer())->relativePositionedInlineOffset(toRenderBox(renderer()));
             localPoint += offset;
         }
@@ -841,7 +846,7 @@ void RenderLayer::updateLayerPosition()
             localPoint += columnOffset;
         }
 
-        LayoutSize scrollOffset = parent()->scrolledContentOffset();
+        IntSize scrollOffset = parent()->scrolledContentOffset();
         localPoint -= scrollOffset;
     }
         
@@ -910,7 +915,7 @@ RenderLayer* RenderLayer::stackingContext() const
 static inline bool isPositionedContainer(RenderLayer* layer)
 {
     RenderBoxModelObject* layerRenderer = layer->renderer();
-    return layer->isRootLayer() || layerRenderer->isPositioned() || layerRenderer->isRelPositioned() || layer->hasTransform();
+    return layer->isRootLayer() || layerRenderer->isOutOfFlowPositioned() || layerRenderer->isRelPositioned() || layer->hasTransform();
 }
 
 static inline bool isFixedPositionedContainer(RenderLayer* layer)
@@ -1516,7 +1521,12 @@ static inline int adjustedScrollDelta(int beginningDelta) {
     return adjustedDelta;
 }
 
-void RenderLayer::panScrollFromPoint(const LayoutPoint& sourcePoint) 
+static inline IntSize adjustedScrollDelta(const IntSize& delta)
+{
+    return IntSize(adjustedScrollDelta(delta.width()), adjustedScrollDelta(delta.height()));
+}
+
+void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
 {
     Frame* frame = renderer()->frame();
     if (!frame)
@@ -1531,20 +1541,19 @@ void RenderLayer::panScrollFromPoint(const LayoutPoint& sourcePoint)
     else
         previousMousePosition = currentMousePosition;
 
-    int xDelta = currentMousePosition.x() - sourcePoint.x();
-    int yDelta = currentMousePosition.y() - sourcePoint.y();
+    IntSize delta = currentMousePosition - sourcePoint;
 
-    if (abs(xDelta) <= ScrollView::noPanScrollRadius) // at the center we let the space for the icon
-        xDelta = 0;
-    if (abs(yDelta) <= ScrollView::noPanScrollRadius)
-        yDelta = 0;
+    if (abs(delta.width()) <= ScrollView::noPanScrollRadius) // at the center we let the space for the icon
+        delta.setWidth(0);
+    if (abs(delta.height()) <= ScrollView::noPanScrollRadius)
+        delta.setHeight(0);
 
-    scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta), ScrollOffsetClamped);
+    scrollByRecursively(adjustedScrollDelta(delta), ScrollOffsetClamped);
 }
 
-void RenderLayer::scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping clamp)
+void RenderLayer::scrollByRecursively(const IntSize& delta, ScrollOffsetClamping clamp)
 {
-    if (!xDelta && !yDelta)
+    if (delta.isZero())
         return;
 
     bool restrictedByLineClamp = false;
@@ -1552,16 +1561,14 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClampi
         restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
-        int newOffsetX = scrollXOffset() + xDelta;
-        int newOffsetY = scrollYOffset() + yDelta;
-        scrollToOffset(newOffsetX, newOffsetY, clamp);
+        IntSize newScrollOffset = scrollOffset() + delta;
+        scrollToOffset(newScrollOffset, clamp);
 
         // If this layer can't do the scroll we ask the next layer up that can scroll to try
-        int leftToScrollX = newOffsetX - scrollXOffset();
-        int leftToScrollY = newOffsetY - scrollYOffset();
-        if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
+        IntSize remainingScrollOffset = newScrollOffset - scrollOffset();
+        if (!remainingScrollOffset.isZero() && renderer()->parent()) {
             if (RenderLayer* scrollableLayer = enclosingScrollableLayer())
-                scrollableLayer->scrollByRecursively(leftToScrollX, leftToScrollY);
+                scrollableLayer->scrollByRecursively(remainingScrollOffset);
 
             Frame* frame = renderer()->frame();
             if (frame)
@@ -1570,29 +1577,30 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClampi
     } else if (renderer()->view()->frameView()) {
         // If we are here, we were called on a renderer that can be programmatically scrolled, but doesn't
         // have an overflow clip. Which means that it is a document node that can be scrolled.
-        renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
+        renderer()->view()->frameView()->scrollBy(delta);
         // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
         // https://bugs.webkit.org/show_bug.cgi?id=28237
     }
 }
 
-void RenderLayer::scrollToOffset(int x, int y, ScrollOffsetClamping clamp)
+IntSize RenderLayer::clampScrollOffset(const IntSize& scrollOffset) const
 {
-    if (clamp == ScrollOffsetClamped) {
-        RenderBox* box = renderBox();
-        if (!box)
-            return;
+    RenderBox* box = renderBox();
+    ASSERT(box);
 
-        int maxX = scrollWidth() - box->clientWidth();
-        int maxY = scrollHeight() - box->clientHeight();
+    int maxX = scrollWidth() - box->clientWidth();
+    int maxY = scrollHeight() - box->clientHeight();
 
-        x = min(max(x, 0), maxX);
-        y = min(max(y, 0), maxY);
-    }
+    int x = min(max(scrollOffset.width(), 0), maxX);
+    int y = min(max(scrollOffset.height(), 0), maxY);
+    return IntSize(x, y);
+}
 
-    IntPoint newScrollOffset(x, y);
-    if (newScrollOffset != LayoutPoint(scrollXOffset(), scrollYOffset()))
-        scrollToOffsetWithoutAnimation(newScrollOffset);
+void RenderLayer::scrollToOffset(const IntSize& scrollOffset, ScrollOffsetClamping clamp)
+{
+    IntSize newScrollOffset = clamp == ScrollOffsetClamped ? clampScrollOffset(scrollOffset) : scrollOffset;
+    if (newScrollOffset != this->scrollOffset())
+        scrollToOffsetWithoutAnimation(toPoint(newScrollOffset));
 }
 
 void RenderLayer::scrollTo(int x, int y)
@@ -1687,23 +1695,14 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
         LayoutRect exposeRect = LayoutRect(rect.x() + scrollXOffset(), rect.y() + scrollYOffset(), rect.width(), rect.height());
         LayoutRect r = getRectToExpose(layerBounds, exposeRect, alignX, alignY);
         
-        LayoutUnit adjustedX = r.x() - absPos.x();
-        LayoutUnit adjustedY = r.y() - absPos.y();
-        // Adjust offsets if they're outside of the allowable range.
-        adjustedX = max<LayoutUnit>(0, min(scrollWidth() - layerBounds.width(), adjustedX));
-        adjustedY = max<LayoutUnit>(0, min(scrollHeight() - layerBounds.height(), adjustedY));
-
-        int xOffset = roundToInt(adjustedX);
-        int yOffset = roundToInt(adjustedY);
-        
-        if (xOffset != scrollXOffset() || yOffset != scrollYOffset()) {
-            int diffX = scrollXOffset();
-            int diffY = scrollYOffset();
-            scrollToOffset(xOffset, yOffset);
-            diffX = scrollXOffset() - diffX;
-            diffY = scrollYOffset() - diffY;
-            newRect.setX(rect.x() - diffX);
-            newRect.setY(rect.y() - diffY);
+        int roundedAdjustedX = roundToInt(r.x() - absPos.x());
+        int roundedAdjustedY = roundToInt(r.y() - absPos.y());
+        IntSize clampedScrollOffset = clampScrollOffset(IntSize(roundedAdjustedX, roundedAdjustedY));
+        if (clampedScrollOffset != scrollOffset()) {
+            IntSize oldScrollOffset = scrollOffset();
+            scrollToOffset(clampedScrollOffset);
+            IntSize scrollOffsetDifference = scrollOffset() - oldScrollOffset;
+            newRect.move(-scrollOffsetDifference);
         }
     } else if (!parentLayer && renderer()->isBox() && renderBox()->canBeProgramaticallyScrolled()) {
         if (frameView) {
@@ -2556,23 +2555,22 @@ void RenderLayer::updateScrollInfoAfterLayout()
         return;
 
     m_scrollDimensionsDirty = true;
-    IntSize scrollOffsetOriginal(scrollXOffset(), scrollYOffset());
+    IntSize originalScrollOffset = scrollOffset();
 
     computeScrollDimensions();
 
     if (box->style()->overflowX() != OMARQUEE) {
         // Layout may cause us to be at an invalid scroll position. In this case we need
         // to pull our scroll offsets back to the max (or push them up to the min).
-        int newX = max(0, min<int>(scrollXOffset(), scrollWidth() - box->clientWidth()));
-        int newY = max(0, min<int>(scrollYOffset(), scrollHeight() - box->clientHeight()));
-        if (newX != scrollXOffset() || newY != scrollYOffset())
-            scrollToOffset(newX, newY);
+        IntSize clampedScrollOffset = clampScrollOffset(scrollOffset());
+        if (clampedScrollOffset != scrollOffset())
+            scrollToOffset(clampedScrollOffset);
     }
 
     updateScrollbarsAfterLayout();
 
-    if (scrollOffsetOriginal != scrollOffset())
-        scrollToOffsetWithoutAnimation(IntPoint(scrollXOffset(), scrollYOffset()));
+    if (originalScrollOffset != scrollOffset())
+        scrollToOffsetWithoutAnimation(toPoint(scrollOffset()));
 }
 
 void RenderLayer::paintOverflowControls(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect, bool paintingOverlayControls)
@@ -3361,7 +3359,7 @@ bool RenderLayer::hitTest(const HitTestRequest& request, HitTestResult& result)
     if (!request.ignoreClipping())
         hitTestArea.intersect(frameVisibleRect(renderer()));
 
-    RenderLayer* insideLayer = hitTestLayer(this, 0, request, result, hitTestArea, result.point(), false);
+    RenderLayer* insideLayer = hitTestLayer(this, 0, request, result, hitTestArea, result.hitTestPoint(), false);
     if (!insideLayer) {
         // We didn't hit any layer. If we are the root layer and the mouse is -- or just was -- down, 
         // return ourselves. We do this so mouse events continue getting delivered after a drag has 
@@ -3413,7 +3411,7 @@ static double computeZOffset(const HitTestingTransformState& transformState)
 }
 
 PassRefPtr<HitTestingTransformState> RenderLayer::createLocalTransformState(RenderLayer* rootLayer, RenderLayer* containerLayer,
-                                        const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                                        const LayoutRect& hitTestRect, const HitTestPoint& hitTestPoint,
                                         const HitTestingTransformState* containerTransformState) const
 {
     RefPtr<HitTestingTransformState> transformState;
@@ -3425,7 +3423,7 @@ PassRefPtr<HitTestingTransformState> RenderLayer::createLocalTransformState(Rend
     } else {
         // If this is the first time we need to make transform state, then base it off of hitTestPoint,
         // which is relative to rootLayer.
-        transformState = HitTestingTransformState::create(hitTestPoint, FloatQuad(hitTestRect));
+        transformState = HitTestingTransformState::create(hitTestPoint.point(), FloatQuad(hitTestRect));
         convertToLayerCoords(rootLayer, offset);
     }
     
@@ -3475,22 +3473,20 @@ static bool isHitCandidate(const RenderLayer* hitLayer, bool canDepthSort, doubl
 // If zOffset is non-null (which indicates that the caller wants z offset information), 
 //  *zOffset on return is the z offset of the hit point relative to the containing flattening layer.
 RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
-                                       const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint, bool appliedTransform,
+                                       const LayoutRect& hitTestRect, const HitTestPoint& hitTestPoint, bool appliedTransform,
                                        const HitTestingTransformState* transformState, double* zOffset)
 {
     // The natural thing would be to keep HitTestingTransformState on the stack, but it's big, so we heap-allocate.
 
     bool useTemporaryClipRects = renderer()->view()->frameView()->containsScrollableAreaWithOverlayScrollbars();
 
-    LayoutRect hitTestArea = result.rectForPoint(hitTestPoint);
-
     // Apply a transform if we have one.
     if (transform() && !appliedTransform) {
         // Make sure the parent's clip rects have been calculated.
         if (parent()) {
             ClipRect clipRect = backgroundClipRect(rootLayer, result.region(), useTemporaryClipRects ? TemporaryClipRects : RootRelativeClipRects, IncludeOverlayScrollbarSize);
             // Go ahead and test the enclosing clip now.
-            if (!clipRect.intersects(hitTestArea))
+            if (!clipRect.intersects(hitTestPoint))
                 return 0;
         }
 
@@ -3509,15 +3505,17 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
         // by our container.
         LayoutPoint localPoint = roundedLayoutPoint(newTransformState->mappedPoint());
         LayoutRect localHitTestRect = newTransformState->boundsOfMappedQuad();
+        HitTestPoint newHitTestPoint(result.hitTestPoint());
+        newHitTestPoint.setPoint(localPoint);
 
         // Now do a hit test with the root layer shifted to be us.
-        return hitTestLayer(this, containerLayer, request, result, localHitTestRect, localPoint, true, newTransformState.get(), zOffset);
+        return hitTestLayer(this, containerLayer, request, result, localHitTestRect, newHitTestPoint, true, newTransformState.get(), zOffset);
     }
 
     // Ensure our lists and 3d status are up-to-date.
     updateCompositingAndLayerListsIfNeeded();
     update3DTransformedDescendantStatus();
-    
+
     RefPtr<HitTestingTransformState> localTransformState;
     if (appliedTransform) {
         // We computed the correct state in the caller (above code), so just reference it.
@@ -3573,8 +3571,8 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
         // Container needs us to give back a z offset for the hit layer.
         zOffsetForContentsPtr = zOffset;
     }
-    
-    // This variable tracks which layer the mouse ends up being inside. 
+
+    // This variable tracks which layer the mouse ends up being inside.
     RenderLayer* candidateLayer = 0;
 
     // Begin by walking our list of positive layers from highest z-index down to the lowest z-index.
@@ -3596,7 +3594,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     }
 
     // Next we want to see if the mouse pos is inside the child RenderObjects of the layer.
-    if (fgRect.intersects(hitTestArea) && isSelfPaintingLayer()) {
+    if (fgRect.intersects(hitTestPoint) && isSelfPaintingLayer()) {
         // Hit test with a temporary HitTestResult, because we only want to commit to 'result' if we know we're frontmost.
         HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestDescendants) &&
@@ -3626,7 +3624,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     if (candidateLayer)
         return candidateLayer;
 
-    if (bgRect.intersects(hitTestArea) && isSelfPaintingLayer()) {
+    if (bgRect.intersects(hitTestPoint) && isSelfPaintingLayer()) {
         HitTestResult tempResult(result.hitTestPoint(), result.shadowContentFilterPolicy());
         if (hitTestContents(request, tempResult, layerBounds, hitTestPoint, HitTestSelf) &&
             isHitCandidate(this, false, zOffsetForContentsPtr, unflattenedTransformState.get())) {
@@ -3638,11 +3636,11 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
         } else if (result.isRectBasedTest())
             result.append(tempResult);
     }
-    
+
     return 0;
 }
 
-bool RenderLayer::hitTestContents(const HitTestRequest& request, HitTestResult& result, const LayoutRect& layerBounds, const LayoutPoint& hitTestPoint, HitTestFilter hitTestFilter) const
+bool RenderLayer::hitTestContents(const HitTestRequest& request, HitTestResult& result, const LayoutRect& layerBounds, const HitTestPoint& hitTestPoint, HitTestFilter hitTestFilter) const
 {
     if (!renderer()->hitTest(request, result, hitTestPoint,
                             toLayoutPoint(layerBounds.location() - renderBoxLocation()),
@@ -3670,7 +3668,7 @@ bool RenderLayer::hitTestContents(const HitTestRequest& request, HitTestResult&
 
 RenderLayer* RenderLayer::hitTestList(Vector<RenderLayer*>* list, RenderLayer* rootLayer,
                                       const HitTestRequest& request, HitTestResult& result,
-                                      const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                                      const LayoutRect& hitTestRect, const HitTestPoint& hitTestPoint,
                                       const HitTestingTransformState* transformState, 
                                       double* zOffsetForDescendants, double* zOffset,
                                       const HitTestingTransformState* unflattenedTransformState,
@@ -3702,12 +3700,12 @@ RenderLayer* RenderLayer::hitTestList(Vector<RenderLayer*>* list, RenderLayer* r
                 break;
         }
     }
-    
+
     return resultLayer;
 }
 
 RenderLayer* RenderLayer::hitTestPaginatedChildLayer(RenderLayer* childLayer, RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                                                     const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint, const HitTestingTransformState* transformState, double* zOffset)
+                                                     const LayoutRect& hitTestRect, const HitTestPoint& hitTestPoint, const HitTestingTransformState* transformState, double* zOffset)
 {
     Vector<RenderLayer*> columnLayers;
     RenderLayer* ancestorLayer = isNormalFlowOnly() ? parent() : stackingContext();
@@ -3724,7 +3722,7 @@ RenderLayer* RenderLayer::hitTestPaginatedChildLayer(RenderLayer* childLayer, Re
 }
 
 RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                                                   const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint, const HitTestingTransformState* transformState, double* zOffset,
+                                                   const LayoutRect& hitTestRect, const HitTestPoint& hitTestPoint, const HitTestingTransformState* transformState, double* zOffset,
                                                    const Vector<RenderLayer*>& columnLayers, size_t columnIndex)
 {
     RenderBlock* columnBlock = toRenderBlock(columnLayers[columnIndex]->renderer());
@@ -3735,10 +3733,10 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
 
     LayoutPoint layerOffset;
     columnBlock->layer()->convertToLayerCoords(rootLayer, layerOffset);
-    
+
     ColumnInfo* colInfo = columnBlock->columnInfo();
     int colCount = columnBlock->columnCount(colInfo);
-    
+
     // We have to go backwards from the last column to the first.
     bool isHorizontal = columnBlock->style()->isHorizontalWritingMode();
     LayoutUnit logicalLeft = columnBlock->logicalLeftOffsetForContent();
@@ -3781,7 +3779,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
         LayoutRect localClipRect(hitTestRect);
         localClipRect.intersect(colRect);
 
-        if (!localClipRect.isEmpty() && localClipRect.intersects(result.rectForPoint(hitTestPoint))) {
+        if (!localClipRect.isEmpty() && hitTestPoint.intersects(localClipRect)) {
             RenderLayer* hitLayer = 0;
             if (!columnIndex) {
                 // Apply a translation transform to change where the layer paints.
@@ -3791,7 +3789,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
                     oldTransform = *childLayer->transform();
                 TransformationMatrix newTransform(oldTransform);
                 newTransform.translateRight(offset.width(), offset.height());
-                
+
                 childLayer->m_transform = adoptPtr(new TransformationMatrix(newTransform));
                 hitLayer = childLayer->hitTestLayer(rootLayer, columnLayers[0], request, result, localClipRect, hitTestPoint, false, transformState, zOffset);
                 if (oldHasTransform)
@@ -3806,9 +3804,11 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
                 newTransformState->translate(offset.width(), offset.height(), HitTestingTransformState::AccumulateTransform);
                 LayoutPoint localPoint = roundedLayoutPoint(newTransformState->mappedPoint());
                 LayoutRect localHitTestRect = newTransformState->mappedQuad().enclosingBoundingBox();
+                HitTestPoint newHitTestPoint(result.hitTestPoint());
+                newHitTestPoint.setPoint(localPoint);
                 newTransformState->flatten();
 
-                hitLayer = hitTestChildLayerColumns(childLayer, columnLayers[columnIndex - 1], request, result, localHitTestRect, localPoint,
+                hitLayer = hitTestChildLayerColumns(childLayer, columnLayers[columnIndex - 1], request, result, localHitTestRect, newHitTestPoint,
                                                     newTransformState.get(), zOffset, columnLayers, columnIndex - 1);
             }
 
@@ -3905,7 +3905,7 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, RenderRegion*
             if (renderer()->style()->hasBorderRadius())
                 newOverflowClip.setHasRadius(true);
             clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
-            if (renderer()->isPositioned() || renderer()->isRelPositioned())
+            if (renderer()->isOutOfFlowPositioned() || renderer()->isRelPositioned())
                 clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
         }
         if (renderer()->hasClip()) {
@@ -4701,7 +4701,7 @@ bool RenderLayer::shouldBeNormalFlowOnly() const
                 || renderer()->isApplet()
                 || renderer()->isRenderIFrame()
                 || renderer()->style()->specifiesColumns())
-            && !renderer()->isPositioned()
+            && !renderer()->isOutOfFlowPositioned()
             && !renderer()->isRelPositioned()
             && !renderer()->hasTransform()
 #if ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 28d7e5627..186965905 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -115,6 +115,7 @@ public:
 
     bool isEmpty() const { return m_rect.isEmpty(); }
     bool intersects(const LayoutRect& rect) { return m_rect.intersects(rect); }
+    bool intersects(const HitTestPoint&);
 
 private:
     LayoutRect m_rect;
@@ -308,7 +309,7 @@ public:
     int scrollWidth() const;
     int scrollHeight() const;
 
-    void panScrollFromPoint(const LayoutPoint&);
+    void panScrollFromPoint(const IntPoint&);
 
     enum ScrollOffsetClamping {
         ScrollOffsetUnclamped,
@@ -316,16 +317,15 @@ public:
     };
 
     // Scrolling methods for layers that can scroll their overflow.
-    void scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollByRecursively(const IntSize&, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollToOffset(const IntSize&, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollToXOffset(int x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(IntSize(x, scrollYOffset()), clamp); }
+    void scrollToYOffset(int y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(IntSize(scrollXOffset(), y), clamp); }
 
     int scrollXOffset() const { return m_scrollOffset.width() + scrollOrigin().x(); }
     int scrollYOffset() const { return m_scrollOffset.height() + scrollOrigin().y(); }
     IntSize scrollOffset() const { return IntSize(scrollXOffset(), scrollYOffset()); }
 
-    void scrollToOffset(int, int, ScrollOffsetClamping = ScrollOffsetUnclamped);
-    void scrollToXOffset(int x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(x, scrollYOffset(), clamp); }
-    void scrollToYOffset(int y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(scrollXOffset(), y, clamp); }
-
     void scrollRectToVisible(const LayoutRect&, const ScrollAlignment& alignX, const ScrollAlignment& alignY);
 
     LayoutRect getRectToExpose(const LayoutRect& visibleRect, const LayoutRect& exposeRect, const ScrollAlignment& alignX, const ScrollAlignment& alignY);
@@ -473,6 +473,16 @@ public:
     void setFilterBackendNeedsRepaintingInRect(const LayoutRect&, bool immediate);
 #endif
 
+    bool canUseConvertToLayerCoords() const
+    {
+        // These RenderObject have an impact on their layers' without them knowing about it.
+        return !renderer()->hasColumns() && !renderer()->hasTransform() && !isComposited()
+#if ENABLE(SVG)
+            && !renderer()->isSVGRoot()
+#endif
+            ;
+    }
+
     void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntPoint& location) const;
     void convertToPixelSnappedLayerCoords(const RenderLayer* ancestorLayer, IntRect&) const;
     void convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutPoint& location) const;
@@ -677,6 +687,8 @@ private:
     friend IntSize RenderBox::scrolledContentOffset() const;
     IntSize scrolledContentOffset() const { return m_scrollOffset; }
 
+    IntSize clampScrollOffset(const IntSize&) const;
+
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
 
@@ -717,26 +729,26 @@ private:
                                     PaintLayerFlags, const Vector<RenderLayer*>& columnLayers, size_t columnIndex);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
-                              const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint, bool appliedTransform,
+                              const LayoutRect& hitTestRect, const HitTestPoint&, bool appliedTransform,
                               const HitTestingTransformState* transformState = 0, double* zOffset = 0);
     RenderLayer* hitTestList(Vector<RenderLayer*>*, RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                             const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                             const LayoutRect& hitTestRect, const HitTestPoint&,
                              const HitTestingTransformState* transformState, double* zOffsetForDescendants, double* zOffset,
                              const HitTestingTransformState* unflattenedTransformState, bool depthSortDescendants);
     RenderLayer* hitTestPaginatedChildLayer(RenderLayer* childLayer, RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                                            const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                                            const LayoutRect& hitTestRect, const HitTestPoint&,
                                             const HitTestingTransformState* transformState, double* zOffset);
     RenderLayer* hitTestChildLayerColumns(RenderLayer* childLayer, RenderLayer* rootLayer, const HitTestRequest& request, HitTestResult& result,
-                                          const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                                          const LayoutRect& hitTestRect, const HitTestPoint&,
                                           const HitTestingTransformState* transformState, double* zOffset,
                                           const Vector<RenderLayer*>& columnLayers, size_t columnIndex);
-                                    
+
     PassRefPtr<HitTestingTransformState> createLocalTransformState(RenderLayer* rootLayer, RenderLayer* containerLayer,
-                            const LayoutRect& hitTestRect, const LayoutPoint& hitTestPoint,
+                            const LayoutRect& hitTestRect, const HitTestPoint&,
                             const HitTestingTransformState* containerTransformState) const;
     
-    bool hitTestContents(const HitTestRequest&, HitTestResult&, const LayoutRect& layerBounds, const LayoutPoint& hitTestPoint, HitTestFilter) const;
-    
+    bool hitTestContents(const HitTestRequest&, HitTestResult&, const LayoutRect& layerBounds, const HitTestPoint&, HitTestFilter) const;
+
     void computeScrollDimensions();
     bool hasHorizontalOverflow() const;
     bool hasVerticalOverflow() const;
@@ -856,16 +868,6 @@ private:
     LayoutUnit overflowLeft() const;
     LayoutUnit overflowRight() const;
 
-    bool canUseConvertToLayerCoords() const
-    {
-        // These RenderObject have an impact on their layers' without them knowing about it.
-        return !renderer()->hasColumns() && !renderer()->hasTransform() && !isComposited()
-#if ENABLE(SVG)
-            && !renderer()->isSVGRoot()
-#endif
-            ;
-    }
-
     LayoutUnit verticalScrollbarStart(int minX, int maxX) const;
     LayoutUnit horizontalScrollbarStart(int minX) const;
 
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 1466e39ba..2869f6653 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -671,7 +671,7 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
 
     // A null ancestorLayer is an indication that 'layer' has already been pushed.
     if (ancestorLayer)
-        overlapMap.geometryMap().pushMappingsToAncestor(layer->renderer(), ancestorLayer->renderer());
+        overlapMap.geometryMap().pushMappingsToAncestor(layer, ancestorLayer);
     
     IntRect bounds;
     bool haveComputedBounds = false;
@@ -710,7 +710,7 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     }
     
     if (ancestorLayer)
-        overlapMap.geometryMap().popMappingsToAncestor(ancestorLayer->renderer());
+        overlapMap.geometryMap().popMappingsToAncestor(ancestorLayer);
 }
 
 //  Recurse through the layers in z-index and overflow order (which is equivalent to painting order)
@@ -727,7 +727,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* ancestor
     layer->updateLayerListsIfNeeded();
     
     if (overlapMap)
-        overlapMap->geometryMap().pushMappingsToAncestor(layer->renderer(), ancestorLayer ? ancestorLayer->renderer() : 0);
+        overlapMap->geometryMap().pushMappingsToAncestor(layer, ancestorLayer);
     
     // Clear the flag
     layer->setHasCompositingDescendant(false);
@@ -910,7 +910,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* ancestor
     descendantHas3DTransform |= anyDescendantHas3DTransform || layer->has3DTransform();
 
     if (overlapMap)
-        overlapMap->geometryMap().popMappingsToAncestor(ancestorLayer ? ancestorLayer->renderer() : 0);
+        overlapMap->geometryMap().popMappingsToAncestor(ancestorLayer);
 }
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
@@ -1813,7 +1813,7 @@ bool RenderLayerCompositor::requiresCompositingForPosition(RenderObject* rendere
     // position:fixed elements that create their own stacking context (e.g. have an explicit z-index,
     // opacity, transform) can get their own composited layer. A stacking context is required otherwise
     // z-index and clipping will be broken.
-    if (!(renderer->isPositioned() && renderer->style()->position() == FixedPosition && layer->isStackingContext()))
+    if (!(renderer->isOutOfFlowPositioned() && renderer->style()->position() == FixedPosition && layer->isStackingContext()))
         return false;
 
     if (Settings* settings = m_renderView->document()->settings())
diff --git a/Source/WebCore/rendering/RenderLineBoxList.cpp b/Source/WebCore/rendering/RenderLineBoxList.cpp
index df8a545f3..dbb5861c8 100644
--- a/Source/WebCore/rendering/RenderLineBoxList.cpp
+++ b/Source/WebCore/rendering/RenderLineBoxList.cpp
@@ -273,8 +273,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintIn
     }
 }
 
-
-bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction) const
+bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction) const
 {
     if (hitTestAction != HitTestForeground)
         return false;
@@ -285,9 +284,10 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     if (!firstLineBox())
         return false;
 
+    LayoutPoint point = pointInContainer.point();
     LayoutRect rect = firstLineBox()->isHorizontal() ?
-        IntRect(pointInContainer.x(), pointInContainer.y() - result.topPadding(), 1, result.topPadding() + result.bottomPadding() + 1) :
-        IntRect(pointInContainer.x() - result.leftPadding(), pointInContainer.y(), result.rightPadding() + result.leftPadding() + 1, 1);
+        IntRect(point.x(), point.y() - pointInContainer.topPadding(), 1, pointInContainer.topPadding() + pointInContainer.bottomPadding() + 1) :
+        IntRect(point.x() - pointInContainer.leftPadding(), point.y(), pointInContainer.rightPadding() + pointInContainer.leftPadding() + 1, 1);
 
     if (!anyLineIntersectsRect(renderer, rect, accumulatedOffset))
         return false;
@@ -300,12 +300,12 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
         if (rangeIntersectsRect(renderer, curr->logicalTopVisualOverflow(root->lineTop()), curr->logicalBottomVisualOverflow(root->lineBottom()), rect, accumulatedOffset)) {
             bool inside = curr->nodeAtPoint(request, result, pointInContainer, accumulatedOffset, root->lineTop(), root->lineBottom());
             if (inside) {
-                renderer->updateHitTestResult(result, pointInContainer - toLayoutSize(accumulatedOffset));
+                renderer->updateHitTestResult(result, pointInContainer.point() - toLayoutSize(accumulatedOffset));
                 return true;
             }
         }
     }
-    
+
     return false;
 }
 
@@ -334,7 +334,7 @@ void RenderLineBoxList::dirtyLinesFromChangedChild(RenderObject* container, Rend
     RootInlineBox* box = 0;
     RenderObject* curr = 0;
     for (curr = child->previousSibling(); curr; curr = curr->previousSibling()) {
-        if (curr->isFloatingOrPositioned())
+        if (curr->isFloatingOrOutOfFlowPositioned())
             continue;
 
         if (curr->isReplaced()) {
diff --git a/Source/WebCore/rendering/RenderLineBoxList.h b/Source/WebCore/rendering/RenderLineBoxList.h
index e4c68036b..2c2038295 100644
--- a/Source/WebCore/rendering/RenderLineBoxList.h
+++ b/Source/WebCore/rendering/RenderLineBoxList.h
@@ -64,8 +64,8 @@ public:
     void dirtyLinesFromChangedChild(RenderObject* parent, RenderObject* child);
 
     void paint(RenderBoxModelObject*, PaintInfo&, const LayoutPoint&) const;
-    bool hitTest(RenderBoxModelObject*, const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) const;
-    
+    bool hitTest(RenderBoxModelObject*, const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) const;
+
 private:
     bool anyLineIntersectsRect(RenderBoxModelObject*, const LayoutRect&, const LayoutPoint&, bool usePrintRect = false, LayoutUnit outlineSize = 0) const;
     bool lineIntersectsDirtyRect(RenderBoxModelObject*, InlineFlowBox*, const PaintInfo&, const LayoutPoint&) const;
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 516449fc5..40b5f58fd 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -677,7 +677,7 @@ void RenderListBox::setScrollTop(int newTop)
     scrollToOffsetWithoutAnimation(VerticalScrollbar, index);
 }
 
-bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     if (!RenderBlock::nodeAtPoint(request, result, pointInContainer, accumulatedOffset, hitTestAction))
         return false;
@@ -686,12 +686,12 @@ bool RenderListBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     LayoutPoint adjustedLocation = accumulatedOffset + location();
 
     for (int i = 0; i < size; ++i) {
-        if (itemBoundingBoxRect(adjustedLocation, i).contains(pointInContainer)) {
+        if (itemBoundingBoxRect(adjustedLocation, i).contains(pointInContainer.point())) {
             if (Element* node = listItems[i]) {
                 result.setInnerNode(node);
                 if (!result.innerNonSharedNode())
                     result.setInnerNonSharedNode(node);
-                result.setLocalPoint(pointInContainer - toLayoutSize(adjustedLocation));
+                result.setLocalPoint(pointInContainer.point() - toLayoutSize(adjustedLocation));
                 break;
             }
         }
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 707b61d40..10b1945c2 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -94,7 +94,7 @@ private:
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     // ScrollableArea interface.
     virtual int scrollSize(ScrollbarOrientation) const;
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 3e6a7dcae..2f7ff6e32 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -189,7 +189,7 @@ static RenderObject* getParentOfFirstLineBox(RenderBlock* curr, RenderObject* ma
         if (currChild->isInline() && (!currChild->isRenderInline() || curr->generatesLineBoxesForInlineChild(currChild)))
             return curr;
 
-        if (currChild->isFloating() || currChild->isPositioned())
+        if (currChild->isFloating() || currChild->isOutOfFlowPositioned())
             continue;
 
         if (currChild->isTable() || !currChild->isRenderBlock() || (currChild->isBox() && toRenderBox(currChild)->isWritingModeRoot()))
diff --git a/Source/WebCore/rendering/RenderMarquee.cpp b/Source/WebCore/rendering/RenderMarquee.cpp
index 2ddffc56f..0dc0eed39 100644
--- a/Source/WebCore/rendering/RenderMarquee.cpp
+++ b/Source/WebCore/rendering/RenderMarquee.cpp
@@ -167,9 +167,9 @@ void RenderMarquee::start()
 
     if (!m_suspended && !m_stopped) {
         if (isHorizontal())
-            m_layer->scrollToOffset(m_start, 0);
+            m_layer->scrollToOffset(IntSize(m_start, 0));
         else
-            m_layer->scrollToOffset(0, m_start);
+            m_layer->scrollToOffset(IntSize(0, m_start));
     }
     else {
         m_suspended = false;
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
index 7fa55271a..efa05186d 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -121,29 +121,37 @@ static void paintRoundedSliderBackground(const IntRect& rect, const RenderStyle*
 {
     int borderRadius = rect.height() / 2;
     IntSize radii(borderRadius, borderRadius);
-    Color sliderBackgroundColor = Color(29, 29, 29);
+    Color sliderBackgroundColor = Color(11, 11, 11);
     context->save();
     context->fillRoundedRect(rect, radii, radii, radii, radii, sliderBackgroundColor, ColorSpaceDeviceRGB);
     context->restore();
 }
 
-static void paintSliderRangeHighlight(const IntRect& rect, const RenderStyle* style, GraphicsContext* context, float startFraction, float widthFraction)
+static void paintSliderRangeHighlight(const IntRect& rect, const RenderStyle* style, GraphicsContext* context, int startPosition, int endPosition, Color startColor, Color endColor)
 {
-    if (startFraction < 0)
-        startFraction = 0;
-    if (widthFraction > 1)
-        widthFraction = 1;
-    float endFraction = startFraction + widthFraction;
-    if (endFraction > 1) {
-        widthFraction = widthFraction - startFraction;
-        endFraction = startFraction + widthFraction;
+    // Calculate border radius; need to avoid being smaller than half the slider height
+    // because of https://bugs.webkit.org/show_bug.cgi?id=30143.
+    int borderRadius = rect.height() / 2;
+    IntSize radii(borderRadius, borderRadius);
+
+    // Calculate highlight rectangle and edge dimensions.
+    int startOffset = startPosition;
+    int endOffset = rect.width() - endPosition;
+    int rangeWidth = endPosition - startPosition;
+
+    if (rangeWidth <= 0)
+        return;
+
+    // Make sure the range width is bigger than border radius at the edges to retain rounded corners.
+    if (startOffset < borderRadius && rangeWidth < borderRadius)
+        rangeWidth = borderRadius;
+    if (endOffset < borderRadius && rangeWidth < borderRadius) {
+        startPosition -= borderRadius - rangeWidth;
+        rangeWidth = borderRadius;
     }
 
     // Set rectangle to highlight range.
     IntRect highlightRect = rect;
-    int startOffset = startFraction * rect.width();
-    int endOffset = rect.width() - endFraction * rect.width();
-    int rangeWidth = widthFraction * rect.width();
     highlightRect.move(startOffset, 0);
     highlightRect.setWidth(rangeWidth);
 
@@ -151,17 +159,10 @@ static void paintSliderRangeHighlight(const IntRect& rect, const RenderStyle* st
     if (highlightRect.isEmpty())
         return;
 
-    // Calculate border radius; need to avoid being smaller than half the slider height
-    // because of https://bugs.webkit.org/show_bug.cgi?id=30143.
-    int borderRadius = rect.height() / 2;
-    IntSize radii(borderRadius, borderRadius);
-
     // Calculate white-grey gradient.
     IntPoint sliderTopLeft = highlightRect.location();
     IntPoint sliderBottomLeft = sliderTopLeft;
     sliderBottomLeft.move(0, highlightRect.height());
-    Color startColor = Color(220, 220, 220);
-    Color endColor = Color(240, 240, 240);
     RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderBottomLeft);
     gradient->addColorStop(0.0, startColor);
     gradient->addColorStop(1.0, endColor);
@@ -182,6 +183,8 @@ static void paintSliderRangeHighlight(const IntRect& rect, const RenderStyle* st
     context->restore();
 }
 
+const int mediaSliderThumbWidth = 32;
+
 static bool paintMediaSlider(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
@@ -206,11 +209,28 @@ static bool paintMediaSlider(RenderObject* object, const PaintInfo& paintInfo, c
         float end = bufferedTimeRanges->end(i, ASSERT_NO_EXCEPTION);
         if (isnan(start) || isnan(end) || start > currentTime || end < currentTime)
             continue;
-        float startFraction = start / duration;
-        float endFraction = end / duration;
-        float widthFraction = endFraction - startFraction;
+        int startPosition = int(start * rect.width() / duration);
+        int currentPosition = int(currentTime * rect.width() / duration);
+        int endPosition = int(end * rect.width() / duration);
+
+        // Add half the thumb width proportionally adjusted to the current painting position.
+        int thumbCenter = mediaSliderThumbWidth / 2;
+        int addWidth = thumbCenter * (1.0 - 2.0 * currentPosition / rect.width());
+        currentPosition += addWidth;
+
+        // Draw white-ish highlight before current time.
+        Color startColor = Color(195, 195, 195);
+        Color endColor = Color(217, 217, 217);
+        if (currentPosition > startPosition)
+            paintSliderRangeHighlight(rect, style, context, startPosition, currentPosition, startColor, endColor);
+
+        // Draw grey-ish highlight after current time.
+        startColor = Color(60, 60, 60);
+        endColor = Color(76, 76, 76);
+
+        if (endPosition > currentPosition)
+            paintSliderRangeHighlight(rect, style, context, currentPosition, endPosition, startColor, endColor);
 
-        paintSliderRangeHighlight(rect, style, context, startFraction, widthFraction);
         return true;
     }
 
@@ -264,7 +284,10 @@ static bool paintMediaVolumeSlider(RenderObject* object, const PaintInfo& paintI
         fillWidth = positionWidth + (zoomLevel * thumbCenter / 2);
     }
 
-    paintSliderRangeHighlight(rect, style, context, 0.0, fillWidth / rect.width());
+    Color startColor = Color(195, 195, 195);
+    Color endColor = Color(217, 217, 217);
+
+    paintSliderRangeHighlight(rect, style, context, 0.0, fillWidth, startColor, endColor);
 
     return true;
 }
@@ -338,7 +361,6 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     return false;
 }
 
-const int mediaSliderThumbWidth = 32;
 const int mediaSliderThumbHeight = 24;
 const int mediaVolumeSliderThumbHeight = 24;
 
diff --git a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
index 536d5fa22..958cc7687 100644
--- a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
+++ b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
@@ -152,7 +152,7 @@ const char* RenderMultiColumnBlock::renderName() const
 {    
     if (isFloating())
         return "RenderMultiColumnBlock (floating)";
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         return "RenderMultiColumnBlock (positioned)";
     if (isAnonymousBlock())
         return "RenderMultiColumnBlock (anonymous)";
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index be90dd6ba..b5ca92b81 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -47,6 +47,7 @@
 #include "RenderDeprecatedFlexibleBox.h"
 #include "RenderFlexibleBox.h"
 #include "RenderGeometryMap.h"
+#include "RenderGrid.h"
 #include "RenderImage.h"
 #include "RenderImageResourceStyleImage.h"
 #include "RenderInline.h"
@@ -151,9 +152,6 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
         return new (arena) RenderRubyText(node);
 
     switch (style->display()) {
-    // For now, we don't show grid elements.
-    case GRID:
-    case INLINE_GRID:
     case NONE:
         return 0;
     case INLINE:
@@ -194,6 +192,9 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     case INLINE_FLEX:
         return new (arena) RenderFlexibleBox(node);
 #endif
+    case GRID:
+    case INLINE_GRID:
+        return new (arena) RenderGrid(node);
     }
 
     return 0;
@@ -640,7 +641,7 @@ void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderOb
         RenderObject* container = object->container();
         if (!container && !object->isRenderView())
             return;
-        if (!last->isText() && last->style()->isPositioned()) {
+        if (!last->isText() && last->style()->isOutOfFlowPositioned()) {
             bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock();
             // Skip relatively positioned inlines and anonymous blocks to get to the enclosing RenderBlock.
             while (object && (!object->isRenderBlock() || object->isAnonymousBlock()))
@@ -681,7 +682,7 @@ void RenderObject::setPreferredLogicalWidthsDirty(bool shouldBeDirty, MarkingBeh
 {
     bool alreadyDirty = preferredLogicalWidthsDirty();
     m_bitfields.setPreferredLogicalWidthsDirty(shouldBeDirty);
-    if (shouldBeDirty && !alreadyDirty && markParents == MarkContainingBlockChain && (isText() || !style()->isPositioned()))
+    if (shouldBeDirty && !alreadyDirty && markParents == MarkContainingBlockChain && (isText() || !style()->isOutOfFlowPositioned()))
         invalidateContainerPreferredLogicalWidths();
 }
 
@@ -698,7 +699,7 @@ void RenderObject::invalidateContainerPreferredLogicalWidths()
             break;
 
         o->m_bitfields.setPreferredLogicalWidthsDirty(true);
-        if (o->style()->isPositioned())
+        if (o->style()->isOutOfFlowPositioned())
             // A positioned object has no effect on the min/max width of its containing block ever.
             // We can optimize this case and not go up any further.
             break;
@@ -1805,13 +1806,13 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             // For changes in float styles, we need to conceivably remove ourselves
             // from the floating objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
-        else if (isPositioned() && (m_style->position() != newStyle->position()))
+        else if (isOutOfFlowPositioned() && (m_style->position() != newStyle->position()))
             // For changes in positioning styles, we need to conceivably remove ourselves
             // from the positioned objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
 
-        s_affectsParentBlock = isFloatingOrPositioned() &&
-            (!newStyle->isFloating() && newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition)
+        s_affectsParentBlock = isFloatingOrOutOfFlowPositioned()
+            && (!newStyle->isFloating() && newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition)
             && parent() && (parent()->isBlockFlow() || parent()->isRenderInline());
 
         // reset style flags
@@ -2406,7 +2407,7 @@ bool RenderObject::isComposited() const
     return hasLayer() && toRenderBoxModelObject(this)->layer()->isComposited();
 }
 
-bool RenderObject::hitTest(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestFilter hitTestFilter)
+bool RenderObject::hitTest(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestFilter hitTestFilter)
 {
     bool inside = false;
     if (hitTestFilter != HitTestSelf) {
@@ -2443,7 +2444,7 @@ void RenderObject::updateHitTestResult(HitTestResult& result, const LayoutPoint&
     }
 }
 
-bool RenderObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& /*pointInContainer*/, const LayoutPoint& /*accumulatedOffset*/, HitTestAction)
+bool RenderObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& /*pointInContainer*/, const LayoutPoint& /*accumulatedOffset*/, HitTestAction)
 {
     return false;
 }
@@ -2746,7 +2747,7 @@ RenderBoxModelObject* RenderObject::offsetParent() const
     // A is the root element.
     // A is the HTML body element.
     // The computed value of the position property for element A is fixed.
-    if (isRoot() || isBody() || (isPositioned() && style()->position() == FixedPosition))
+    if (isRoot() || isBody() || (isOutOfFlowPositioned() && style()->position() == FixedPosition))
         return 0;
 
     // If A is an area HTML element which has a map HTML element somewhere in the ancestor
@@ -2761,10 +2762,10 @@ RenderBoxModelObject* RenderObject::offsetParent() const
     //       is one of the following HTML elements: td, th, or table.
     //     * Our own extension: if there is a difference in the effective zoom
 
-    bool skipTables = isPositioned() || isRelPositioned();
+    bool skipTables = isOutOfFlowPositioned() || isRelPositioned();
     float currZoom = style()->effectiveZoom();
     RenderObject* curr = parent();
-    while (curr && (!curr->node() || (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
+    while (curr && (!curr->node() || (!curr->isOutOfFlowPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
         Node* element = curr->node();
         if (!skipTables && element && (element->hasTagName(tableTag) || element->hasTagName(tdTag) || element->hasTagName(thTag)))
             break;
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 23cdbc88c..3f01e90f9 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -46,6 +46,7 @@ namespace WebCore {
 class AffineTransform;
 class AnimationController;
 class Cursor;
+class HitTestPoint;
 class HitTestResult;
 class InlineBox;
 class InlineFlowBox;
@@ -499,7 +500,8 @@ public:
     virtual RenderBoxModelObject* virtualContinuation() const { return 0; }
 
     bool isFloating() const { return m_bitfields.floating(); }
-    bool isPositioned() const { return m_bitfields.positioned(); } // absolute or fixed positioning
+    bool isOutOfFlowPositioned() const { return m_bitfields.positioned(); } // absolute or fixed positioning
+    bool isInFlowPositioned() const { return m_bitfields.relPositioned(); } // relative positioning
     bool isRelPositioned() const { return m_bitfields.relPositioned(); } // relative positioning
     bool isText() const  { return m_bitfields.isText(); }
     bool isBox() const { return m_bitfields.isBox(); }
@@ -537,7 +539,7 @@ public:
 
     bool isSelectionBorder() const;
 
-    bool hasClip() const { return isPositioned() && style()->hasClip(); }
+    bool hasClip() const { return isOutOfFlowPositioned() && style()->hasClip(); }
     bool hasOverflowClip() const { return m_bitfields.hasOverflowClip(); }
 
     bool hasTransform() const { return m_bitfields.hasTransform(); }
@@ -641,9 +643,9 @@ public:
 
     bool isComposited() const;
 
-    bool hitTest(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestFilter = HitTestAll);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    bool hitTest(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestFilter = HitTestAll);
     virtual void updateHitTestResult(HitTestResult&, const LayoutPoint&);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
 
     virtual VisiblePosition positionForPoint(const LayoutPoint&);
     VisiblePosition createVisiblePosition(int offset, EAffinity);
@@ -779,7 +781,7 @@ public:
 
     virtual unsigned int length() const { return 1; }
 
-    bool isFloatingOrPositioned() const { return (isFloating() || isPositioned()); }
+    bool isFloatingOrOutOfFlowPositioned() const { return (isFloating() || isOutOfFlowPositioned()); }
 
     bool isTransparent() const { return style()->opacity() < 1.0f; }
     float opacity() const { return style()->opacity(); }
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index f545297d9..422504e6b 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -75,7 +75,7 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
 {
     ASSERT(oldChild->parent() == owner);
 
-    if (oldChild->isFloatingOrPositioned())
+    if (oldChild->isFloatingOrOutOfFlowPositioned())
         toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
 
     // So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
@@ -111,7 +111,7 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
         if (oldChild->isListItem())
             toRenderListItem(oldChild)->updateListMarkerNumbers();
 
-        if (oldChild->isPositioned() && owner->childrenInline())
+        if (oldChild->isOutOfFlowPositioned() && owner->childrenInline())
             owner->dirtyLinesFromChangedChild(oldChild);
 
         if (oldChild->isRenderRegion())
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index ea9d52c13..9938dffb0 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -118,7 +118,7 @@ void RenderRegion::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintO
 }
 
 // Hit Testing
-bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     if (!isValid())
         return false;
@@ -129,11 +129,11 @@ bool RenderRegion::nodeAtPoint(const HitTestRequest& request, HitTestResult& res
     // foreground phase (which is true for replaced elements like images).
     LayoutRect boundsRect = borderBoxRectInRegion(result.region());
     boundsRect.moveBy(adjustedLocation);
-    if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
+    if (visibleToHitTesting() && action == HitTestForeground && pointInContainer.intersects(boundsRect)) {
         // Check the contents of the RenderFlowThread.
         if (m_flowThread && m_flowThread->hitTestRegion(this, request, result, pointInContainer, LayoutPoint(adjustedLocation.x() + borderLeft() + paddingLeft(), adjustedLocation.y() + borderTop() + paddingTop())))
             return true;
-        updateHitTestResult(result, pointInContainer - toLayoutSize(adjustedLocation));
+        updateHitTestResult(result, pointInContainer.point() - toLayoutSize(adjustedLocation));
         if (!result.addNodeToRectBasedTestResult(node(), pointInContainer, boundsRect))
             return true;
     }
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index 086c63c98..826e98072 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -46,7 +46,7 @@ public:
     virtual bool isRenderRegion() const { return true; }
 
     virtual void paintReplaced(PaintInfo&, const LayoutPoint&);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 2555fcd6a..794acd820 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -238,7 +238,7 @@ static inline bool hasAutoHeightOrContainingBlockWithAutoHeight(const RenderRepl
     // For percentage heights: The percentage is calculated with respect to the height of the generated box's
     // containing block. If the height of the containing block is not specified explicitly (i.e., it depends
     // on content height), and this element is not absolutely positioned, the value computes to 'auto'.
-    if (!logicalHeightLength.isPercent() || replaced->isPositioned() || replaced->document()->inQuirksMode())
+    if (!logicalHeightLength.isPercent() || replaced->isOutOfFlowPositioned() || replaced->document()->inQuirksMode())
         return false;
 
     for (RenderBlock* cb = replaced->containingBlock(); !cb->isRenderView(); cb = cb->containingBlock()) {
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 716e55f05..9c27375df 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -76,7 +76,7 @@ RenderRubyText* RenderRubyRun::rubyText() const
     RenderObject* child = firstChild();
     // If in future it becomes necessary to support floating or positioned ruby text,
     // layout will have to be changed to handle them properly.
-    ASSERT(!child || !child->isRubyText() || !child->isFloatingOrPositioned());
+    ASSERT(!child || !child->isRubyText() || !child->isFloatingOrOutOfFlowPositioned());
     return child && child->isRubyText() ? static_cast<RenderRubyText*>(child) : 0;
 }
 
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 479e3d6ee..ab3187794 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -114,7 +114,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
     if (!beforeChild)
         beforeChild = afterPseudoElementRenderer();
 
-    bool wrapInAnonymousSection = !child->isPositioned();
+    bool wrapInAnonymousSection = !child->isOutOfFlowPositioned();
 
     if (child->isTableCaption()) {
         m_captions.append(toRenderTableCaption(child));
@@ -213,7 +213,7 @@ void RenderTable::computeLogicalWidth()
 {
     recalcSectionsIfNeeded();
 
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         computePositionedLogicalWidth();
 
     RenderBlock* cb = containingBlock();
@@ -390,7 +390,7 @@ void RenderTable::layout()
 
     setLogicalHeight(logicalHeight() + borderAndPaddingBefore);
 
-    if (!isPositioned())
+    if (!isOutOfFlowPositioned())
         computeLogicalHeight();
 
     Length logicalHeightLength = style()->logicalHeight();
@@ -439,7 +439,7 @@ void RenderTable::layout()
         layoutCaption(m_captions[i]);
     }
 
-    if (isPositioned())
+    if (isOutOfFlowPositioned())
         computeLogicalHeight();
 
     // table can be containing block of positioned elements.
@@ -1275,17 +1275,17 @@ LayoutRect RenderTable::overflowClipRect(const LayoutPoint& location, RenderRegi
     return rect;
 }
 
-bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     LayoutPoint adjustedLocation = accumulatedOffset + location();
 
     // Check kids first.
-    if (!hasOverflowClip() || overflowClipRect(adjustedLocation, result.region()).intersects(result.rectForPoint(pointInContainer))) {
+    if (!hasOverflowClip() || pointInContainer.intersects(overflowClipRect(adjustedLocation, result.region()))) {
         for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
             if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && (child->isTableSection() || child->isTableCaption())) {
                 LayoutPoint childPoint = flipForWritingModeForChild(toRenderBox(child), adjustedLocation);
                 if (child->nodeAtPoint(request, result, pointInContainer, childPoint, action)) {
-                    updateHitTestResult(result, toLayoutPoint(pointInContainer - childPoint));
+                    updateHitTestResult(result, toLayoutPoint(pointInContainer.point() - childPoint));
                     return true;
                 }
             }
@@ -1294,8 +1294,8 @@ bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     // Check our bounds next.
     LayoutRect boundsRect(adjustedLocation, size());
-    if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
-        updateHitTestResult(result, flipForWritingMode(pointInContainer - toLayoutSize(adjustedLocation)));
+    if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && pointInContainer.intersects(boundsRect)) {
+        updateHitTestResult(result, flipForWritingMode(pointInContainer.point() - toLayoutSize(adjustedLocation)));
         if (!result.addNodeToRectBasedTestResult(node(), pointInContainer, boundsRect))
             return true;
     }
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index c3eb0729b..b6d25069f 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -243,8 +243,8 @@ private:
     virtual void paintMask(PaintInfo&, const LayoutPoint&);
     virtual void layout();
     virtual void computePreferredLogicalWidths();
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
-    
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
+
     virtual LayoutUnit firstLineBoxBaseline() const OVERRIDE;
     virtual LayoutUnit lastLineBoxBaseline() const OVERRIDE;
 
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 3caa7b4f3..0e424bc11 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -28,6 +28,7 @@
 #include "CachedImage.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "HitTestResult.h"
 #include "PaintInfo.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
@@ -193,7 +194,7 @@ LayoutRect RenderTableRow::clippedOverflowRectForRepaint(RenderBoxModelObject* r
 }
 
 // Hit Testing
-bool RenderTableRow::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderTableRow::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     // Table rows cannot ever be hit tested.  Effectively they do not exist.
     // Just forward to our children always.
@@ -205,12 +206,12 @@ bool RenderTableRow::nodeAtPoint(const HitTestRequest& request, HitTestResult& r
         if (child->isTableCell() && !toRenderBox(child)->hasSelfPaintingLayer()) {
             LayoutPoint cellPoint = flipForWritingModeForChild(toRenderTableCell(child), accumulatedOffset);
             if (child->nodeAtPoint(request, result, pointInContainer, cellPoint, action)) {
-                updateHitTestResult(result, pointInContainer - toLayoutSize(cellPoint));
+                updateHitTestResult(result, pointInContainer.point() - toLayoutSize(cellPoint));
                 return true;
             }
         }
     }
-    
+
     return false;
 }
 
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index c01cd45ed..afa838c12 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -95,7 +95,7 @@ private:
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void layout();
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual bool requiresLayer() const OVERRIDE { return isTransparent() || hasOverflowClip() || hasTransform() || hasHiddenBackface() || hasMask() || hasFilter(); }
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index d78a3d6f4..09a63b91f 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -1361,7 +1361,7 @@ void RenderTableSection::splitColumn(unsigned pos, unsigned first)
 }
 
 // Hit Testing
-bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     // If we have no children then we have nothing to do.
     if (!firstChild())
@@ -1371,7 +1371,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
     // Just forward to our children always.
     LayoutPoint adjustedLocation = accumulatedOffset + location();
 
-    if (hasOverflowClip() && !overflowClipRect(adjustedLocation, result.region()).intersects(result.rectForPoint(pointInContainer)))
+    if (hasOverflowClip() && !pointInContainer.intersects(overflowClipRect(adjustedLocation, result.region())))
         return false;
 
     if (hasOverflowingCell()) {
@@ -1383,7 +1383,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
             if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer()) {
                 LayoutPoint childPoint = flipForWritingModeForChild(toRenderBox(child), adjustedLocation);
                 if (child->nodeAtPoint(request, result, pointInContainer, childPoint, action)) {
-                    updateHitTestResult(result, toLayoutPoint(pointInContainer - childPoint));
+                    updateHitTestResult(result, toLayoutPoint(pointInContainer.point() - childPoint));
                     return true;
                 }
             }
@@ -1393,7 +1393,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
 
     recalcCellsIfNeeded();
 
-    LayoutRect hitTestRect = result.rectForPoint(pointInContainer);
+    LayoutRect hitTestRect = pointInContainer.boundingBox();
     hitTestRect.moveBy(-adjustedLocation);
 
     LayoutRect tableAlignedRect = logicalRectForWritingModeAndDirection(hitTestRect);
@@ -1414,7 +1414,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
                 RenderTableCell* cell = current.cells[i];
                 LayoutPoint cellPoint = flipForWritingModeForChild(cell, adjustedLocation);
                 if (static_cast<RenderObject*>(cell)->nodeAtPoint(request, result, pointInContainer, cellPoint, action)) {
-                    updateHitTestResult(result, toLayoutPoint(pointInContainer - cellPoint));
+                    updateHitTestResult(result, pointInContainer.point() - toLayoutSize(cellPoint));
                     return true;
                 }
             }
diff --git a/Source/WebCore/rendering/RenderTableSection.h b/Source/WebCore/rendering/RenderTableSection.h
index 289415306..891038e14 100644
--- a/Source/WebCore/rendering/RenderTableSection.h
+++ b/Source/WebCore/rendering/RenderTableSection.h
@@ -217,7 +217,7 @@ private:
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     void ensureRows(unsigned);
 
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index 7ea7d7b43..baf95475c 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -30,6 +30,7 @@
 #include "FloatQuad.h"
 #include "FontTranscoder.h"
 #include "FrameView.h"
+#include "Hyphenation.h"
 #include "InlineTextBox.h"
 #include "Range.h"
 #include "RenderArena.h"
@@ -882,6 +883,52 @@ void RenderText::computePreferredLogicalWidths(float leadWidth)
         m_knownToHaveNoOverflowAndNoFallbackFonts = true;
 }
 
+static inline float hyphenWidth(RenderText* renderer, const Font& font)
+{
+    RenderStyle* style = renderer->style();
+    return font.width(RenderBlock::constructTextRun(renderer, font, style->hyphenString().string(), style));
+}
+
+static float maxWordFragmentWidth(RenderText* renderer, RenderStyle* style, const Font& font, const UChar* word, int wordLength, int minimumPrefixLength, int minimumSuffixLength, int& suffixStart)
+{
+    suffixStart = 0;
+    if (wordLength <= minimumSuffixLength)
+        return 0;
+
+    Vector<int, 8> hyphenLocations;
+    int hyphenLocation = wordLength - minimumSuffixLength;
+    while ((hyphenLocation = lastHyphenLocation(word, wordLength, hyphenLocation, style->locale())) >= minimumPrefixLength)
+        hyphenLocations.append(hyphenLocation);
+
+    if (hyphenLocations.isEmpty())
+        return 0;
+
+    hyphenLocations.reverse();
+
+    float minimumFragmentWidthToConsider = font.pixelSize() * 5 / 4 + hyphenWidth(renderer, font);
+    float maxFragmentWidth = 0;
+    for (size_t k = 0; k < hyphenLocations.size(); ++k) {
+        int fragmentLength = hyphenLocations[k] - suffixStart;
+        StringBuilder fragmentWithHyphen;
+        fragmentWithHyphen.append(word + suffixStart, fragmentLength);
+        fragmentWithHyphen.append(style->hyphenString());
+
+        TextRun run = RenderBlock::constructTextRun(renderer, font, fragmentWithHyphen.characters(), fragmentWithHyphen.length(), style);
+        run.setCharactersLength(fragmentWithHyphen.length());
+        run.setCharacterScanForCodePath(!renderer->canUseSimpleFontCodePath());
+        float fragmentWidth = font.width(run);
+
+        // Narrow prefixes are ignored. See tryHyphenating in RenderBlockLineLayout.cpp.
+        if (fragmentWidth <= minimumFragmentWidthToConsider)
+            continue;
+
+        suffixStart += fragmentLength;
+        maxFragmentWidth = max(maxFragmentWidth, fragmentWidth);
+    }
+
+    return maxFragmentWidth;
+}
+
 void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const SimpleFontData*>& fallbackFonts, GlyphOverflow& glyphOverflow)
 {
     ASSERT(m_hasTab || preferredLogicalWidthsDirty() || !m_knownToHaveNoOverflowAndNoFallbackFonts);
@@ -920,6 +967,24 @@ void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const Si
     // space, then subtract its width.
     float wordTrailingSpaceWidth = f.typesettingFeatures() & Kerning ? f.width(RenderBlock::constructTextRun(this, f, &space, 1, styleToUse)) : 0;
 
+    // If automatic hyphenation is allowed, we keep track of the width of the widest word (or word
+    // fragment) encountered so far, and only try hyphenating words that are wider.
+    float maxWordWidth = numeric_limits<float>::max();
+    int minimumPrefixLength = 0;
+    int minimumSuffixLength = 0;
+    if (styleToUse->hyphens() == HyphensAuto && canHyphenate(styleToUse->locale())) {
+        maxWordWidth = 0;
+
+        // Map 'hyphenate-limit-{before,after}: auto;' to 2.
+        minimumPrefixLength = styleToUse->hyphenationLimitBefore();
+        if (minimumPrefixLength < 0)
+            minimumPrefixLength = 2;
+
+        minimumSuffixLength = styleToUse->hyphenationLimitAfter();
+        if (minimumSuffixLength < 0)
+            minimumSuffixLength = 2;
+    }
+
     int firstGlyphLeftOverflow = -1;
 
     bool breakNBSP = styleToUse->autoWrap() && styleToUse->nbspMode() == SPACE;
@@ -963,7 +1028,7 @@ void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const Si
             ASSERT(lastWordBoundary == i);
             lastWordBoundary++;
             continue;
-        } else if (c == softHyphen) {
+        } else if (c == softHyphen && styleToUse->hyphens() != HyphensNone) {
             currMaxWidth += widthFromCache(f, lastWordBoundary, i - lastWordBoundary, leadWidth + currMaxWidth, &fallbackFonts, &glyphOverflow);
             if (firstGlyphLeftOverflow < 0)
                 firstGlyphLeftOverflow = glyphOverflow.left;
@@ -974,12 +1039,12 @@ void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const Si
         bool hasBreak = breakAll || isBreakable(breakIterator, i, nextBreakable, breakNBSP);
         bool betweenWords = true;
         int j = i;
-        while (c != '\n' && !isSpaceAccordingToStyle(c, styleToUse) && c != '\t' && c != softHyphen) {
+        while (c != '\n' && !isSpaceAccordingToStyle(c, styleToUse) && c != '\t' && (c != softHyphen || styleToUse->hyphens() == HyphensNone)) {
             j++;
             if (j == len)
                 break;
             c = txt[j];
-            if (isBreakable(breakIterator, j, nextBreakable, breakNBSP))
+            if (isBreakable(breakIterator, j, nextBreakable, breakNBSP) && txt[j - 1] != softHyphen)
                 break;
             if (breakAll) {
                 betweenWords = false;
@@ -993,8 +1058,30 @@ void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const Si
             float w;
             if (wordTrailingSpaceWidth && isSpace)
                 w = widthFromCache(f, i, wordLen + 1, leadWidth + currMaxWidth, &fallbackFonts, &glyphOverflow) - wordTrailingSpaceWidth;
-            else
+            else {
                 w = widthFromCache(f, i, wordLen, leadWidth + currMaxWidth, &fallbackFonts, &glyphOverflow);
+                if (c == softHyphen && styleToUse->hyphens() != HyphensNone)
+                    currMinWidth += hyphenWidth(this, f);
+            }
+
+            if (w > maxWordWidth) {
+                int suffixStart;
+                float maxFragmentWidth = maxWordFragmentWidth(this, styleToUse, f, txt + i, wordLen, minimumPrefixLength, minimumSuffixLength, suffixStart);
+
+                if (suffixStart) {
+                    float suffixWidth;
+                    if (wordTrailingSpaceWidth && isSpace)
+                        suffixWidth = widthFromCache(f, i + suffixStart, wordLen - suffixStart + 1, leadWidth + currMaxWidth, 0, 0) - wordTrailingSpaceWidth;
+                    else
+                        suffixWidth = widthFromCache(f, i + suffixStart, wordLen - suffixStart, leadWidth + currMaxWidth, 0, 0);
+
+                    maxFragmentWidth = max(maxFragmentWidth, suffixWidth);
+
+                    currMinWidth += maxFragmentWidth - w;
+                    maxWordWidth = max(maxWordWidth, maxFragmentWidth);
+                } else
+                    maxWordWidth = w;
+            }
 
             if (firstGlyphLeftOverflow < 0)
                 firstGlyphLeftOverflow = glyphOverflow.left;
@@ -1023,9 +1110,9 @@ void RenderText::computePreferredLogicalWidths(float leadWidth, HashSet<const Si
                 // being appended to a previous text run when considering the total minimum width of the containing block.
                 if (hasBreak)
                     m_hasBreakableChar = true;
-                m_beginMinWidth = hasBreak ? 0 : w;
+                m_beginMinWidth = hasBreak ? 0 : currMinWidth;
             }
-            m_endMinWidth = w;
+            m_endMinWidth = currMinWidth;
 
             if (currMinWidth > m_minWidth)
                 m_minWidth = currMinWidth;
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index 8157e37eb..b96eca73f 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -156,7 +156,7 @@ private:
 
     virtual void paint(PaintInfo&, const LayoutPoint&) { ASSERT_NOT_REACHED(); }
     virtual void layout() { ASSERT_NOT_REACHED(); }
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint&, const LayoutPoint&, HitTestAction) { ASSERT_NOT_REACHED(); return false; }
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint&, const LayoutPoint&, HitTestAction) OVERRIDE { ASSERT_NOT_REACHED(); return false; }
 
     void deleteTextBoxes();
     bool containsOnlyWhitespace(unsigned from, unsigned len) const;
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index 9b4ffe5cf..a46327e65 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -42,13 +42,13 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
         static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed();
 }
 
-bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     if (!RenderTextControl::nodeAtPoint(request, result, pointInContainer, accumulatedOffset, hitTestAction))
         return false;
 
     if (result.innerNode() == node() || result.innerNode() == innerTextElement())
-        hitInnerTextElement(result, pointInContainer, accumulatedOffset);
+        hitInnerTextElement(result, pointInContainer.point(), accumulatedOffset);
 
     return true;
 }
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.h b/Source/WebCore/rendering/RenderTextControlMultiLine.h
index 3ae1ea210..5c84a5910 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.h
@@ -34,7 +34,7 @@ public:
 private:
     virtual bool isTextArea() const { return true; }
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const;
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index 31f1f2837..c43bf675c 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -203,7 +203,7 @@ void RenderTextControlSingleLine::layout()
     }
 }
 
-bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     if (!RenderTextControl::nodeAtPoint(request, result, pointInContainer, accumulatedOffset, hitTestAction))
         return false;
@@ -214,7 +214,7 @@ bool RenderTextControlSingleLine::nodeAtPoint(const HitTestRequest& request, Hit
     //  - we hit regions not in any decoration buttons.
     HTMLElement* container = containerElement();
     if (result.innerNode()->isDescendantOf(innerTextElement()) || result.innerNode() == node() || (container && container == result.innerNode())) {
-        LayoutPoint pointInParent = pointInContainer;
+        LayoutPoint pointInParent = pointInContainer.point();
         if (container && innerBlockElement()) {
             if (innerBlockElement()->renderBox())
                 pointInParent -= toLayoutSize(innerBlockElement()->renderBox()->location());
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.h b/Source/WebCore/rendering/RenderTextControlSingleLine.h
index ffc50a33d..115c48308 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.h
@@ -56,7 +56,7 @@ private:
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual void layout();
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual void autoscroll();
 
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index c49d8f201..3a30260f8 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -385,11 +385,11 @@ RenderWidget* RenderWidget::find(const Widget* widget)
     return widgetRendererMap().get(widget);
 }
 
-bool RenderWidget::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
+bool RenderWidget::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction action)
 {
     bool hadResult = result.innerNode();
     bool inside = RenderReplaced::nodeAtPoint(request, result, pointInContainer, accumulatedOffset, action);
-    
+
     // Check to see if we are really over the widget itself (and not just in the border/padding area).
     if ((inside || result.isRectBasedTest()) && !hadResult && result.innerNode() == node())
         result.setIsOverWidget(contentBoxRect().contains(result.localPoint()));
diff --git a/Source/WebCore/rendering/RenderWidget.h b/Source/WebCore/rendering/RenderWidget.h
index 54a7a771c..b93ae7b5a 100644
--- a/Source/WebCore/rendering/RenderWidget.h
+++ b/Source/WebCore/rendering/RenderWidget.h
@@ -60,7 +60,7 @@ protected:
     virtual void layout();
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual CursorDirective getCursor(const LayoutPoint&, Cursor&) const;
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
 private:
     virtual bool isWidget() const { return true; }
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index bcbe7bd89..e410be009 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -122,7 +122,7 @@ bool RootInlineBox::lineCanAccommodateEllipsis(bool ltr, int blockEdge, int line
     return InlineFlowBox::canAccommodateEllipsis(ltr, blockEdge, ellipsisWidth);
 }
 
-void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth,
+float RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth,
                                   InlineBox* markupBox)
 {
     // Create an ellipsis box.
@@ -138,21 +138,26 @@ void RootInlineBox::placeEllipsis(const AtomicString& ellipsisStr,  bool ltr, fl
     // FIXME: Do we need an RTL version of this?
     if (ltr && (x() + logicalWidth() + ellipsisWidth) <= blockRightEdge) {
         ellipsisBox->setX(x() + logicalWidth());
-        return;
+        return logicalWidth() + ellipsisWidth;
     }
 
     // Now attempt to find the nearest glyph horizontally and place just to the right (or left in RTL)
     // of that glyph.  Mark all of the objects that intersect the ellipsis box as not painting (as being
     // truncated).
     bool foundBox = false;
-    ellipsisBox->setX(placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox));
+    float truncatedWidth = 0;
+    float position = placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, truncatedWidth, foundBox);
+    ellipsisBox->setX(position);
+    return truncatedWidth;
 }
 
-float RootInlineBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool& foundBox)
+float RootInlineBox::placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, float &truncatedWidth, bool& foundBox)
 {
-    float result = InlineFlowBox::placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, foundBox);
-    if (result == -1)
+    float result = InlineFlowBox::placeEllipsisBox(ltr, blockLeftEdge, blockRightEdge, ellipsisWidth, truncatedWidth, foundBox);
+    if (result == -1) {
         result = ltr ? blockRightEdge - ellipsisWidth : blockLeftEdge;
+        truncatedWidth = blockRightEdge - blockLeftEdge;
+    }
     return result;
 }
 
@@ -212,11 +217,11 @@ void RootInlineBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
 #endif
 }
 
-bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
+bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
 {
     if (hasEllipsisBox() && visibleToHitTesting()) {
         if (ellipsisBox()->nodeAtPoint(request, result, pointInContainer, accumulatedOffset, lineTop, lineBottom)) {
-            renderer()->updateHitTestResult(result, pointInContainer - toLayoutSize(accumulatedOffset));
+            renderer()->updateHitTestResult(result, pointInContainer.point() - toLayoutSize(accumulatedOffset));
             return true;
         }
     }
@@ -231,6 +236,8 @@ void RootInlineBox::adjustPosition(float dx, float dy)
     m_lineBottom += blockDirectionDelta;
     m_lineTopWithLeading += blockDirectionDelta;
     m_lineBottomWithLeading += blockDirectionDelta;
+    if (hasEllipsisBox())
+        ellipsisBox()->adjustPosition(dx, dy);
 }
 
 void RootInlineBox::childRemoved(InlineBox* box)
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 2edbddb2c..dee490fd4 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -92,15 +92,17 @@ public:
     void childRemoved(InlineBox* box);
 
     bool lineCanAccommodateEllipsis(bool ltr, int blockEdge, int lineBoxEdge, int ellipsisWidth);
-    void placeEllipsis(const AtomicString& ellipsisStr, bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, InlineBox* markupBox = 0);
-    virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool& foundBox);
+    // Return the truncatedWidth, the width of the truncated text + ellipsis.
+    float placeEllipsis(const AtomicString& ellipsisStr, bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, InlineBox* markupBox = 0);
+    // Return the position of the EllipsisBox or -1.
+    virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, float &truncatedWidth, bool& foundBox) OVERRIDE;
 
     using InlineBox::hasEllipsisBox;
     EllipsisBox* ellipsisBox() const;
 
     void paintEllipsisBox(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom) const;
 
-    virtual void clearTruncation();
+    virtual void clearTruncation() OVERRIDE;
 
     bool isHyphenated() const;
 
@@ -113,7 +115,7 @@ public:
 #endif
 
     virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) OVERRIDE;
 
     using InlineBox::hasSelectedChildren;
     using InlineBox::setHasSelectedChildren;
@@ -184,7 +186,6 @@ public:
     virtual const char* boxName() const;
 #endif
 private:
-
     LayoutUnit lineSnapAdjustment(LayoutUnit delta = 0) const;
 
     LayoutUnit beforeAnnotationsAdjustment() const;
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 36c5ed40e..3ca95d4d0 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -474,6 +474,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             || rareInheritedData->m_lineGrid != other->rareInheritedData->m_lineGrid
 #if ENABLE(CSS_IMAGE_RESOLUTION)
             || rareInheritedData->m_imageResolutionSource != other->rareInheritedData->m_imageResolutionSource
+            || rareInheritedData->m_imageResolutionSnap != other->rareInheritedData->m_imageResolutionSnap
             || rareInheritedData->m_imageResolution != other->rareInheritedData->m_imageResolution
 #endif
             || rareInheritedData->m_lineSnap != other->rareInheritedData->m_lineSnap
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 947c6075f..805aff79d 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -19,7 +19,6 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
 #ifndef RenderStyle_h
@@ -521,7 +520,7 @@ public:
     bool hasStaticBlockPosition(bool horizontal) const { return horizontal ? hasAutoTopAndBottom() : hasAutoLeftAndRight(); }
 
     EPosition position() const { return static_cast<EPosition>(noninherited_flags._position); }
-    bool isPositioned() const { return position() == AbsolutePosition || position() == FixedPosition; }
+    bool isOutOfFlowPositioned() const { return position() == AbsolutePosition || position() == FixedPosition; }
     EFloat floating() const { return static_cast<EFloat>(noninherited_flags._floating); }
 
     Length width() const { return m_box->width(); }
@@ -983,6 +982,7 @@ public:
 
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     ImageResolutionSource imageResolutionSource() const { return static_cast<ImageResolutionSource>(rareInheritedData->m_imageResolutionSource); }
+    ImageResolutionSnap imageResolutionSnap() const { return static_cast<ImageResolutionSnap>(rareInheritedData->m_imageResolutionSnap); }
     float imageResolution() const { return rareInheritedData->m_imageResolution; }
 #endif
     
@@ -1154,6 +1154,7 @@ public:
 
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     void setImageResolutionSource(ImageResolutionSource v) { SET_VAR(rareInheritedData, m_imageResolutionSource, v) }
+    void setImageResolutionSnap(ImageResolutionSnap v) { SET_VAR(rareInheritedData, m_imageResolutionSnap, v) }
     void setImageResolution(float f) { SET_VAR(rareInheritedData, m_imageResolution, f) }
 #endif
 
@@ -1490,7 +1491,7 @@ public:
 
     bool isDisplayReplacedType() const
     {
-        return display() == INLINE_BLOCK || display() == INLINE_BOX || display() == INLINE_TABLE;
+        return display() == INLINE_BLOCK || display() == INLINE_BOX || display() == INLINE_TABLE || display() == INLINE_GRID;
     }
 
     bool isDisplayInlineType() const
@@ -1501,7 +1502,7 @@ public:
     bool isOriginalDisplayInlineType() const
     {
         return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK
-            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
+            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE || originalDisplay() == INLINE_GRID;
     }
 
     void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
@@ -1667,6 +1668,7 @@ public:
     static LineBoxContain initialLineBoxContain() { return LineBoxContainBlock | LineBoxContainInline | LineBoxContainReplaced; }
     static EImageRendering initialImageRendering() { return ImageRenderingAuto; }
     static ImageResolutionSource initialImageResolutionSource() { return ImageResolutionSpecified; }
+    static ImageResolutionSnap initialImageResolutionSnap() { return ImageResolutionNoSnap; }
     static float initialImageResolution() { return 1; }
     static StyleImage* initialBorderImageSource() { return 0; }
     static StyleImage* initialMaskBoxImageSource() { return 0; }
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 1a5a57c70..9c03f390f 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -452,6 +452,8 @@ enum EImageRendering { ImageRenderingAuto, ImageRenderingOptimizeSpeed, ImageRen
 
 enum ImageResolutionSource { ImageResolutionSpecified = 0, ImageResolutionFromImage };
 
+enum ImageResolutionSnap { ImageResolutionNoSnap = 0, ImageResolutionSnapPixels };
+
 enum Order { LogicalOrder = 0, VisualOrder };
 
 enum RegionOverflow { AutoRegionOverflow, BreakRegionOverflow };
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 7fe609c21..e8a54334f 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -89,6 +89,7 @@ StyleRareInheritedData::StyleRareInheritedData()
 #endif
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     , m_imageResolutionSource(RenderStyle::initialImageResolutionSource())
+    , m_imageResolutionSnap(RenderStyle::initialImageResolutionSnap())
 #endif
     , hyphenationLimitBefore(-1)
     , hyphenationLimitAfter(-1)
@@ -147,6 +148,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
 #endif
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     , m_imageResolutionSource(o.m_imageResolutionSource)
+    , m_imageResolutionSnap(o.m_imageResolutionSnap)
 #endif
     , hyphenationString(o.hyphenationString)
     , hyphenationLimitBefore(o.hyphenationLimitBefore)
@@ -231,6 +233,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && m_imageRendering == o.m_imageRendering
 #if ENABLE(CSS_IMAGE_RESOLUTION)
         && m_imageResolutionSource == o.m_imageResolutionSource
+        && m_imageResolutionSnap == o.m_imageResolutionSnap
         && m_imageResolution == o.m_imageResolution
 #endif
         && m_lineSnap == o.m_lineSnap
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index 5891af98f..8bd3bf9ce 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -19,7 +19,6 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
 #ifndef StyleRareInheritedData_h
@@ -103,6 +102,7 @@ public:
 #endif
 #if ENABLE(CSS_IMAGE_RESOLUTION)
     unsigned m_imageResolutionSource : 1; // ImageResolutionSource
+    unsigned m_imageResolutionSnap : 1; // ImageResolutionSnap
 #endif
 
     AtomicString hyphenationString;
diff --git a/Source/WebCore/rendering/style/StyleVariableData.h b/Source/WebCore/rendering/style/StyleVariableData.h
index bb45989f1..b1e42dbee 100644
--- a/Source/WebCore/rendering/style/StyleVariableData.h
+++ b/Source/WebCore/rendering/style/StyleVariableData.h
@@ -26,6 +26,7 @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
  */
 
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
index 074944066..d66056615 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
@@ -25,6 +25,7 @@
 #include "RenderSVGForeignObject.h"
 
 #include "GraphicsContext.h"
+#include "HitTestResult.h"
 #include "LayoutRepainter.h"
 #include "RenderObject.h"
 #include "RenderSVGResource.h"
@@ -177,12 +178,13 @@ bool RenderSVGForeignObject::nodeAtFloatPoint(const HitTestRequest& request, Hit
         return false;
 
     // FOs establish a stacking context, so we need to hit-test all layers.
-    return RenderBlock::nodeAtPoint(request, result, roundedLayoutPoint(localPoint), LayoutPoint(), HitTestForeground)
-        || RenderBlock::nodeAtPoint(request, result, roundedLayoutPoint(localPoint), LayoutPoint(), HitTestFloat)
-        || RenderBlock::nodeAtPoint(request, result, roundedLayoutPoint(localPoint), LayoutPoint(), HitTestChildBlockBackgrounds);
+    HitTestPoint hitTestPoint(roundedLayoutPoint(localPoint));
+    return RenderBlock::nodeAtPoint(request, result, hitTestPoint, LayoutPoint(), HitTestForeground)
+        || RenderBlock::nodeAtPoint(request, result, hitTestPoint, LayoutPoint(), HitTestFloat)
+        || RenderBlock::nodeAtPoint(request, result, hitTestPoint, LayoutPoint(), HitTestChildBlockBackgrounds);
 }
 
-bool RenderSVGForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint&, const LayoutPoint&, HitTestAction)
+bool RenderSVGForeignObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint&, const LayoutPoint&, HitTestAction)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.h b/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
index 8fe0864c1..80ddfd630 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.h
@@ -51,7 +51,7 @@ public:
     virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(FloatPoint(), m_viewport.size()); }
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
     virtual bool isSVGForeignObject() const { return true; }
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&, ApplyContainerFlipOrNot = ApplyContainerFlip, bool* wasFixed = 0) const;
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
index cf3079c06..18e7ecace 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
@@ -111,7 +111,7 @@ void RenderSVGModelObject::styleDidChange(StyleDifference diff, const RenderStyl
     SVGResourcesCache::clientStyleChanged(this, diff, style());
 }
 
-bool RenderSVGModelObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint&, const LayoutPoint&, HitTestAction)
+bool RenderSVGModelObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint&, const LayoutPoint&, HitTestAction)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.h b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
index d82600f57..0d8192609 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
@@ -71,7 +71,7 @@ protected:
 
 private:
     // This method should never be called, SVG uses a different nodeAtPoint method
-    bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 };
 
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 58a715309..c09457e61 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -173,9 +173,12 @@ LayoutUnit RenderSVGRoot::computeReplacedLogicalWidth(bool includeMaxWidth) cons
     if (svg->widthAttributeEstablishesViewport())
         return resolveLengthAttributeForSVG(svg->intrinsicWidth(SVGSVGElement::IgnoreCSSProperties), style()->effectiveZoom(), containingBlock()->availableLogicalWidth(), view());
 
-    // Only SVGs embedded in <object> reach this point.
-    ASSERT(isEmbeddedThroughFrameContainingSVGDocument());
-    return document()->frame()->ownerRenderer()->availableLogicalWidth();
+    // SVG embedded through object/embed/iframe.
+    if (isEmbeddedThroughFrameContainingSVGDocument())
+        return document()->frame()->ownerRenderer()->availableLogicalWidth();
+
+    // SVG embedded via SVGImage (background-image/border-image/etc) / Inline SVG.
+    return RenderReplaced::computeReplacedLogicalWidth(includeMaxWidth);
 }
 
 LayoutUnit RenderSVGRoot::computeReplacedLogicalHeight() const
@@ -205,9 +208,12 @@ LayoutUnit RenderSVGRoot::computeReplacedLogicalHeight() const
         return resolveLengthAttributeForSVG(height, style()->effectiveZoom(), containingBlock()->availableLogicalHeight(), view());
     }
 
-    // Only SVGs embedded in <object> reach this point.
-    ASSERT(isEmbeddedThroughFrameContainingSVGDocument());
-    return document()->frame()->ownerRenderer()->availableLogicalHeight();
+    // SVG embedded through object/embed/iframe.
+    if (isEmbeddedThroughFrameContainingSVGDocument())
+        return document()->frame()->ownerRenderer()->availableLogicalHeight();
+
+    // SVG embedded via SVGImage (background-image/border-image/etc) / Inline SVG.
+    return RenderReplaced::computeReplacedLogicalHeight();
 }
 
 void RenderSVGRoot::layout()
@@ -409,9 +415,9 @@ void RenderSVGRoot::updateCachedBoundaries()
     m_repaintBoundingBox.inflate(borderAndPaddingWidth());
 }
 
-bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
+bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
-    LayoutPoint pointInParent = pointInContainer - toLayoutSize(accumulatedOffset);
+    LayoutPoint pointInParent = pointInContainer.point() - toLayoutSize(accumulatedOffset);
     LayoutPoint pointInBorderBox(pointInParent.x() - x(), pointInParent.y() - y());
 
     // Note: For now, we're ignoring hits to border and padding for <svg>
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index 6fb569468..9aa7e7c18 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -90,7 +90,7 @@ private:
     virtual FloatRect strokeBoundingBox() const { return m_strokeBoundingBox; }
     virtual FloatRect repaintRectInLocalCoordinates() const { return m_repaintBoundingBox; }
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect& repaintRect, bool fixed) const;
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index a2cae7dbb..f514e2157 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -34,6 +34,7 @@
 #include "FontCache.h"
 #include "GraphicsContext.h"
 #include "HitTestRequest.h"
+#include "HitTestResult.h"
 #include "LayoutRepainter.h"
 #include "PointerEventsHitRules.h"
 #include "RenderSVGInlineText.h"
@@ -450,14 +451,15 @@ bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResul
             if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
                 return false;       
 
-            return RenderBlock::nodeAtPoint(request, result, flooredIntPoint(localPoint), IntPoint(), hitTestAction);
+            HitTestPoint hitTestPoint(flooredIntPoint(localPoint));
+            return RenderBlock::nodeAtPoint(request, result, hitTestPoint, LayoutPoint(), hitTestAction);
         }
     }
 
     return false;
 }
 
-bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint&, const LayoutPoint&, HitTestAction)
+bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint&, const LayoutPoint&, HitTestAction)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index af950c341..93cb64f8f 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -62,7 +62,7 @@ private:
     virtual bool isSVGText() const { return true; }
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual VisiblePosition positionForPoint(const LayoutPoint&);
 
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index 9302aef80..d1a0985d0 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -738,7 +738,7 @@ FloatRect SVGInlineTextBox::calculateBoundaries() const
     return textRect;
 }
 
-bool SVGInlineTextBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit, LayoutUnit)
+bool SVGInlineTextBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit, LayoutUnit)
 {
     // FIXME: integrate with InlineTextBox::nodeAtPoint better.
     ASSERT(!isLineBreak());
@@ -751,8 +751,8 @@ bool SVGInlineTextBox::nodeAtPoint(const HitTestRequest& request, HitTestResult&
             FloatPoint boxOrigin(x(), y());
             boxOrigin.moveBy(accumulatedOffset);
             FloatRect rect(boxOrigin, size());
-            if (rect.intersects(result.rectForPoint(pointInContainer))) {
-                renderer()->updateHitTestResult(result, pointInContainer - toLayoutSize(accumulatedOffset));
+            if (pointInContainer.intersects(rect)) {
+                renderer()->updateHitTestResult(result, pointInContainer.point() - toLayoutSize(accumulatedOffset));
                 if (!result.addNodeToRectBasedTestResult(renderer()->node(), pointInContainer, rect))
                     return true;
              }
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.h b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
index 079601d2c..a4e03d828 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.h
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.h
@@ -79,7 +79,7 @@ private:
     void paintTextWithShadows(GraphicsContext*, RenderStyle*, TextRun&, const SVGTextFragment&, int startPosition, int endPosition);
     void paintText(GraphicsContext*, RenderStyle*, RenderStyle* selectionStyle, const SVGTextFragment&, bool hasSelection, bool paintSelectedTextOnly);
 
-    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom);
+    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestPoint& pointInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) OVERRIDE;
 
 private:
     float m_logicalHeight;
diff --git a/Source/WebCore/svg/SVGFEImageElement.cpp b/Source/WebCore/svg/SVGFEImageElement.cpp
index 75d0b43bb..7635738fd 100644
--- a/Source/WebCore/svg/SVGFEImageElement.cpp
+++ b/Source/WebCore/svg/SVGFEImageElement.cpp
@@ -96,9 +96,6 @@ void SVGFEImageElement::buildPendingResource()
     String id;
     Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
     if (!target) {
-        if (hasPendingResources())
-            return;
-
         if (id.isEmpty())
             requestImageResource();
         else {
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 0ab47ea5e..97bc43d31 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -188,7 +188,7 @@ void SVGTRefElement::detachTarget()
     // Mark the referenced ID as pending.
     String id;
     SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    if (!hasPendingResources() && !id.isEmpty())
+    if (!id.isEmpty())
         document()->accessSVGExtensions()->addPendingResource(id, this);
 }
 
@@ -270,10 +270,9 @@ void SVGTRefElement::buildPendingResource()
     String id;
     Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
     if (!target) {
-        if (hasPendingResources() || id.isEmpty())
+        if (id.isEmpty())
             return;
 
-        ASSERT(!hasPendingResources());
         document()->accessSVGExtensions()->addPendingResource(id, this);
         ASSERT(hasPendingResources());
         return;
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 2221bac37..76684c95f 100755
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -418,10 +418,9 @@ void SVGUseElement::buildPendingResource()
         // We can't observe if the target somewhen enters the external document, nor should we do it.
         if (externalDocument())
             return;
-        if (hasPendingResources() || id.isEmpty())
+        if (id.isEmpty())
             return;
 
-        ASSERT(!hasPendingResources());
         referencedDocument()->accessSVGExtensions()->addPendingResource(id, this);
         ASSERT(hasPendingResources());
         return;
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 2781d2f9c..4ff02e384 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -178,9 +178,7 @@ static inline void clearTimesWithDynamicOrigins(Vector<SMILTimeWithOrigin>& time
 
 void SVGSMILElement::reset()
 {
-    // Don't clear the animated type if we're frozen, only take action here if we're active.
-    if (m_activeState == Active)
-        clearAnimatedType(m_targetElement);
+    clearAnimatedType(m_targetElement);
 
     m_activeState = Inactive;
     m_isWaitingForFirstInterval = true;
diff --git a/Source/WebCore/svg/graphics/SVGImageCache.cpp b/Source/WebCore/svg/graphics/SVGImageCache.cpp
index 91fea0b71..693ee2a8f 100644
--- a/Source/WebCore/svg/graphics/SVGImageCache.cpp
+++ b/Source/WebCore/svg/graphics/SVGImageCache.cpp
@@ -25,6 +25,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
+#include "Page.h"
 #include "RenderSVGRoot.h"
 #include "SVGImage.h"
 
@@ -128,18 +129,25 @@ void SVGImageCache::redrawTimerFired(Timer<SVGImageCache>*)
        redraw();
 }
 
-Image* SVGImageCache::lookupOrCreateBitmapImageForClient(const CachedImageClient* client)
+Image* SVGImageCache::lookupOrCreateBitmapImageForRenderer(const RenderObject* renderer)
 {
-    ASSERT(client);
+    ASSERT(renderer);
+    const CachedImageClient* client = renderer;
 
-    // The cache needs to know the size of the client before querying an image for it.
-    SizeAndScalesMap::iterator sizeIt = m_sizeAndScalesMap.find(client);
+    // The cache needs to know the size of the renderer before querying an image for it.
+    SizeAndScalesMap::iterator sizeIt = m_sizeAndScalesMap.find(renderer);
     if (sizeIt == m_sizeAndScalesMap.end())
         return Image::nullImage();
 
     IntSize size = sizeIt->second.size;
     float zoom = sizeIt->second.zoom;
     float scale = sizeIt->second.scale;
+
+    // FIXME (85335): This needs to take CSS transform scale into account as well.
+    Page* page = renderer->document()->page();
+    if (!scale)
+        scale = page->deviceScaleFactor() * page->pageScaleFactor();
+
     ASSERT(!size.isEmpty());
 
     // Lookup image for client in cache and eventually update it.
@@ -170,7 +178,7 @@ Image* SVGImageCache::lookupOrCreateBitmapImageForClient(const CachedImageClient
     Image* newImagePtr = newImage.get();
     ASSERT(newImagePtr);
 
-    m_imageDataMap.add(client, ImageData(newBuffer.leakPtr(), newImage.release(), sizeIt->second));
+    m_imageDataMap.add(client, ImageData(newBuffer.leakPtr(), newImage.release(), SizeAndScales(size, zoom, scale)));
     return newImagePtr;
 }
 
diff --git a/Source/WebCore/svg/graphics/SVGImageCache.h b/Source/WebCore/svg/graphics/SVGImageCache.h
index 2ec7277ba..25c76a0ee 100644
--- a/Source/WebCore/svg/graphics/SVGImageCache.h
+++ b/Source/WebCore/svg/graphics/SVGImageCache.h
@@ -34,6 +34,7 @@ class CachedImage;
 class CachedImageClient;
 class ImageBuffer;
 class SVGImage;
+class RenderObject;
 
 class SVGImageCache {
 public:
@@ -47,7 +48,7 @@ public:
     struct SizeAndScales {
         SizeAndScales()
             : zoom(1)
-            , scale(1)
+            , scale(0)
         {
         }
 
@@ -58,9 +59,16 @@ public:
         {
         }
 
+        SizeAndScales(const IntSize& newSize, float newZoom)
+            : size(newSize)
+            , zoom(newZoom)
+            , scale(0)
+        {
+        }
+
         IntSize size;
         float zoom;
-        float scale;
+        float scale; // A scale of 0 indicates that the default scale should be used.
     };
 
     void removeClientFromCache(const CachedImageClient*);
@@ -68,7 +76,7 @@ public:
     void setRequestedSizeAndScales(const CachedImageClient*, const SizeAndScales&);
     SizeAndScales requestedSizeAndScales(const CachedImageClient*) const;
 
-    Image* lookupOrCreateBitmapImageForClient(const CachedImageClient*);
+    Image* lookupOrCreateBitmapImageForRenderer(const RenderObject*);
     void imageContentChanged();
 
 private:
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index e1d9cdb8d..bf4392305 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -270,12 +270,6 @@ void InternalSettings::setDeviceSupportsMouse(bool enabled, ExceptionCode& ec)
     settings()->setDeviceSupportsMouse(enabled);
 }
 
-void InternalSettings::setDeviceScaleFactor(float scaleFactor, ExceptionCode& ec)
-{
-    InternalSettingsGuardForPage();
-    page()->setDeviceScaleFactor(scaleFactor);
-}
-
 typedef void (Settings::*SetFontFamilyFunction)(const AtomicString&, UScriptCode);
 static void setFontFamily(Settings* settings, const String& family, const String& script, SetFontFamilyFunction setter)
 {
@@ -354,6 +348,18 @@ void InternalSettings::setCSSExclusionsEnabled(bool enabled, ExceptionCode& ec)
     RuntimeEnabledFeatures::setCSSExclusionsEnabled(enabled);
 }
 
+void InternalSettings::setCSSVariablesEnabled(bool enabled, ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettings();
+    settings()->setCSSVariablesEnabled(enabled);
+}
+
+bool InternalSettings::cssVariablesEnabled(ExceptionCode& ec)
+{
+    InternalSettingsGuardForSettingsReturn(false);
+    return settings()->cssVariablesEnabled();
+}
+
 void InternalSettings::setMediaPlaybackRequiresUserGesture(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index cd28b6365..127da428f 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -64,7 +64,6 @@ public:
     void setTouchEventEmulationEnabled(bool enabled, ExceptionCode&);
     void setDeviceSupportsTouch(bool enabled, ExceptionCode&);
     void setDeviceSupportsMouse(bool enabled, ExceptionCode&);
-    void setDeviceScaleFactor(float scaleFactor, ExceptionCode&);
     void setShadowDOMEnabled(bool enabled, ExceptionCode&);
     void setStandardFontFamily(const String& family, const String& script, ExceptionCode&);
     void setSerifFontFamily(const String& family, const String& script, ExceptionCode&);
@@ -76,6 +75,8 @@ public:
     void setEnableScrollAnimator(bool enabled, ExceptionCode&);
     bool scrollAnimatorEnabled(ExceptionCode&);
     void setCSSExclusionsEnabled(bool enabled, ExceptionCode&);
+    void setCSSVariablesEnabled(bool enabled, ExceptionCode&);
+    bool cssVariablesEnabled(ExceptionCode&);
     void setMediaPlaybackRequiresUserGesture(bool, ExceptionCode&);
     void setEditingBehavior(const String&, ExceptionCode&);
     void setFixedPositionCreatesStackingContext(bool, ExceptionCode&);
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index 427f94893..1965f05e7 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -43,7 +43,6 @@ module window {
         void setTouchEventEmulationEnabled(in boolean enabled) raises(DOMException);
         void setDeviceSupportsTouch(in boolean enabled) raises(DOMException);
         void setDeviceSupportsMouse(in boolean enabled) raises(DOMException);
-        void setDeviceScaleFactor(in float scaleFactor) raises(DOMException);
         void setShadowDOMEnabled(in boolean enabled) raises(DOMException);
         void setStandardFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setSerifFontFamily(in DOMString family, in DOMString script) raises(DOMException);
@@ -55,6 +54,8 @@ module window {
         void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
         boolean scrollAnimatorEnabled() raises(DOMException);
         void setCSSExclusionsEnabled(in boolean enabled) raises(DOMException);
+        void setCSSVariablesEnabled(in boolean enabled) raises(DOMException);
+        boolean cssVariablesEnabled() raises(DOMException);
         void setMediaPlaybackRequiresUserGesture(in boolean enabled) raises(DOMException);
         void setEditingBehavior(in DOMString behavior) raises(DOMException);
         void setFixedPositionCreatesStackingContext(in boolean creates) raises(DOMException);
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index ad629f19e..44ef4d5c5 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -206,6 +206,16 @@ Node* Internals::treeScopeRootNode(Node* node, ExceptionCode& ec)
     return node->treeScope()->rootNode();
 }
 
+Node* Internals::parentTreeScope(Node* node, ExceptionCode& ec)
+{
+    if (!node) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+    const TreeScope* parentTreeScope = node->treeScope()->parentTreeScope();
+    return parentTreeScope ? parentTreeScope->rootNode() : 0;
+}
+
 bool Internals::attached(Node* node, ExceptionCode& ec)
 {
     if (!node) {
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index eb07c7d77..cac206be2 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -84,6 +84,7 @@ public:
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
     bool isValidContentSelect(Element* insertionPoint, ExceptionCode&);
     Node* treeScopeRootNode(Node*, ExceptionCode&);
+    Node* parentTreeScope(Node*, ExceptionCode&);
 
     bool attached(Node*, ExceptionCode&);
 
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 9237e9b9d..b3a249f66 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -55,6 +55,7 @@ module window {
         Element getElementByIdInShadowRoot(in Node shadowRoot, in DOMString id) raises(DOMException);
         boolean isValidContentSelect(in Element contentElement) raises(DOMException);
         Node treeScopeRootNode(in Node node) raises (DOMException);
+        Node parentTreeScope(in Node node) raises (DOMException);
 
         Node nextSiblingByWalker(in Node node) raises(DOMException);
         Node firstChildByWalker(in Node node) raises(DOMException);
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index c7e0e55b0..cdf2ebc4a 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,14 @@
+2012-06-22  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [BlackBerry] Sanitize GLSL code using ANGLE.
+
+        BlackBerry port does not sanitize GLSL code with ANGLE
+        https://bugs.webkit.org/show_bug.cgi?id=89583
+
+        Reviewed by Rob Buis.
+
+        * PlatformBlackBerry.cmake: Add ANGLE sources to BlackBerry builds.
+
 2012-06-19  Csaba Osztrogonác  <ossy@webkit.org>
 
         [CMake] Unreviewed speculative buildfix after r120786.
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index e3512f65a..be2a948dd 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -107,6 +107,18 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebKitSupport/FatFingers.cpp
 )
 
+
+IF (ENABLE_WEBGL)
+    LIST(APPEND WebKit_INCLUDE_DIRECTORIES
+        ${OPENGL_INCLUDE_DIR}
+        ${THIRDPARTY_DIR}/ANGLE/src
+        ${THIRDPARTY_DIR}/ANGLE/include/GLSLANG
+    )
+    LIST(APPEND WebKit_LIBRARIES
+        ${OPENGL_gl_LIBRARY}
+    )
+ENDIF (ENABLE_WEBGL)
+
 IF (ENABLE_DRT)
     # DumpRenderTree sources
     LIST(APPEND WebKit_SOURCES
diff --git a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
index 6177d1e34..3a6033a5a 100644
--- a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
+++ b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
@@ -75,7 +75,7 @@ void globalInitialize()
 
     CacheClientBlackBerry::get()->initialize();
 
-    BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::get();
+    BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::instance();
 
     ImageSource::setMaxPixelsPerDecodedImage(settings->maxPixelsPerDecodedImage());
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index d8ad4778f..411fcb3ab 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -532,6 +532,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
 #if USE(ACCELERATED_COMPOSITING)
     m_tapHighlight = DefaultTapHighlight::create(this);
     m_selectionOverlay = SelectionOverlay::create(this);
+    m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(true);
 #endif
 
     // FIXME: We explicitly call setDelegate() instead of passing ourself in createFromStandardSettings()
@@ -548,7 +549,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     m_mainFrame->init();
 
 #if ENABLE(WEBGL)
-    Platform::Settings* settings = Platform::Settings::get();
+    Platform::Settings* settings = Platform::Settings::instance();
     m_page->settings()->setWebGLEnabled(settings && settings->isWebGLSupported());
 #endif
 #if ENABLE(ACCELERATED_2D_CANVAS)
@@ -563,6 +564,8 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     m_page->settings()->setInteractiveFormValidationEnabled(true);
     m_page->settings()->setAllowUniversalAccessFromFileURLs(false);
     m_page->settings()->setAllowFileAccessFromFileURLs(false);
+    m_page->settings()->setShouldUseCrossOriginProtocolCheck(!m_webSettings->allowCrossSiteRequests());
+    m_page->settings()->setWebSecurityEnabled(!m_webSettings->allowCrossSiteRequests());
 
     m_backingStoreClient = BackingStoreClient::create(m_mainFrame, /* parent frame */ 0, m_webPage);
     // The direct access to BackingStore is left here for convenience since it
@@ -888,6 +891,29 @@ void WebPage::prepareToDestroy()
     d->prepareToDestroy();
 }
 
+static void enableCrossSiteXHRRecursively(Frame* frame)
+{
+    frame->document()->securityOrigin()->grantUniversalAccess();
+
+    Vector<RefPtr<Frame>, 10> childFrames;
+    for (RefPtr<Frame> childFrame = frame->tree()->firstChild(); childFrame; childFrame = childFrame->tree()->nextSibling())
+        childFrames.append(childFrame);
+
+    unsigned size = childFrames.size();
+    for (unsigned i = 0; i < size; i++)
+        enableCrossSiteXHRRecursively(childFrames[i].get());
+}
+
+void WebPagePrivate::enableCrossSiteXHR()
+{
+    enableCrossSiteXHRRecursively(m_mainFrame);
+}
+
+void WebPage::enableCrossSiteXHR()
+{
+    d->enableCrossSiteXHR();
+}
+
 void WebPagePrivate::setLoadState(LoadState state)
 {
     if (m_loadState == state)
@@ -956,7 +982,7 @@ void WebPagePrivate::setLoadState(LoadState state)
             static ViewportArguments defaultViewportArguments;
             bool documentHasViewportArguments = false;
             FrameLoadType frameLoadType = FrameLoadTypeStandard;
-            if (m_mainFrame && m_mainFrame->document() && !(m_mainFrame->document()->viewportArguments() == defaultViewportArguments))
+            if (m_mainFrame && m_mainFrame->document() && m_mainFrame->document()->viewportArguments() != defaultViewportArguments)
                 documentHasViewportArguments = true;
             if (m_mainFrame && m_mainFrame->loader())
                 frameLoadType = m_mainFrame->loader()->loadType();
@@ -997,7 +1023,7 @@ void WebPagePrivate::setLoadState(LoadState state)
 #endif
 
             // Notify InputHandler of state change.
-            m_inputHandler->enableInputMode(false);
+            m_inputHandler->setInputModeEnabled(false);
 
             // Set the scroll to origin here and notify the client since we'll be
             // zooming below without any real contents yet thus the contents size
@@ -1311,7 +1337,7 @@ bool WebPagePrivate::shouldSendResizeEvent()
     //            NOTE: Care must be exercised in the use of this option, as it bypasses
     //                  the sanity provided in 'isLoadingInAPISense()' below.
     //
-    static const bool unrestrictedResizeEvents = Platform::Settings::get()->unrestrictedResizeEvents();
+    static const bool unrestrictedResizeEvents = Platform::Settings::instance()->unrestrictedResizeEvents();
     if (unrestrictedResizeEvents)
         return true;
 
@@ -2480,7 +2506,7 @@ typedef bool (*PredicateFunction)(RenderLayer*);
 static bool isPositionedContainer(RenderLayer* layer)
 {
     RenderObject* o = layer->renderer();
-    return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
+    return o->isRenderView() || o->isOutOfFlowPositioned() || o->isRelPositioned() || layer->hasTransform();
 }
 
 static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
@@ -2489,13 +2515,13 @@ static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
     if (o->isRenderView())
         return false;
 
-    return o->isPositioned() && o->style()->position() == FixedPosition;
+    return o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition;
 }
 
 static bool isFixedPositionedContainer(RenderLayer* layer)
 {
     RenderObject* o = layer->renderer();
-    return o->isRenderView() || (o->isPositioned() && o->style()->position() == FixedPosition);
+    return o->isRenderView() || (o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition);
 }
 
 static RenderLayer* findAncestorOrSelfNotMatching(PredicateFunction predicate, RenderLayer* layer)
@@ -3644,7 +3670,7 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
 
     // Recompute our virtual viewport.
     static ViewportArguments defaultViewportArguments;
-    if (!(m_viewportArguments == defaultViewportArguments)) {
+    if (m_viewportArguments != defaultViewportArguments) {
         // We may need to infer the width and height for the viewport with respect to the rotation.
         IntSize newVirtualViewport = recomputeVirtualViewportFromViewportArguments();
         ASSERT(!newVirtualViewport.isEmpty());
@@ -3943,7 +3969,7 @@ bool WebPagePrivate::handleMouseEvent(PlatformMouseEvent& mouseEvent)
     }
 
     if (mouseEvent.type() == WebCore::PlatformEvent::MousePressed) {
-        m_inputHandler->enableInputMode();
+        m_inputHandler->setInputModeEnabled();
         if (m_inputHandler->willOpenPopupForNode(node)) {
             // Do not allow any human generated mouse or keyboard events to select <option>s in the list box
             // because we use a pop up dialog to handle the actual selections. This prevents options from
@@ -4141,7 +4167,7 @@ bool WebPagePrivate::dispatchTouchEventToFullScreenPlugin(PluginView* plugin, co
     return handled;
 }
 
-bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point)
+bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point, bool useFatFingers)
 {
     if (d->m_page->defersLoading())
         return false;
@@ -4156,7 +4182,7 @@ bool WebPage::touchPointAsMouseEvent(const Platform::TouchPoint& point)
     tPoint.m_pos = d->mapFromTransformed(tPoint.m_pos);
     tPoint.m_screenPos = d->mapFromTransformed(tPoint.m_screenPos);
 
-    return d->m_touchEventHandler->handleTouchPoint(tPoint);
+    return d->m_touchEventHandler->handleTouchPoint(tPoint, useFatFingers);
 }
 
 bool WebPagePrivate::dispatchTouchPointAsMouseEventToFullScreenPlugin(PluginView* pluginView, const Platform::TouchPoint& point)
@@ -4344,7 +4370,7 @@ bool WebPagePrivate::scrollRenderer(RenderObject* renderer, const IntSize& delta
         if (!layerDelta.isZero()) {
             m_inRegionScrollStartingNode = enclosingLayerNode(layer);
             IntPoint newOffset = currentOffset + layerDelta;
-            layer->scrollToOffset(newOffset.x(), newOffset.y());
+            layer->scrollToOffset(toSize(newOffset));
             renderer->repaint(true);
             return true;
         }
@@ -6312,6 +6338,7 @@ void WebPagePrivate::didChangeSettings(WebSettings* webSettings)
     coreSettings->setProcessHTTPEquiv(!webSettings->isEmailMode());
 
     coreSettings->setShouldUseCrossOriginProtocolCheck(!webSettings->allowCrossSiteRequests());
+    coreSettings->setWebSecurityEnabled(!webSettings->allowCrossSiteRequests());
 
     cookieManager().setPrivateMode(webSettings->isPrivateBrowsingEnabled());
 
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index 8a037dde1..eb38583c4 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -110,6 +110,8 @@ public:
     // This will force any unload handlers to run.
     void prepareToDestroy();
 
+    void enableCrossSiteXHR();
+
     void reload();
     void reloadFromCache();
 
@@ -137,7 +139,7 @@ public:
 
     // For conversion to mouse events.
     void touchEventCancel();
-    bool touchPointAsMouseEvent(const Platform::TouchPoint&);
+    bool touchPointAsMouseEvent(const Platform::TouchPoint&, bool useFatFingers = true);
 
     // Returns true if the key stroke was handled by WebKit.
     bool keyEvent(const Platform::KeyboardEvent&);
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 0c159e9da..9b2ee701a 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -104,6 +104,8 @@ public:
     void stopCurrentLoad();
     void prepareToDestroy();
 
+    void enableCrossSiteXHR();
+
     LoadState loadState() const { return m_loadState; }
     bool isLoading() const { return m_loadState == WebPagePrivate::Provisional || m_loadState == WebPagePrivate::Committed; }
 
diff --git a/Source/WebKit/blackberry/Api/WebViewportArguments.cpp b/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
index 798c3d5c1..ab570a975 100644
--- a/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
+++ b/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
@@ -111,7 +111,7 @@ bool WebViewportArguments::operator==(const WebViewportArguments& other)
 
 bool WebViewportArguments::operator!=(const WebViewportArguments& other)
 {
-    return !(*this == other);
+    return *d != *(other.d);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 3dd869ce7..67aa6558f 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,262 @@
+2012-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Rename isPositioned to isOutOfFlowPositioned for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=89836
+
+        Reviewed by Antti Koivisto.
+        
+        RenderObject and RenderStyle had an isPositioned() method that was
+        confusing, because it excluded relative positioning. Rename to 
+        isOutOfFlowPositioned(), which makes it clearer that it only applies
+        to absolute and fixed positioning.
+
+        Simple rename; no behavior change.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::isPositionedContainer):
+        (BlackBerry::WebKit::isNonRenderViewFixedPositionedContainer):
+        (BlackBerry::WebKit::isFixedPositionedContainer):
+
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::clearMemoryCaches):
+        * WebCoreSupport/ClientExtension.cpp:
+        * WebCoreSupport/PagePopupBlackBerry.cpp:
+        (WebCore::PagePopupBlackBerry::installDomFunction):
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        (DumpRenderTreeSupport::computedStyleIncludingVisitedInfo):
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::clearMemoryCaches):
+        * WebCoreSupport/ClientExtension.cpp:
+        * WebCoreSupport/PagePopupBlackBerry.cpp:
+        (WebCore::PagePopupBlackBerry::installDomFunction):
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        (DumpRenderTreeSupport::computedStyleIncludingVisitedInfo):
+
+2012-06-22  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Tap highlight fade animations are added to overlay continuously during pinch zoom.
+        https://bugs.webkit.org/show_bug.cgi?id=89772
+
+        Reviewed by Antonio Gomes.
+
+        When pinch zooming, DefaultTapHighlight::hide is continuously
+        called from the UI thread. This resulted in fade animations being
+        created and added to the override overlay continuously.
+
+        This patch moves the m_visible check so that it applies for both
+        threads.
+
+        Internal PR164183
+
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        (BlackBerry::WebKit::DefaultTapHighlight::draw):
+        (BlackBerry::WebKit::DefaultTapHighlight::hide):
+        * WebKitSupport/DefaultTapHighlight.h:
+        (DefaultTapHighlight):
+
+2012-06-22  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Set WebSecurityEnabled flag accordingly.
+        https://bugs.webkit.org/show_bug.cgi?id=89602
+
+        Reviewed by Rob Buis.
+
+        Disable web security checks if needed.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::didChangeSettings):
+
+2012-06-22  Parth Patel  <parpatel@rim.com>
+
+        [Blackberry] BlackBerry::Platform::Settings::get() rename to BlackBerry::Platform::Settings::instance() to make it consistent with our other singletons
+        https://bugs.webkit.org/show_bug.cgi?id=89684
+
+        Reviewed by Yong Li.
+
+        Build Fix-Typo Update setting instance access to use instance() instead of get().
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::isInputModeEnabled):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+
+        * WebCoreSupport/DeviceOrientationClientBlackBerry.h:
+        (DeviceOrientationClientBlackBerry):
+
+2012-06-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorState::updateCookie should not do JSON serialization if unsupported
+        https://bugs.webkit.org/show_bug.cgi?id=89743
+
+        Reviewed by Yury Semikhatsky.
+
+        * WebCoreSupport/InspectorClientBlackBerry.cpp:
+        (WebCore::InspectorClientBlackBerry::updateInspectorStateCookie):
+
+2012-06-21  Parth Patel  <parpatel@rim.com>
+
+        [Blackberry] BlackBerry::Platform::Settings::get() rename to BlackBerry::Platform::Settings::instance() to make it consistent with our other singletons
+        https://bugs.webkit.org/show_bug.cgi?id=89684
+
+        Reviewed by Yong Li.
+   
+        Update setting instance access to use instance() instead of get().
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::globalInitialize):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::shouldSendResizeEvent):
+        * WebCoreSupport/AboutData.cpp:
+        (WebCore::configPage):
+        * WebCoreSupport/CacheClientBlackBerry.cpp:
+        (WebCore::CacheClientBlackBerry::updateCacheCapacity):
+        * WebKitSupport/FatFingers.cpp:
+        (BlackBerry::WebKit::FatFingers::getPaddings):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::isInputModeEnabled):
+        (BlackBerry::WebKit::InputHandler::setInputModeEnabled):
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        * WebKitSupport/SurfacePool.cpp:
+        (BlackBerry::WebKit::SurfacePool::initialize):
+
+2012-06-21  Genevieve Mak  <gmak@rim.com>
+
+        Add a parameter to handletTouchPoint to bypass FatFingers
+        on touch up. There are some cases where the user may drag
+        their finger off the element and we want to use the actual
+        touch point instead of the FatFingers adjusted point.
+        https://bugs.webkit.org/show_bug.cgi?id=89677
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::touchPointAsMouseEvent):
+        * Api/WebPage.h:
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-06-21  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Input mode should adapt automatically to settings changes
+        https://bugs.webkit.org/show_bug.cgi?id=89595
+
+        Reviewed by Antonio Gomes.
+
+        PR 167540.
+
+        Add helper function to check if input is enabled so that
+        the override settings can be applied at any time.
+
+        Reviewed Internally by Gen Mak.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setLoadState):
+        (BlackBerry::WebKit::WebPagePrivate::handleMouseEvent):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::isInputModeEnabled):
+        (BlackBerry::WebKit::InputHandler::setInputModeEnabled):
+        (BlackBerry::WebKit::InputHandler::setElementFocused):
+        (BlackBerry::WebKit::InputHandler::ensureFocusTextElementVisible):
+        (BlackBerry::WebKit::InputHandler::notifyClientOfKeyboardVisibilityChange):
+        (BlackBerry::WebKit::InputHandler::handleKeyboardInput):
+        (BlackBerry::WebKit::InputHandler::setComposingText):
+        * WebKitSupport/InputHandler.h:
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+
+2012-06-20  Jacky Jiang  <zhajiang@rim.com>
+
+        Add a != operator to ViewportArguments
+        https://bugs.webkit.org/show_bug.cgi?id=87505
+
+        Reviewed by Antonio Gomes.
+        Patch by Jacky Jiang  <zhajiang@rim.com>
+
+        Use != operator of ViewportArguments.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setLoadState):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        * Api/WebViewportArguments.cpp:
+        (BlackBerry::WebKit::WebViewportArguments::operator!=):
+
+2012-06-20  Christopher Hutten-Czapski  <chutten@rim.com>
+
+        [BlackBerry] Add an API to immediately enable cross-site XHR
+        https://bugs.webkit.org/show_bug.cgi?id=89594
+
+        Internally Reviewed by Yong Li.
+        Reviewed by Rob Buis.
+
+        There is no API to disable it as clients may rely on legacy behaviour
+        of not disabling until the next frame load.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::enableCrossSiteXHRRecursively):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::enableCrossSiteXHR):
+        (BlackBerry::WebKit::WebPage::enableCrossSiteXHR):
+        * Api/WebPage.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-06-20  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Enable setAcceleratedCompositingForFixedPositionEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=89575
+
+        Reviewed by Antonio Gomes.
+
+        Enable the flag so that we get position:fixed elemetns to be rendered
+        using accelerated compositing.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use IntSize in RenderLayer to represent scroll offsets
+        https://bugs.webkit.org/show_bug.cgi?id=89154
+
+        Reviewed by Eric Seidel.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::scrollRenderer):
+        Updated to pass an IntSize to scrollToOffset.
+
 2012-06-19  Yong Li  <yoli@rim.com>
 
         [BlackBerry] Should check the return value of fromUTF8() before executing the script.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutData.cpp b/Source/WebKit/blackberry/WebCoreSupport/AboutData.cpp
index e217742da..dc950b348 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutData.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutData.cpp
@@ -99,7 +99,7 @@ String configPage()
 #endif
     + "</td></tr>";
 
-    BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::get();
+    BlackBerry::Platform::Settings* settings = BlackBerry::Platform::Settings::instance();
     page += String("</table><h2>Platform Settings</h2><table>");
     page += numberToHTMLTr("isRSSFilteringEnabled", settings->isRSSFilteringEnabled());
     page += numberToHTMLTr("secondaryThreadStackSize", settings->secondaryThreadStackSize());
diff --git a/Source/WebKit/blackberry/WebCoreSupport/CacheClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/CacheClientBlackBerry.cpp
index c203a1822..1e4b45106 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/CacheClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/CacheClientBlackBerry.cpp
@@ -56,7 +56,7 @@ void CacheClientBlackBerry::updateCacheCapacity()
 #if ENABLE(BLACKBERRY_DEBUG_MEMORY)
     // We're debugging memory usage. So keep it disabled.
 #else
-    unsigned cacheCapacity = BlackBerry::Platform::Settings::get()->getSuggestedCacheCapacity(memoryCache()->totalSize());
+    unsigned cacheCapacity = BlackBerry::Platform::Settings::instance()->getSuggestedCacheCapacity(memoryCache()->totalSize());
     if (m_lastCapacity == cacheCapacity) {
         // Suggested capacity hasn't been changed.
         return;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.h
index 7610fb1d4..ca1dd9d4d 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/DeviceOrientationClientBlackBerry.h
@@ -19,8 +19,8 @@
 #ifndef DeviceOrientationClientBlackBerry_h
 #define DeviceOrientationClientBlackBerry_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 
 #include <BlackBerryPlatformDeviceOrientationTrackerListener.h>
 #include <wtf/RefPtr.h>
@@ -47,7 +47,7 @@ public:
     virtual void setController(DeviceOrientationController*);
     virtual void startUpdating();
     virtual void stopUpdating();
-    virtual DeviceOrientation* lastOrientation() const;
+    virtual DeviceOrientationData* lastOrientation() const;
     virtual void deviceOrientationControllerDestroyed();
     virtual void onOrientation(const BlackBerry::Platform::DeviceOrientationEvent*);
 
@@ -55,7 +55,7 @@ private:
     BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
     BlackBerry::Platform::DeviceOrientationTracker* m_tracker;
     DeviceOrientationController* m_controller;
-    RefPtr<DeviceOrientation> m_currentOrientation;
+    RefPtr<DeviceOrientationData> m_currentOrientation;
 };
 }
 
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
index dbb5f0807..22e2364b0 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
@@ -87,6 +87,7 @@ void InspectorClientBlackBerry::clearBrowserCookies()
 
 void InspectorClientBlackBerry::updateInspectorStateCookie(const String& cookie)
 {
+    // If this is implemented, we should override and return true in InspectorStateClient::supportsInspectorStateUpdates().
     notImplemented();
 };
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
index 4cc565e63..74c1bfae3 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
@@ -61,7 +61,10 @@ void DefaultTapHighlight::draw(const Platform::IntRectRegion& region, int red, i
     if (rect.isEmpty())
         return;
 
-    m_visible = true;
+    {
+        MutexLocker lock(m_mutex);
+        m_visible = true;
+    }
 
     if (!m_overlay) {
         m_overlay = adoptPtr(new WebOverlay(this));
@@ -82,18 +85,22 @@ void DefaultTapHighlight::hide()
     if (!m_overlay)
         return;
 
+    {
+        MutexLocker lock(m_mutex);
+        if (!m_visible)
+            return;
+        m_visible = false;
+    }
+
     // Since WebAnimation is not thread safe, we create a new one each time instead of reusing the same object on different
     // threads (that would introduce race conditions).
     WebAnimation fadeAnimation = WebAnimation::fadeAnimation(fadeAnimationName(), 1.0, 0.0, ActiveTextFadeAnimationDuration);
 
     // Normally, this method is called on the WebKit thread, but it can also be
     // called from the compositing thread.
-    if (BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread()) {
-        if (!m_visible)
-            return;
-        m_visible = false;
+    if (BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread())
         m_overlay->addAnimation(fadeAnimation);
-    } else if (BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread())
+    else if (BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread())
         m_overlay->override()->addAnimation(fadeAnimation);
 }
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
index fdf632a50..72ea40251 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
@@ -31,6 +31,7 @@
 #include <BlackBerryPlatformIntRectRegion.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/Threading.h>
 
 namespace BlackBerry {
 namespace WebKit {
@@ -69,6 +70,7 @@ private:
     WebCore::Color m_color;
     bool m_visible;
     bool m_shouldHideAfterScroll;
+    Mutex m_mutex;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
index d9fa43b1e..381e7a1ec 100644
--- a/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/FatFingers.cpp
@@ -450,10 +450,10 @@ bool FatFingers::checkForText(Node* curNode, Vector<IntersectingRegion>& interse
 
 void FatFingers::getPaddings(unsigned& top, unsigned& right, unsigned& bottom, unsigned& left) const
 {
-    static unsigned topPadding = Platform::Settings::get()->topFatFingerPadding();
-    static unsigned rightPadding = Platform::Settings::get()->rightFatFingerPadding();
-    static unsigned bottomPadding = Platform::Settings::get()->bottomFatFingerPadding();
-    static unsigned leftPadding = Platform::Settings::get()->leftFatFingerPadding();
+    static unsigned topPadding = Platform::Settings::instance()->topFatFingerPadding();
+    static unsigned rightPadding = Platform::Settings::instance()->rightFatFingerPadding();
+    static unsigned bottomPadding = Platform::Settings::instance()->bottomFatFingerPadding();
+    static unsigned leftPadding = Platform::Settings::instance()->leftFatFingerPadding();
 
     double currentScale = m_webPage->currentScale();
     top = topPadding / currentScale;
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index c563ad25f..ea6741d65 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -432,21 +432,22 @@ void InputHandler::setElementUnfocused(bool refocusOccuring)
     m_currentFocusElementType = TextEdit;
 }
 
-void InputHandler::enableInputMode(bool inputModeAllowed)
+bool InputHandler::isInputModeEnabled() const
 {
-    FocusLog(LogLevelInfo, "InputHandler::enableInputMode '%s', override is '%s'"
-             , inputModeAllowed ? "true" : "false"
-             , m_webPage->m_dumpRenderTree || Platform::Settings::get()->alwaysShowKeyboardOnFocus() ? "true" : "false");
+    // Input mode is enabled when set, or when dump render tree or always show keyboard setting is enabled.
+    return m_inputModeEnabled || m_webPage->m_dumpRenderTree || Platform::Settings::instance()->alwaysShowKeyboardOnFocus();
+}
 
-    m_inputModeEnabled = inputModeAllowed;
+void InputHandler::setInputModeEnabled(bool active)
+{
+    FocusLog(LogLevelInfo, "InputHandler::setInputModeEnabled '%s', override is '%s'"
+             , active ? "true" : "false"
+             , m_webPage->m_dumpRenderTree || Platform::Settings::instance()->alwaysShowKeyboardOnFocus() ? "true" : "false");
 
-    // If DRT is running or always show keyboard setting is active, do not delay
-    // showing the keyboard.
-    if (m_webPage->m_dumpRenderTree || Platform::Settings::get()->alwaysShowKeyboardOnFocus())
-        m_inputModeEnabled = true;
+    m_inputModeEnabled = active;
 
     // If the frame selection isn't focused, focus it.
-    if (m_inputModeEnabled && isActiveTextEdit() && !m_currentFocusElement->document()->frame()->selection()->isFocused())
+    if (isInputModeEnabled() && isActiveTextEdit() && !m_currentFocusElement->document()->frame()->selection()->isFocused())
         m_currentFocusElement->document()->frame()->selection()->setFocused(true);
 }
 
@@ -455,8 +456,8 @@ void InputHandler::setElementFocused(Element* element)
     ASSERT(DOMSupport::isTextBasedContentEditableElement(element));
     ASSERT(element->document() && element->document()->frame());
 
-    if (element->document()->frame()->selection()->isFocused() != m_inputModeEnabled)
-        element->document()->frame()->selection()->setFocused(m_inputModeEnabled);
+    if (element->document()->frame()->selection()->isFocused() != isInputModeEnabled())
+        element->document()->frame()->selection()->setFocused(isInputModeEnabled());
 
     // Clear the existing focus node details.
     setElementUnfocused(true /*refocusOccuring*/);
@@ -552,10 +553,10 @@ WebCore::IntRect InputHandler::boundingBoxForInputField()
 
 void InputHandler::ensureFocusTextElementVisible(CaretScrollType scrollType)
 {
-    if (!m_inputModeEnabled || !m_currentFocusElement || !m_currentFocusElement->document())
+    if (!isActiveTextEdit() || !isInputModeEnabled() || !m_currentFocusElement->document())
         return;
 
-    if (!Platform::Settings::get()->allowCenterScrollAdjustmentForInputFields() && scrollType != EdgeIfNeeded)
+    if (!Platform::Settings::instance()->allowCenterScrollAdjustmentForInputFields() && scrollType != EdgeIfNeeded)
         return;
 
     Frame* elementFrame = m_currentFocusElement->document()->frame();
@@ -770,7 +771,7 @@ void InputHandler::processPendingKeyboardVisibilityChange()
 void InputHandler::notifyClientOfKeyboardVisibilityChange(bool visible)
 {
     // If we aren't ready for input, keyboard changes should be ignored.
-    if (!m_inputModeEnabled && visible)
+    if (!isInputModeEnabled() && visible)
         return;
 
     if (!m_delayKeyboardVisibilityChange) {
@@ -929,7 +930,7 @@ bool InputHandler::handleKeyboardInput(const Platform::KeyboardEvent& keyboardEv
     InputLog(LogLevelInfo, "InputHandler::handleKeyboardInput received character=%lc, type=%d", keyboardEvent.character(), keyboardEvent.type());
 
     // Enable input mode if we are processing a key event.
-    enableInputMode();
+    setInputModeEnabled();
 
     // If we aren't specifically part of a composition, fail, IMF should never send key input
     // while composing text. If IMF has failed, we should have already finished the
@@ -1725,7 +1726,7 @@ int32_t InputHandler::setComposingText(spannable_string_t* spannableString, int3
     InputLog(LogLevelInfo, "InputHandler::setComposingText at relativeCursorPosition: %d", relativeCursorPosition);
 
     // Enable input mode if we are processing a key event.
-    enableInputMode();
+    setInputModeEnabled();
 
     return setSpannableTextAndRelativeCursor(spannableString, relativeCursorPosition, true /* markTextAsComposing */) ? 0 : -1;
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
index c63344724..e34126ba2 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.h
@@ -57,7 +57,8 @@ public:
     enum FocusElementType { TextEdit, TextPopup /* Date/Time & Color */, SelectPopup, Plugin };
     enum CaretScrollType { CenterAlways, CenterIfNeeded, EdgeIfNeeded };
 
-    void enableInputMode(bool inputModeAllowed = true);
+    bool isInputModeEnabled() const;
+    void setInputModeEnabled(bool active = true);
 
     void focusedNodeChanged();
     void nodeTextChanged(const WebCore::Node*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
index bf2a58da1..de4fe5caa 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
@@ -69,8 +69,8 @@ void SurfacePool::initialize(const BlackBerry::Platform::IntSize& tileSize)
         return;
     m_initialized = true;
 
-    const unsigned numberOfTiles = BlackBerry::Platform::Settings::get()->numberOfBackingStoreTiles();
-    const unsigned maxNumberOfTiles = BlackBerry::Platform::Settings::get()->maximumNumberOfBackingStoreTilesAcrossProcesses();
+    const unsigned numberOfTiles = BlackBerry::Platform::Settings::instance()->numberOfBackingStoreTiles();
+    const unsigned maxNumberOfTiles = BlackBerry::Platform::Settings::instance()->maximumNumberOfBackingStoreTilesAcrossProcesses();
 
     if (numberOfTiles) { // Only allocate if we actually use a backingstore.
         unsigned byteLimit = (maxNumberOfTiles /*pool*/ + 2 /*visible tile buffer, backbuffer*/) * tileSize.width() * tileSize.height() * 4;
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
index a74af4b97..c8668be85 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -168,15 +168,16 @@ void TouchEventHandler::touchHoldEvent()
         m_webPage->clearFocusNode();
 }
 
-bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point)
+bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point, bool useFatFingers)
 {
     // Enable input mode on any touch event.
-    m_webPage->m_inputHandler->enableInputMode();
+    m_webPage->m_inputHandler->setInputModeEnabled();
     bool pureWithMouseConversion = m_webPage->m_touchEventMode == PureTouchEventsWithMouseConversion;
 
     switch (point.m_state) {
     case Platform::TouchPoint::TouchPressed:
         {
+            // FIXME: bypass FatFingers if useFatFingers is false
             m_lastFatFingersResult.reset(); // Theoretically this shouldn't be required. Keep it just in case states get mangled.
             m_didCancelTouch = false;
             m_lastScreenPoint = point.m_screenPos;
@@ -229,7 +230,7 @@ bool TouchEventHandler::handleTouchPoint(Platform::TouchPoint& point)
                 m_webPage->m_inputHandler->notifyClientOfKeyboardVisibilityChange(true);
 
             IntPoint adjustedPoint;
-            if (m_convertTouchToMouse) {
+            if (m_convertTouchToMouse || !useFatFingers) {
                 adjustedPoint = point.m_pos;
                 m_convertTouchToMouse = pureWithMouseConversion;
             } else // Fat finger point in viewport coordinates.
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
index 3bcdd87d4..91c7f160e 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.h
@@ -35,7 +35,7 @@ public:
     TouchEventHandler(WebPagePrivate* webpage);
     ~TouchEventHandler();
 
-    bool handleTouchPoint(Platform::TouchPoint&);
+    bool handleTouchPoint(Platform::TouchPoint&, bool useFatFingers);
     void touchEventCancel();
     void touchHoldEvent();
 
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 49bb91c43..3cbb2e803 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,736 @@
+2012-06-24  Luke Macpherson  <macpherson@chromium.org>
+
+        Add runtime flag to enable/disable CSS variables (in addition to existing compile-time flag).
+        https://bugs.webkit.org/show_bug.cgi?id=89542
+
+        Reviewed by Dimitri Glazkov.
+
+        * features.gypi:
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setExperimentalCSSVariablesEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-06-23  Kwang Yul Seo  <skyul@company100.net>
+
+        [chromium] Return has value, in function returning void
+        https://bugs.webkit.org/show_bug.cgi?id=89822
+
+        Reviewed by Adam Barth.
+
+        A followup for r121091.
+
+        * src/WebHistoryItem.cpp:
+        (WebKit::WebHistoryItem::setPageScaleFactor):
+        * src/WebImageLayer.cpp:
+        (WebKit::WebImageLayer::setBitmap):
+        * src/WebLayer.cpp:
+        (WebKit::WebLayer::setMaskLayer):
+        * src/WebOptionElement.cpp:
+        (WebKit::WebOptionElement::setValue):
+        (WebKit::WebOptionElement::setDefaultSelected):
+
+2012-06-23  Kwang Yul Seo  <skyul@company100.net>
+
+        [chromium] Return has value, in function returning void
+        https://bugs.webkit.org/show_bug.cgi?id=89805
+
+        Reviewed by Adam Barth.
+
+        Make WebFrameImpl::replaceSelection not return a value because it is a function returning void.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::replaceSelection):
+
+2012-06-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-06-22  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Avoid infinite loop if we try to encode -1 for leveldb
+        https://bugs.webkit.org/show_bug.cgi?id=89625
+
+        Reviewed by Tony Chang.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-06-22  Michael Nordman  <michaeln@google.com>
+
+        [chromium] WebKit API plumbing for applicationCache.abort() 
+        https://bugs.webkit.org/show_bug.cgi?id=89792
+
+        Reviewed by Darin Fisher.
+
+        * public/WebApplicationCacheHost.h:
+        (WebKit::WebApplicationCacheHost::abort):
+        * src/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::abort):
+
+2012-06-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Update various test fixtures and tests to cover scheduling, visibility, and resource allocation changes.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (CCLayerTreeHostTestAbortFrameWhenInvisible):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::CCLayerTreeHostTestAbortFrameWhenInvisible):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::beginTest):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::afterTest):
+        (WTF):
+        (WTF::TEST_F):
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/CCSchedulerStateMachineTest.cpp:
+        (WebCore::TEST):
+        * tests/CCTiledLayerTestCommon.h:
+        * tests/FakeWebGraphicsContext3D.h:
+        (WebKit::FakeWebGraphicsContext3D::FakeWebGraphicsContext3D):
+        (FakeWebGraphicsContext3D):
+        (WebKit::FakeWebGraphicsContext3D::createTexture):
+        * tests/LayerRendererChromiumTest.cpp:
+        (TEST_F):
+        * tests/TiledLayerChromiumTest.cpp:
+
+
+2012-06-22  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        [chromium] Notify the document if a plugin accepts touch input events
+        https://bugs.webkit.org/show_bug.cgi?id=89769
+
+        Reviewed by Adam Barth.
+
+        The browser sends touch events to webkit only if webkit has any touch-event handlers. So it is
+        necessary to notify the document when a plugin starts accepting touch-events so that it can in
+        turn tell the browser to send it touch events.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setIsAcceptingTouchEvents):
+        (WebKit):
+        (WebKit::WebPluginContainerImpl::WebPluginContainerImpl):
+        (WebKit::WebPluginContainerImpl::~WebPluginContainerImpl):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121064.
+        http://trac.webkit.org/changeset/121064
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Broke Chromium Mac build.
+
+        * public/WebView.h:
+        (WebKit):
+        (WebView):
+        * src/WebLayerTreeView.cpp:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestScrollSimple::layout):
+        (WTF::CCLayerTreeHostTestScrollMultipleRedraw::drawLayersOnCCThread):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::didCommitAndDrawFrame):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::didCommit):
+
+2012-06-22  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Expose rendering statistics to WebWidget.
+        https://bugs.webkit.org/show_bug.cgi?id=88268
+
+        Reviewed by James Robinson.
+
+        The WebKit side of a basic framework for exposing rendering statistics
+        to Chromium's --enable-benchmarking extension.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::renderingStatistics):
+        (WebKit):
+
+2012-06-22  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Do not accumulate occlusion from 3d layers on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=89704
+
+        Reviewed by James Robinson.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebKitTests):
+        (CCOcclusionTrackerTestUnsorted3dLayers):
+        (WebKitTests::CCOcclusionTrackerTestUnsorted3dLayers::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect::runMyTest):
+
+2012-06-22  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Snapshot metadata in front end to avoid IPC round-trips
+        https://bugs.webkit.org/show_bug.cgi?id=88467
+
+        Reviewed by Tony Chang.
+
+        Add conversions to/from WebCore IDB metadata type and plumbing for routing the
+        IDBDatabaseBackendInterface::metadata() call through the public API..
+
+        * WebKit.gyp: New file added.
+        * public/WebIDBMetadata.h: Conversion functions.
+        (WebCore):
+        (WebIDBMetadata):
+        * src/IDBDatabaseBackendProxy.cpp: Plumbing.
+        (WebKit::IDBDatabaseBackendProxy::metadata):
+        (WebKit):
+        * src/IDBDatabaseBackendProxy.h: Plumbing.
+        (IDBDatabaseBackendProxy):
+        * src/WebIDBDatabaseImpl.cpp: Plumbing.
+        (WebKit::WebIDBDatabaseImpl::metadata):
+        (WebKit):
+        * src/WebIDBDatabaseImpl.h: Plumbing.
+        (WebKit):
+        (WebIDBDatabaseImpl):
+        * src/WebIDBMetadata.cpp: Added - conversion functions.
+        (WebKit):
+        (WebKit::WebIDBMetadata::WebIDBMetadata):
+        (WebKit::WebIDBMetadata::operator IDBDatabaseMetadata):
+
+2012-06-22  Fady Samuel  <fsamuel@chromium.org>
+
+        [Chromium] Browser Plugin: Expose advanceFocus to WebKit API so that guests can advance focus of theirs embedders
+        https://bugs.webkit.org/show_bug.cgi?id=88827
+
+        Reviewed by Darin Fisher.
+
+        A browser plugin needs to be able to tells its embedder when the guest
+        is done tabbing through controls and wants its embedder to advance its
+        tab position.
+
+        * public/WebView.h:
+        (WebView):
+        (WebKit::WebView::advanceFocus):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::advanceFocus):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-06-22  Jeff Timanus  <twiz@chromium.org>
+
+        [Chromium] Change implementing a fast-path for copying GPU-accelerated Canvas2D instances to WebGL textures.
+        https://bugs.webkit.org/show_bug.cgi?id=86275
+
+        This change adds the necessary plumbing to the various rendering contexts to copy the backing store texture of
+        a Canvas2D instance to be copied to a WebGL texture.  The GL_CHROMIUM_copy_texture extension is necessary
+        because the backing-store for a GPU-accelerated skia Canvas2D is normally in BGRA format, which is not supported
+        by glCopyTexImage.
+
+        Reviewed by Kenneth Russell.
+
+        * DEPS: Rolled chromium to 143630 to fix chromium-linux ews failures.
+
+2012-06-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r121025.
+        http://trac.webkit.org/changeset/121025
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        Caused crash in
+        EventHandler.shouldTurnVerticalTicksIntoHorizontal webkit unit
+        test on 10.7
+
+        * WebKit.gypi:
+        * tests/EventHandlerTest.cpp: Removed.
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * WebKit.gyp:
+        * WebKitUnitTests.gyp:
+
+2012-06-22  Robert Kroeger  <rjkroege@chromium.org>
+
+        Suppress horizontal conversion of PlatformWheelEvents when hasPreciseScrollingDeltas is true
+        https://bugs.webkit.org/show_bug.cgi?id=89580
+
+        WebKit GTK and Chromium Linux force vertical wheel events to
+        scroll horizontally when over horizontal scroll bars.  This is
+        undesirable for touchpad scrolling with hasPreciseScrollingDeltas() == true.
+
+        Added unit tests to show that
+        EventHandler::shouldTurnVerticalTicksIntoHorizontal() is true
+        only for PlatformWheelEvents when !hasPreciseScrollingDeltas().
+
+        Reviewed by Adam Barth.
+
+        * WebKit.gypi:
+        * tests/EventHandlerTest.cpp: Added.
+        (MockScrollbar):
+        (MockScrollbar::MockScrollbar):
+        (MockScrollbar::~MockScrollbar):
+        (MockHitTestResult):
+        (MockHitTestResult::MockHitTestResult):
+        (MockHitTestResult::scrollbar):
+        (MockPlatformWheelEvent):
+        (MockPlatformWheelEvent::MockPlatformWheelEvent):
+        (EventHandlerTest):
+        (EventHandlerTest::EventHandlerTest):
+        (EventHandlerTest::externalShouldTurnVerticalTicksIntoHorizontal):
+        (TEST):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+        
+        * public/WebDeviceOrientation.h:
+        (WebDeviceOrientation):
+        * src/DeviceOrientationClientProxy.cpp:
+        (WebKit::DeviceOrientationClientProxy::lastOrientation):
+        * src/DeviceOrientationClientProxy.h:
+        (DeviceOrientationClientProxy):
+        * src/WebDeviceOrientation.cpp:
+        (WebKit::WebDeviceOrientation::WebDeviceOrientation):
+        (WebKit::WebDeviceOrientation::operator=):
+        (WebKit::WebDeviceOrientation::operator PassRefPtr<WebCore::DeviceOrientationData>):
+        * src/WebDeviceOrientationController.cpp:
+        (WebKit::WebDeviceOrientationController::didChangeDeviceOrientation):
+
+2012-06-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorState::updateCookie should not do JSON serialization if unsupported
+        https://bugs.webkit.org/show_bug.cgi?id=89743
+
+        The Chromium port does want InspectorState updates.
+
+        Reviewed by Yury Semikhatsky.
+
+        * src/InspectorClientImpl.h:
+        (WebKit::InspectorClientImpl::supportsInspectorStateUpdates):
+        * src/WebDevToolsAgentImpl.h:
+        (WebKit::WebDevToolsAgentImpl::supportsInspectorStateUpdates):
+
+2012-06-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120982.
+        http://trac.webkit.org/changeset/120982
+        https://bugs.webkit.org/show_bug.cgi?id=89740
+
+        [chromium] ASSERTION FAILED:
+        m_allocatedTextureIds.contains(textureId) (Requested by ukai
+        on #webkit).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (CCLayerTreeHostTestVisibilityAndAllocationControlDrawing):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::beginTest):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::didCommitAndDrawFrame):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::didCommit):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::commitCompleteOnCCThread):
+        (WTF::CCLayerTreeHostTestVisibilityAndAllocationControlDrawing::afterTest):
+        (WTF):
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/CCSchedulerStateMachineTest.cpp:
+        (WebCore::TEST):
+        * tests/CCTiledLayerTestCommon.h:
+        (WebKitTests::FakeTextureAllocator::createTexture):
+        (WebKitTests::FakeTextureAllocator::deleteTexture):
+        * tests/FakeWebGraphicsContext3D.h:
+        (WebKit::FakeWebGraphicsContext3D::createTexture):
+        (FakeWebGraphicsContext3D):
+        * tests/LayerRendererChromiumTest.cpp:
+        (TEST_F):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-06-21  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Initialize compositor's visibility state upon initialization
+        https://bugs.webkit.org/show_bug.cgi?id=89712
+
+        Reviewed by Adrienne Walker.
+
+        A given WebViewImpl's visibility state might change any number of times before compositing is enabled. If the
+        visibility state is not the default (visible) when the compositor is initialized, we need to let it know the
+        correct visibility state or it will start ticking uselessly in threaded mode.
+
+        Tested manually, there's no way to create a new WebViewImpl in a non-visible state in a WebKit test that I know
+        of.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-06-21  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        [chromium] Add touch-event support for WebPluginContainerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=89089
+
+        Reviewed by Adam Barth.
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleEvent):
+        * src/WebPluginContainerImpl.h:
+        (WebCore):
+        (WebPluginContainerImpl):
+
+2012-06-21  Oli Lan  <olilan@chromium.org>
+
+        Add methods to select between offsets in an editable field.
+        https://bugs.webkit.org/show_bug.cgi?id=89098
+
+        Reviewed by Ryosuke Niwa.
+
+        Reviewed by Ryosuke Niwa.
+
+        This adds a new method WebViewImpl::setEditableSelectionOffsets, which
+        can be used to select between two character positions in the node
+        currently beign edited.
+
+        The offsets are assumed to be relative to the rootEditableElement.
+        
+        This can be used for IME features that require the ability to manipulate
+        the selection, for example on Android where the method InputConnection#setSelection
+        is used.
+
+        This method calls a new method Editor::setSelectionOffsets.
+
+        The method works for inputs/textareas (i.e. text form controls) and
+        contenteditable nodes, and the new test in WebViewTest tests both these cases.
+
+        * public/WebView.h:
+        (WebView):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setEditableSelectionOffsets):
+        (WebKit):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/WebViewTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit):
+        * tests/data/content_editable_populated.html: Added.
+        * tests/data/input_field_populated.html: Added.
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerRendererChromium is not getting visibility messages in single threaded compositing mode.
+        https://bugs.webkit.org/show_bug.cgi?id=89045
+
+        Reviewed by Adrienne Walker.
+
+        Based on patch by Michal Mocny <mmocny@google.com>.
+
+        Update various test fixtures and tests to cover scheduling, visibility, and resource allocation changes.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (CCLayerTreeHostTestAbortFrameWhenInvisible):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::CCLayerTreeHostTestAbortFrameWhenInvisible):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::beginTest):
+        (WTF::CCLayerTreeHostTestAbortFrameWhenInvisible::afterTest):
+        (WTF):
+        (WTF::TEST_F):
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/CCSchedulerStateMachineTest.cpp:
+        (WebCore::TEST):
+        * tests/CCTiledLayerTestCommon.h:
+        * tests/FakeWebGraphicsContext3D.h:
+        (WebKit::FakeWebGraphicsContext3D::FakeWebGraphicsContext3D):
+        (FakeWebGraphicsContext3D):
+        (WebKit::FakeWebGraphicsContext3D::createTexture):
+        * tests/LayerRendererChromiumTest.cpp:
+        (TEST_F):
+        * tests/TiledLayerChromiumTest.cpp:
+
+
+2012-06-21  Mike West  <mkwst@chromium.org>
+
+        [Chromium] Enable CSP_NEXT on the Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=89683
+
+        Reviewed by Adam Barth.
+
+        Enable CSP 1.1 on the Chromium port. This has zero practical effect,
+        as no CSP 1.1 patches have landed yet. But it will. Oh it will.
+
+        * features.gypi: ENABLE_CSP_NEXT=1
+
+2012-06-21  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Implement spec behavior for multiEntry indexes with invalid/duplicate subkeys
+        https://bugs.webkit.org/show_bug.cgi?id=86123
+
+        Reviewed by Darin Fisher.
+
+        Add matching isValid() to WebIDBKey to match the one in IDBKey.
+
+        * public/WebIDBKey.h:
+        * src/WebIDBKey.cpp:
+        (WebKit::WebIDBKey::isValid):
+        (WebKit):
+        * src/WebIDBKeyRange.cpp:
+        (WebKit::WebIDBKeyRange::assign):
+
+2012-06-21  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Overlays when using the web inspector are blurry with device scale factor > 1
+        https://bugs.webkit.org/show_bug.cgi?id=89676
+
+        Reviewed by James Robinson.
+
+        Whenever we construct a GraphicsLayerChromium, make initialize the
+        device and page scale factors, if possible.
+
+        * tests/GraphicsLayerChromiumTest.cpp:
+        (WebKitTests::TEST_F):
+        (WebKitTests):
+
+2012-06-21  Min Qin  <qinmin@chromium.org>
+
+        remove ENABLE_FULLSCREEN_MEDIA_CONTROL flag
+        https://bugs.webkit.org/show_bug.cgi?id=89614
+
+        Reviewed by Eric Carlson.
+
+        Since desktop chrome now has fullscreen button, we don't need this flag anymore
+
+        * features.gypi:
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        Added unit tests to check surface texture caching when partial
+        swap is not used.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-06-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120889.
+        http://trac.webkit.org/changeset/120889
+        https://bugs.webkit.org/show_bug.cgi?id=89630
+
+        [Chromium] webkit_unit_tests didDrawNotCalledOnHiddenLayer
+        start failing (Requested by ukai on #webkit).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Damage tracker is not used without partial swap, causing valid render passes to be removed
+        https://bugs.webkit.org/show_bug.cgi?id=89589
+
+        Reviewed by Adrienne Walker.
+
+        Added unit tests to check surface texture caching when partial
+        swap is not used.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove redundant IDBObjectStore.delete() overloads
+        https://bugs.webkit.org/show_bug.cgi?id=89587
+
+        Reviewed by Darin Fisher.
+
+        * public/WebIDBObjectStore.h: Add note to remove overload when Chromium is updated.
+        (WebIDBObjectStore):
+        * src/IDBObjectStoreBackendProxy.cpp: Delete IDBKey overload.
+        * src/IDBObjectStoreBackendProxy.h: Delete IDBKey overload.
+        (IDBObjectStoreBackendProxy):
+        * src/WebIDBObjectStoreImpl.cpp: Delete IDBKey overload.
+        * src/WebIDBObjectStoreImpl.h: Delete IDBKey overload.
+        (WebIDBObjectStoreImpl):
+
+2012-06-20  Garret Kelly  <gdk@chromium.org>
+
+        Moving cookieEnabled/setCookieEnabled from Page to Settings, and
+        exposing through WebSettings.
+        https://bugs.webkit.org/show_bug.cgi?id=89545
+
+        Reviewed by Adam Barth.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setCookieEnabled):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-06-20  Raymes Khoury  <raymes@chromium.org>
+
+        Perform hit-test from correct frame in isRectTopmost()
+        https://bugs.webkit.org/show_bug.cgi?id=89492
+
+        Reviewed by Levi Weintraub.
+
+        Hit-testing was being performed from the main frame, which gave the
+        incorrect result if the plugin was in a different frame.
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::isRectTopmost):
+
+2012-06-20  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Support mobile device rotation resizing
+        https://bugs.webkit.org/show_bug.cgi?id=86819
+
+        Reviewed by Adam Barth.
+
+        Resizes on a mobile device are caused either by rotation or
+        on-screen-keyboard bringup, and need different treatment to remain
+        naturally laid out, scaled and scrolled without disorienting the user.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::resize):
+
+2012-06-19  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Separate LayerRenderer initialization from updateLayers
+        https://bugs.webkit.org/show_bug.cgi?id=89525
+
+        Reviewed by Adrienne Walker.
+
+        Update tests to call initializeLayerRendererIfNeeded() before calling updateLayers() to reflect what the proxies
+        do.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-06-20  Christopher Cameron  <ccameron@chromium.org>
+
+        [chromium] webkit-backface-visibility doesn't work with video
+        https://bugs.webkit.org/show_bug.cgi?id=88908
+
+        When determining a contents layer's backface culling, use the parent
+        layer's transform and backface-visibility properties. Track which
+        layers need this special treatment with useParentBackfaceVisibility
+        and setUseParentBackfaceVisibility functions in WebCore::LayerChromium,
+        WebKit::WebLayer, and WebCore::CCLayerImpl.
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebLayer.cpp:
+            (WebKit::WebLayer::setUseParentBackfaceVisibility):
+                Add an accessor to specify that a layer should use its parent's
+                backface culling behavior.
+
+2012-06-20  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Make sure that render surfaces are not pixel doubled with a device scale factor of 2
+        https://bugs.webkit.org/show_bug.cgi?id=86882
+
+        Reviewed by Adrienne Walker.
+
+        To ensure that render surfaces are not pixel doubled when device scale factor is
+        two, the render surface's owning layer's draw transform is scaled by the
+        contents scale (in the same way that the parent matrix is scaled by the device
+        scale factor). The transformedLayerRect's dimensions also need to be in pixel
+        space. The surface origin transform should not scale, but needs to offset the
+        correct number of pixels, and the replica transforms need to be modified to
+        account for the scaling.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        Unreviewed build fix.
+
+        * tests/IDBDatabaseBackendTest.cpp:
+        (WebCore::MockIDBCallbacks::~MockIDBCallbacks):
+        (WebCore::FakeIDBDatabaseCallbacks::~FakeIDBDatabaseCallbacks):
+
+2012-06-20  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Don't close database if pending connections are in flight
+        https://bugs.webkit.org/show_bug.cgi?id=89512
+
+        Reviewed by Tony Chang.
+
+        * tests/IDBDatabaseBackendTest.cpp:
+        (MockIDBCallbacks):
+        (WebCore::MockIDBCallbacks::create):
+        (WebCore::MockIDBCallbacks::MockIDBCallbacks):
+        (WebCore):
+        (FakeIDBDatabaseCallbacks):
+        (WebCore::FakeIDBDatabaseCallbacks::create):
+        (WebCore::FakeIDBDatabaseCallbacks::FakeIDBDatabaseCallbacks):
+        (WebCore::TEST):
+
+2012-06-20  Zeev Lieber  <zlieber@chromium.org>
+
+        [Chromium] Remove redundant #includes in compositor
+        https://bugs.webkit.org/show_bug.cgi?id=89503
+
+        Reviewed by Adrienne Walker.
+
+        Minor adjustments to #include statements to remove
+        dependencies. No new tests.
+
+        * src/WebCompositorImpl.cpp:
+        * src/WebLayerTreeView.cpp:
+        * tests/CCLayerTestCommon.cpp:
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        * tests/CCOcclusionTrackerTest.cpp:
+        * tests/CCQuadCullerTest.cpp:
+        * tests/CCTiledLayerImplTest.cpp:
+        * tests/ImageLayerChromiumTest.cpp:
+        * tests/LayerRendererChromiumTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-06-20  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechRecognition.maxAlternatives attribute
+        https://bugs.webkit.org/show_bug.cgi?id=89459
+
+        Reviewed by Eric Seidel.
+
+        Plumbing for the maxAlternatives attribute.
+
+        * public/WebSpeechRecognitionParams.h:
+        (WebKit::WebSpeechRecognitionParams::WebSpeechRecognitionParams):
+        (WebKit::WebSpeechRecognitionParams::maxAlternatives):
+        (WebSpeechRecognitionParams):
+        * src/SpeechRecognitionClientProxy.cpp:
+        (WebKit::SpeechRecognitionClientProxy::start):
+        * src/SpeechRecognitionClientProxy.h:
+        (SpeechRecognitionClientProxy):
+
 2012-06-20  Hironori Bono  <hbono@chromium.org>
 
         [chromium] Select the marker range when right-clicking on a marker.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 78bca67d0..307c63cc0 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '142842'
+  'chromium_rev': '143776'
 }
 
 deps = {
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 74db258be..bcbb91386 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -561,6 +561,7 @@
                 'src/WebIDBKey.cpp',
                 'src/WebIDBKeyPath.cpp',
                 'src/WebIDBKeyRange.cpp',
+                'src/WebIDBMetadata.cpp',
                 'src/WebIDBObjectStoreImpl.cpp',
                 'src/WebIDBObjectStoreImpl.h',
                 'src/WebIDBTransactionImpl.cpp',
@@ -1036,7 +1037,7 @@
         },
     ], # targets
     'conditions': [
-        ['os_posix==1 and OS!="mac" and OS!="android" and gcc_version==46', {
+        ['os_posix==1 and OS!="mac" and gcc_version==46', {
             'target_defaults': {
                 # Disable warnings about c++0x compatibility, as some names (such
                 # as nullptr) conflict with upcoming c++0x types.
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 6f1ed11c7..58af83985 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -117,7 +117,7 @@
         }                
     ], # targets
     'conditions': [
-        ['os_posix==1 and OS!="mac" and OS!="android" and gcc_version==46', {
+        ['os_posix==1 and OS!="mac" and gcc_version==46', {
             'target_defaults': {
                 # Disable warnings about c++0x compatibility, as some names (such
                 # as nullptr) conflict with upcoming c++0x types.
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index a4290a8b3..2ae79ba92 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -37,7 +37,7 @@
       'ENABLE_BLOB=1',
       'ENABLE_BLOB_SLICE=1',
       'ENABLE_CHANNEL_MESSAGING=1',
-      'ENABLE_CSP_NEXT=0',
+      'ENABLE_CSP_NEXT=1',
       'ENABLE_CSS3_FLEXBOX=1',
       'ENABLE_CSS_BOX_DECORATION_BREAK=1',
       'ENABLE_CSS_EXCLUSIONS=1',
@@ -46,7 +46,7 @@
       'ENABLE_CSS_IMAGE_RESOLUTION=0',
       'ENABLE_CSS_REGIONS=1',
       'ENABLE_CSS_SHADERS=1',
-      'ENABLE_CSS_VARIABLES=0',
+      'ENABLE_CSS_VARIABLES=1',
       'ENABLE_CUSTOM_SCHEME_HANDLER=0',
       'ENABLE_DATALIST=1',
       'ENABLE_DASHBOARD_SUPPORT=0',
@@ -136,7 +136,6 @@
         'feature_defines': [
           'ENABLE_CALENDAR_PICKER=0',
           'ENABLE_FONT_BOOSTING=1',
-          'ENABLE_FULLSCREEN_MEDIA_CONTROLS=1',
           'ENABLE_INPUT_SPEECH=0',
           'ENABLE_INPUT_TYPE_DATETIME=1',
           'ENABLE_INPUT_TYPE_DATETIMELOCAL=1',
@@ -162,7 +161,6 @@
         'feature_defines': [
           'ENABLE_CALENDAR_PICKER=1',
           'ENABLE_FONT_BOOSTING=0',
-          'ENABLE_FULLSCREEN_MEDIA_CONTROLS=1',
           'ENABLE_INPUT_SPEECH=1',
           'ENABLE_JAVASCRIPT_I18N_API=1',
           'ENABLE_LEGACY_NOTIFICATIONS=1',
diff --git a/Source/WebKit/chromium/public/WebApplicationCacheHost.h b/Source/WebKit/chromium/public/WebApplicationCacheHost.h
index bd5221807..fb68126a7 100644
--- a/Source/WebKit/chromium/public/WebApplicationCacheHost.h
+++ b/Source/WebKit/chromium/public/WebApplicationCacheHost.h
@@ -92,6 +92,7 @@ public:
     virtual Status status() { return Uncached; }
     virtual bool startUpdate() { return false; }
     virtual bool swapCache() { return false; }
+    virtual void abort() { }
 
     // Structures and methods to support inspecting Application Caches.
     struct CacheInfo {
diff --git a/Source/WebKit/chromium/public/WebDeviceOrientation.h b/Source/WebKit/chromium/public/WebDeviceOrientation.h
index b26649e1c..66540bd8a 100644
--- a/Source/WebKit/chromium/public/WebDeviceOrientation.h
+++ b/Source/WebKit/chromium/public/WebDeviceOrientation.h
@@ -28,7 +28,7 @@
 
 #if WEBKIT_IMPLEMENTATION
 namespace WTF { template <typename T> class PassRefPtr; }
-namespace WebCore { class DeviceOrientation; }
+namespace WebCore { class DeviceOrientationData; }
 #endif
 
 namespace WebKit {
@@ -86,9 +86,9 @@ public:
     bool absolute() const { return m_absolute; }
 
 #if WEBKIT_IMPLEMENTATION
-    WebDeviceOrientation(const WebCore::DeviceOrientation*);
-    WebDeviceOrientation& operator=(const WebCore::DeviceOrientation*);
-    operator WTF::PassRefPtr<WebCore::DeviceOrientation>() const;
+    WebDeviceOrientation(const WebCore::DeviceOrientationData*);
+    WebDeviceOrientation& operator=(const WebCore::DeviceOrientationData*);
+    operator WTF::PassRefPtr<WebCore::DeviceOrientationData>() const;
 #endif
 
 private:
diff --git a/Source/WebKit/chromium/public/WebIDBKey.h b/Source/WebKit/chromium/public/WebIDBKey.h
index a78142345..0b704cac2 100644
--- a/Source/WebKit/chromium/public/WebIDBKey.h
+++ b/Source/WebKit/chromium/public/WebIDBKey.h
@@ -79,6 +79,7 @@ public:
     };
 
     WEBKIT_EXPORT Type type() const;
+    WEBKIT_EXPORT bool isValid() const;
     WEBKIT_EXPORT WebVector<WebIDBKey> array() const; // Only valid for ArrayType.
     WEBKIT_EXPORT WebString string() const; // Only valid for StringType.
     WEBKIT_EXPORT double date() const; // Only valid for DateType.
diff --git a/Source/WebKit/chromium/public/WebIDBMetadata.h b/Source/WebKit/chromium/public/WebIDBMetadata.h
index 410d9facf..1c33d1b08 100644
--- a/Source/WebKit/chromium/public/WebIDBMetadata.h
+++ b/Source/WebKit/chromium/public/WebIDBMetadata.h
@@ -31,6 +31,10 @@
 #include "platform/WebString.h"
 #include "platform/WebVector.h"
 
+namespace WebCore {
+struct IDBDatabaseMetadata;
+}
+
 namespace WebKit {
 
 struct WebIDBMetadata {
@@ -62,6 +66,11 @@ struct WebIDBMetadata {
             , unique(false)
             , multiEntry(false) { }
     };
+
+#if WEBKIT_IMPLEMENTATION
+    WebIDBMetadata(const WebCore::IDBDatabaseMetadata&);
+    operator WebCore::IDBDatabaseMetadata() const;
+#endif
 };
 
 
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index 0af426e50..d9b3232a0 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -73,6 +73,7 @@ public:
     };
 
     virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Remove the following overload when all callers are updated.
     virtual void deleteFunction(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index 777431fb0..99f078fd6 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -107,6 +107,9 @@ public:
     // content. The rectangle is in the plugin's coordinate system.
     virtual bool isRectTopmost(const WebRect&) = 0;
 
+    // Notifies when the plugin starts/stops accepting touch events.
+    virtual void setIsAcceptingTouchEvents(bool) = 0;
+
     virtual WebPlugin* plugin() = 0;
     virtual void setPlugin(WebPlugin*) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 0528d8ef4..5ec5c50da 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -105,6 +105,7 @@ public:
     virtual void setExperimentalCSSRegionsEnabled(bool) = 0;
     virtual void setExperimentalCSSGridLayoutEnabled(bool) = 0;
     virtual void setExperimentalCSSCustomFilterEnabled(bool) = 0;
+    virtual void setExperimentalCSSVariablesEnabled(bool) = 0;
     virtual void setOpenGLMultisamplingEnabled(bool) = 0;
     virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
     virtual void setWebGLErrorsToConsoleEnabled(bool) = 0;
@@ -154,6 +155,7 @@ public:
     virtual void setMaxUntiledLayerSize(WebSize) = 0;
     virtual void setFixedPositionCreatesStackingContext(bool) = 0;
     virtual void setSyncXHRInDocumentsEnabled(bool) = 0;
+    virtual void setCookieEnabled(bool) = 0;
 
     virtual bool forceSoftwareCompositing() const = 0;
 
diff --git a/Source/WebKit/chromium/public/WebSpeechRecognitionParams.h b/Source/WebKit/chromium/public/WebSpeechRecognitionParams.h
index 562bfa0c4..96eecd994 100644
--- a/Source/WebKit/chromium/public/WebSpeechRecognitionParams.h
+++ b/Source/WebKit/chromium/public/WebSpeechRecognitionParams.h
@@ -37,10 +37,11 @@ class WebSpeechGrammar;
 
 class WebSpeechRecognitionParams {
 public:
-    WebSpeechRecognitionParams(const WebVector<WebSpeechGrammar>& grammars, const WebString& language, bool continuous, const WebSecurityOrigin& origin)
+    WebSpeechRecognitionParams(const WebVector<WebSpeechGrammar>& grammars, const WebString& language, bool continuous, unsigned long maxAlternatives, const WebSecurityOrigin& origin)
         : m_grammars(grammars)
         , m_language(language)
         , m_continuous(continuous)
+        , m_maxAlternatives(maxAlternatives)
         , m_origin(origin)
     {
     }
@@ -48,12 +49,14 @@ public:
     const WebVector<WebSpeechGrammar>& grammars() const { return m_grammars; }
     const WebString& language() const { return m_language; }
     bool continuous() const { return m_continuous; }
+    unsigned long maxAlternatives() const { return m_maxAlternatives; }
     const WebSecurityOrigin& origin() const { return m_origin; }
 
 private:
     WebVector<WebSpeechGrammar> m_grammars;
     WebString m_language;
     bool m_continuous;
+    unsigned long m_maxAlternatives;
     WebSecurityOrigin m_origin;
 };
 
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 542b1021a..c15298204 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -191,6 +191,10 @@ public:
     // window space.
     virtual void scrollFocusedNodeIntoRect(const WebRect&) { }
 
+    // Advance the focus of the WebView forward to the next element or to the
+    // previous element in the tab sequence (if reverse is true).
+    virtual void advanceFocus(bool reverse) { }
+
 
     // Zoom ----------------------------------------------------------------
 
@@ -453,6 +457,8 @@ public:
     // by the compositor) but must be completed by the WebView.
     virtual void transferActiveWheelFlingAnimation(const WebActiveWheelFlingParameters&) = 0;
 
+    virtual bool setEditableSelectionOffsets(int start, int end) = 0;
+
     // Visibility -----------------------------------------------------------
 
     // Sets the visibility of the WebView.
diff --git a/Source/WebKit/chromium/src/ApplicationCacheHost.cpp b/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
index bbf740dfd..2b6a47707 100644
--- a/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/Source/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -299,7 +299,8 @@ bool ApplicationCacheHost::swapCache()
 
 void ApplicationCacheHost::abort()
 {
-    // FIXME: See https://bugs.webkit.org/show_bug.cgi?id=76270
+    if (m_internal)
+        m_internal->m_outerHost->abort();
 }
 
 bool ApplicationCacheHost::isApplicationCacheEnabled()
diff --git a/Source/WebKit/chromium/src/DeviceOrientationClientProxy.cpp b/Source/WebKit/chromium/src/DeviceOrientationClientProxy.cpp
index 29b43ba56..f1f0b33f9 100644
--- a/Source/WebKit/chromium/src/DeviceOrientationClientProxy.cpp
+++ b/Source/WebKit/chromium/src/DeviceOrientationClientProxy.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "DeviceOrientationClientProxy.h"
 
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 #include "WebDeviceOrientation.h"
 #include "WebDeviceOrientationController.h"
 #include <wtf/OwnPtr.h>
@@ -60,12 +60,12 @@ void DeviceOrientationClientProxy::stopUpdating()
     m_client->stopUpdating();
 }
 
-WebCore::DeviceOrientation* DeviceOrientationClientProxy::lastOrientation() const
+WebCore::DeviceOrientationData* DeviceOrientationClientProxy::lastOrientation() const
 {
     if (!m_client)
         return 0;
 
-    // Cache the DeviceOrientation pointer so its reference count does not drop to zero upon return.
+    // Cache the DeviceOrientationData pointer so its reference count does not drop to zero upon return.
     m_lastOrientation = m_client->lastOrientation();
 
     return m_lastOrientation.get();
diff --git a/Source/WebKit/chromium/src/DeviceOrientationClientProxy.h b/Source/WebKit/chromium/src/DeviceOrientationClientProxy.h
index 73fd3e2a0..eddb3d29d 100644
--- a/Source/WebKit/chromium/src/DeviceOrientationClientProxy.h
+++ b/Source/WebKit/chromium/src/DeviceOrientationClientProxy.h
@@ -26,8 +26,8 @@
 #ifndef DeviceOrientationClientProxy_h
 #define DeviceOrientationClientProxy_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 #include "WebDeviceOrientationClient.h"
 #include <wtf/RefPtr.h>
 
@@ -47,12 +47,12 @@ public:
     virtual void setController(WebCore::DeviceOrientationController*) OVERRIDE;
     virtual void startUpdating() OVERRIDE;
     virtual void stopUpdating() OVERRIDE;
-    virtual WebCore::DeviceOrientation* lastOrientation() const OVERRIDE;
+    virtual WebCore::DeviceOrientationData* lastOrientation() const OVERRIDE;
     virtual void deviceOrientationControllerDestroyed() OVERRIDE;
 
 private:
     WebDeviceOrientationClient* m_client;
-    mutable RefPtr<WebCore::DeviceOrientation> m_lastOrientation;
+    mutable RefPtr<WebCore::DeviceOrientationData> m_lastOrientation;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index 58661ebab..107ec63b3 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -31,6 +31,7 @@
 #include "DOMStringList.h"
 #include "IDBCallbacks.h"
 #include "IDBDatabaseCallbacks.h"
+#include "IDBMetadata.h"
 #include "IDBObjectStoreBackendProxy.h"
 #include "IDBTransactionBackendProxy.h"
 #include "WebDOMStringList.h"
@@ -60,6 +61,11 @@ IDBDatabaseBackendProxy::~IDBDatabaseBackendProxy()
 {
 }
 
+IDBDatabaseMetadata IDBDatabaseBackendProxy::metadata() const
+{
+    return m_webIDBDatabase->metadata();
+}
+
 String IDBDatabaseBackendProxy::name() const
 {
     return m_webIDBDatabase->name();
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index e817edf19..b05552ccb 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -42,6 +42,7 @@ public:
     static PassRefPtr<WebCore::IDBDatabaseBackendInterface> create(PassOwnPtr<WebIDBDatabase>);
     virtual ~IDBDatabaseBackendProxy();
 
+    virtual WebCore::IDBDatabaseMetadata metadata() const;
     virtual String name() const;
     virtual String version() const;
     virtual PassRefPtr<WebCore::DOMStringList> objectStoreNames() const;
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index c03b2f13b..9ca777bc9 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -95,14 +95,6 @@ void IDBObjectStoreBackendProxy::put(PassRefPtr<SerializedScriptValue> value, Pa
     m_webIDBObjectStore->put(value, key, static_cast<WebIDBObjectStore::PutMode>(putMode), new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
-{
-    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
-    // all implementations of IDB interfaces are proxy objects.
-    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->deleteFunction(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
-}
-
 void IDBObjectStoreBackendProxy::deleteFunction(PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
index 5d6796c64..c6da74cf1 100644
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -50,7 +50,6 @@ public:
 
     virtual void get(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
-    virtual void deleteFunction(PassRefPtr<WebCore::IDBKey>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void clear(PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
 
diff --git a/Source/WebKit/chromium/src/InspectorClientImpl.h b/Source/WebKit/chromium/src/InspectorClientImpl.h
index 6cb5c5544..5ea6baeb3 100644
--- a/Source/WebKit/chromium/src/InspectorClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorClientImpl.h
@@ -59,6 +59,7 @@ public:
 
     virtual bool sendMessageToFrontend(const WTF::String&);
 
+    virtual bool supportsInspectorStateUpdates() const { return true; }
     virtual void updateInspectorStateCookie(const WTF::String&);
 
     virtual bool canClearBrowserCache();
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
index cd35b2620..0888e3033 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
@@ -55,13 +55,13 @@ PassOwnPtr<SpeechRecognitionClientProxy> SpeechRecognitionClientProxy::create(We
     return adoptPtr(new SpeechRecognitionClientProxy(recognizer));
 }
 
-void SpeechRecognitionClientProxy::start(SpeechRecognition* recognition, const SpeechGrammarList* grammarList, const String& lang, bool continuous)
+void SpeechRecognitionClientProxy::start(SpeechRecognition* recognition, const SpeechGrammarList* grammarList, const String& lang, bool continuous, unsigned long maxAlternatives)
 {
     WebVector<WebSpeechGrammar> webSpeechGrammars(static_cast<size_t>(grammarList->length()));
     for (unsigned long i = 0; i < grammarList->length(); ++i)
         webSpeechGrammars[i] = grammarList->item(i);
 
-    WebSpeechRecognitionParams params(webSpeechGrammars, lang, continuous, WebSecurityOrigin(recognition->scriptExecutionContext()->securityOrigin()));
+    WebSpeechRecognitionParams params(webSpeechGrammars, lang, continuous, maxAlternatives, WebSecurityOrigin(recognition->scriptExecutionContext()->securityOrigin()));
     m_recognizer->start(WebSpeechRecognitionHandle(recognition), params, this);
 }
 
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
index 0c3ecebaa..8063e71ed 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
@@ -46,7 +46,7 @@ public:
     static PassOwnPtr<SpeechRecognitionClientProxy> create(WebSpeechRecognizer*);
 
     // WebCore::SpeechRecognitionClient:
-    virtual void start(WebCore::SpeechRecognition*, const WebCore::SpeechGrammarList*, const String& lang, bool continuous) OVERRIDE;
+    virtual void start(WebCore::SpeechRecognition*, const WebCore::SpeechGrammarList*, const String& lang, bool continuous, unsigned long maxAlternatives) OVERRIDE;
     virtual void stop(WebCore::SpeechRecognition*) OVERRIDE;
     virtual void abort(WebCore::SpeechRecognition*) OVERRIDE;
 
diff --git a/Source/WebKit/chromium/src/WebCompositorImpl.cpp b/Source/WebKit/chromium/src/WebCompositorImpl.cpp
index f4e96e0be..369ae555a 100644
--- a/Source/WebKit/chromium/src/WebCompositorImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorImpl.cpp
@@ -28,6 +28,7 @@
 #include "WebCompositorImpl.h"
 
 #include "CCThreadImpl.h"
+#include "GraphicsContext3D.h"
 #include "WebKit.h"
 #include "platform/WebKitPlatformSupport.h"
 #include "WebCompositorClient.h"
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
index edbee1471..6b5247617 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.h
@@ -94,6 +94,7 @@ public:
     virtual void bringFrontendToFront();
     virtual void highlight();
     virtual void hideHighlight();
+    virtual bool supportsInspectorStateUpdates() const { return true; }
     virtual void updateInspectorStateCookie(const WTF::String&);
     virtual bool sendMessageToFrontend(const WTF::String&);
 
diff --git a/Source/WebKit/chromium/src/WebDeviceOrientation.cpp b/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
index d7a282f35..24f7bc801 100644
--- a/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
+++ b/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "WebDeviceOrientation.h"
 
-#include "DeviceOrientation.h"
+#include "DeviceOrientationData.h"
 #include <wtf/PassRefPtr.h>
 
 namespace WebKit {
 
-WebDeviceOrientation::WebDeviceOrientation(const WebCore::DeviceOrientation* orientation)
+WebDeviceOrientation::WebDeviceOrientation(const WebCore::DeviceOrientationData* orientation)
 {
     if (!orientation) {
         m_isNull = true;
@@ -57,7 +57,7 @@ WebDeviceOrientation::WebDeviceOrientation(const WebCore::DeviceOrientation* ori
     m_absolute = orientation->absolute();
 }
 
-WebDeviceOrientation& WebDeviceOrientation::operator=(const WebCore::DeviceOrientation* orientation)
+WebDeviceOrientation& WebDeviceOrientation::operator=(const WebCore::DeviceOrientationData* orientation)
 {
     if (!orientation) {
         m_isNull = true;
@@ -84,11 +84,11 @@ WebDeviceOrientation& WebDeviceOrientation::operator=(const WebCore::DeviceOrien
     return *this;
 }
 
-WebDeviceOrientation::operator PassRefPtr<WebCore::DeviceOrientation>() const
+WebDeviceOrientation::operator PassRefPtr<WebCore::DeviceOrientationData>() const
 {
     if (m_isNull)
         return 0;
-    return WebCore::DeviceOrientation::create(m_canProvideAlpha, m_alpha, m_canProvideBeta, m_beta, m_canProvideGamma, m_gamma, m_canProvideAbsolute, m_absolute);
+    return WebCore::DeviceOrientationData::create(m_canProvideAlpha, m_alpha, m_canProvideBeta, m_beta, m_canProvideGamma, m_gamma, m_canProvideAbsolute, m_absolute);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebDeviceOrientationController.cpp b/Source/WebKit/chromium/src/WebDeviceOrientationController.cpp
index 7d09a6e7d..0b9ee88e9 100644
--- a/Source/WebKit/chromium/src/WebDeviceOrientationController.cpp
+++ b/Source/WebKit/chromium/src/WebDeviceOrientationController.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "WebDeviceOrientationController.h"
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationController.h"
+#include "DeviceOrientationData.h"
 #include "WebDeviceOrientation.h"
 #include <wtf/PassRefPtr.h>
 
@@ -35,7 +35,7 @@ namespace WebKit {
 
 void WebDeviceOrientationController::didChangeDeviceOrientation(const WebDeviceOrientation& orientation)
 {
-    RefPtr<WebCore::DeviceOrientation> deviceOrientation = PassRefPtr<WebCore::DeviceOrientation>(orientation);
+    RefPtr<WebCore::DeviceOrientationData> deviceOrientation = PassRefPtr<WebCore::DeviceOrientationData>(orientation);
     m_controller->didChangeDeviceOrientation(deviceOrientation.get());
 }
 
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 88fd9f61d..8ccec72b1 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -1162,7 +1162,7 @@ void WebFrameImpl::replaceSelection(const WebString& text)
 {
     bool selectReplacement = false;
     bool smartReplace = true;
-    return frame()->editor()->replaceSelectionWithText(text, selectReplacement, smartReplace);
+    frame()->editor()->replaceSelectionWithText(text, selectReplacement, smartReplace);
 }
 
 void WebFrameImpl::insertText(const WebString& text)
diff --git a/Source/WebKit/chromium/src/WebHistoryItem.cpp b/Source/WebKit/chromium/src/WebHistoryItem.cpp
index 27dbc44c2..db35317ad 100644
--- a/Source/WebKit/chromium/src/WebHistoryItem.cpp
+++ b/Source/WebKit/chromium/src/WebHistoryItem.cpp
@@ -173,7 +173,7 @@ float WebHistoryItem::pageScaleFactor() const
 void WebHistoryItem::setPageScaleFactor(float scale)
 {
     ensureMutable();
-    return m_private->setPageScaleFactor(scale);
+    m_private->setPageScaleFactor(scale);
 }
 
 bool WebHistoryItem::isTargetItem() const
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 2662f801f..39803e145 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -32,9 +32,11 @@
 #include "IDBCallbacksProxy.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseCallbacksProxy.h"
+#include "IDBMetadata.h"
 #include "IDBTransactionBackendInterface.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBDatabaseCallbacks.h"
+#include "WebIDBMetadata.h"
 #include "WebIDBObjectStoreImpl.h"
 #include "WebIDBTransactionImpl.h"
 
@@ -51,6 +53,11 @@ WebIDBDatabaseImpl::~WebIDBDatabaseImpl()
 {
 }
 
+WebIDBMetadata WebIDBDatabaseImpl::metadata() const
+{
+    return m_databaseBackend->metadata();
+}
+
 WebString WebIDBDatabaseImpl::name() const
 {
     return m_databaseBackend->name();
diff --git a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
index 190d7e2dc..5e989e00e 100644
--- a/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -40,6 +40,7 @@ namespace WebKit {
 
 class IDBDatabaseCallbacksProxy;
 class WebIDBDatabaseCallbacks;
+class WebIDBDatabaseMetadata;
 class WebIDBObjectStore;
 class WebIDBTransaction;
 
@@ -49,6 +50,7 @@ public:
     WebIDBDatabaseImpl(WTF::PassRefPtr<WebCore::IDBDatabaseBackendInterface>);
     virtual ~WebIDBDatabaseImpl();
 
+    virtual WebIDBMetadata metadata() const;
     virtual WebString name() const;
     virtual WebString version() const;
     virtual WebDOMStringList objectStoreNames() const;
diff --git a/Source/WebKit/chromium/src/WebIDBKey.cpp b/Source/WebKit/chromium/src/WebIDBKey.cpp
index 25be6c52f..cfadafbac 100644
--- a/Source/WebKit/chromium/src/WebIDBKey.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKey.cpp
@@ -120,6 +120,8 @@ static PassRefPtr<IDBKey> convertFromWebIDBKeyArray(const WebVector<WebIDBKey>&
             keys.append(IDBKey::createNumber(array[i].number()));
             break;
         case WebIDBKey::InvalidType:
+            keys.append(IDBKey::createInvalid());
+            break;
         case WebIDBKey::NullType:
             ASSERT_NOT_REACHED();
             break;
@@ -149,6 +151,8 @@ static void convertToWebIDBKeyArray(const IDBKey::KeyArray& array, WebVector<Web
             keys[i] = WebIDBKey::createNumber(key->number());
             break;
         case IDBKey::InvalidType:
+            keys[i] = WebIDBKey::createInvalid();
+            break;
         case IDBKey::MinType:
             ASSERT_NOT_REACHED();
             break;
@@ -199,6 +203,13 @@ WebIDBKey::Type WebIDBKey::type() const
     return Type(m_private->type());
 }
 
+bool WebIDBKey::isValid() const
+{
+    if (!m_private.get())
+        return false;
+    return m_private->isValid();
+}
+
 WebVector<WebIDBKey> WebIDBKey::array() const
 {
     WebVector<WebIDBKey> keys;
diff --git a/Source/WebKit/chromium/src/WebIDBKeyRange.cpp b/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
index fef0d3c3d..419261c22 100644
--- a/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
+++ b/Source/WebKit/chromium/src/WebIDBKeyRange.cpp
@@ -43,7 +43,7 @@ void WebIDBKeyRange::assign(const WebIDBKeyRange& other)
 
 void WebIDBKeyRange::assign(const WebIDBKey& lower, const WebIDBKey& upper, bool lowerOpen, bool upperOpen)
 {
-    if (lower.type() == WebIDBKey::InvalidType && upper.type() == WebIDBKey::InvalidType)
+    if (!lower.isValid() && !upper.isValid())
         m_private = 0;
     else
         m_private = IDBKeyRange::create(lower, upper, lowerOpen ? IDBKeyRange::LowerBoundOpen : IDBKeyRange::LowerBoundClosed, upperOpen ? IDBKeyRange::UpperBoundOpen : IDBKeyRange::UpperBoundClosed);
diff --git a/Source/WebKit/chromium/src/WebIDBMetadata.cpp b/Source/WebKit/chromium/src/WebIDBMetadata.cpp
new file mode 100644
index 000000000..735063ef0
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebIDBMetadata.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebIDBMetadata.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBMetadata.h"
+#include "WebIDBKeyPath.h"
+#include "platform/WebString.h"
+#include "platform/WebVector.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebIDBMetadata::WebIDBMetadata(const WebCore::IDBDatabaseMetadata& metadata)
+{
+    name = metadata.name;
+    version = metadata.version;
+    objectStores = WebVector<ObjectStore>(static_cast<size_t>(metadata.objectStores.size()));
+
+    size_t i = 0;
+    for (IDBDatabaseMetadata::ObjectStoreMap::const_iterator storeIterator = metadata.objectStores.begin(); storeIterator != metadata.objectStores.end(); ++storeIterator) {
+        const IDBObjectStoreMetadata& objectStore = storeIterator->second;
+        ObjectStore webObjectStore;
+        webObjectStore.name = objectStore.name;
+        webObjectStore.keyPath = objectStore.keyPath;
+        webObjectStore.autoIncrement = objectStore.autoIncrement;
+        webObjectStore.indexes = WebVector<Index>(static_cast<size_t>(objectStore.indexes.size()));
+
+        size_t j = 0;
+        for (IDBObjectStoreMetadata::IndexMap::const_iterator indexIterator = objectStore.indexes.begin(); indexIterator != objectStore.indexes.end(); ++indexIterator) {
+            const IDBIndexMetadata& index = indexIterator->second;
+            Index webIndex;
+            webIndex.name = index.name;
+            webIndex.keyPath = index.keyPath;
+            webIndex.unique = index.unique;
+            webIndex.multiEntry = index.multiEntry;
+            webObjectStore.indexes[j++] = webIndex;
+        }
+        objectStores[i++] = webObjectStore;
+    }
+}
+
+WebIDBMetadata::operator IDBDatabaseMetadata() const
+{
+    IDBDatabaseMetadata db(name, version);
+    for (size_t i = 0; i < objectStores.size(); ++i) {
+        const ObjectStore webObjectStore = objectStores[i];
+        IDBObjectStoreMetadata objectStore(webObjectStore.name, webObjectStore.keyPath, webObjectStore.autoIncrement);
+
+        for (size_t j = 0; j < webObjectStore.indexes.size(); ++j) {
+            const Index webIndex = webObjectStore.indexes[j];
+            IDBIndexMetadata index(webIndex.name, webIndex.keyPath, webIndex.unique, webIndex.multiEntry);
+            objectStore.indexes.set(index.name, index);
+        }
+        db.objectStores.set(objectStore.name, objectStore);
+    }
+    return db;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index ebd7ae945..4c45be2f9 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -83,11 +83,6 @@ void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const Web
     m_objectStore->put(value, key, static_cast<IDBObjectStoreBackendInterface::PutMode>(putMode), IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
-{
-    m_objectStore->deleteFunction(key, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
-}
-
 void WebIDBObjectStoreImpl::deleteFunction(const WebIDBKeyRange& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
     m_objectStore->deleteFunction(keyRange, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 91aee7833..1bffd562b 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -52,7 +52,6 @@ public:
 
     void get(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
-    void deleteFunction(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
     void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
diff --git a/Source/WebKit/chromium/src/WebImageLayer.cpp b/Source/WebKit/chromium/src/WebImageLayer.cpp
index 93dbf3930..f76151530 100644
--- a/Source/WebKit/chromium/src/WebImageLayer.cpp
+++ b/Source/WebKit/chromium/src/WebImageLayer.cpp
@@ -42,7 +42,7 @@ WebImageLayer::WebImageLayer(PassRefPtr<WebCore::ImageLayerChromium> layer)
 
 void WebImageLayer::setBitmap(SkBitmap bitmap)
 {
-    return unwrap<WebCore::ImageLayerChromium>()->setBitmap(bitmap);
+    unwrap<WebCore::ImageLayerChromium>()->setBitmap(bitmap);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayer.cpp b/Source/WebKit/chromium/src/WebLayer.cpp
index 6b1029814..25cb5868c 100644
--- a/Source/WebKit/chromium/src/WebLayer.cpp
+++ b/Source/WebKit/chromium/src/WebLayer.cpp
@@ -187,7 +187,7 @@ bool WebLayer::masksToBounds() const
 void WebLayer::setMaskLayer(const WebLayer& maskLayer)
 {
     WebLayer ref = maskLayer;
-    return m_private->setMaskLayer(ref.unwrap<LayerChromium>());
+    m_private->setMaskLayer(ref.unwrap<LayerChromium>());
 }
 
 WebLayer WebLayer::maskLayer() const
@@ -270,6 +270,11 @@ void WebLayer::setPreserves3D(bool preserve3D)
     m_private->setPreserves3D(preserve3D);
 }
 
+void WebLayer::setUseParentBackfaceVisibility(bool useParentBackfaceVisibility)
+{
+    m_private->setUseParentBackfaceVisibility(useParentBackfaceVisibility);
+}
+
 void WebLayer::setBackgroundColor(WebColor color)
 {
     m_private->setBackgroundColor(color);
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index 47cc88310..356af1de2 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -27,7 +27,9 @@
 #include "platform/WebLayerTreeView.h"
 
 #include "GraphicsContext3DPrivate.h"
+#include "LayerChromium.h"
 #include "WebLayerTreeViewImpl.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
 #include "platform/WebLayer.h"
 #include "platform/WebPoint.h"
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 95186dd86..3ca9f5d0f 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -803,11 +803,13 @@ void WebMediaPlayerClientImpl::getSupportedTypes(HashSet<String>& supportedTypes
 #if ENABLE(ENCRYPTED_MEDIA)
 MediaPlayer::SupportsType WebMediaPlayerClientImpl::supportsType(const String& type,
                                                                  const String& codecs,
-                                                                 const String& keySystem)
+                                                                 const String& keySystem,
+                                                                 const KURL&)
 {
 #else
 MediaPlayer::SupportsType WebMediaPlayerClientImpl::supportsType(const String& type,
-                                                                 const String& codecs)
+                                                                 const String& codecs,
+                                                                 const KURL&)
 {
     String keySystem;
 #endif
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index 53a24d666..b3c94fe58 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -186,10 +186,10 @@ private:
     static void getSupportedTypes(WTF::HashSet<WTF::String>&);
 #if ENABLE(ENCRYPTED_MEDIA)
     static WebCore::MediaPlayer::SupportsType supportsType(
-        const WTF::String& type, const WTF::String& codecs, const String& keySystem);
+        const WTF::String& type, const WTF::String& codecs, const String& keySystem, const WebCore::KURL&);
 #else
     static WebCore::MediaPlayer::SupportsType supportsType(
-        const WTF::String& type, const WTF::String& codecs);
+        const WTF::String& type, const WTF::String& codecs, const WebCore::KURL&);
 #endif
 #if USE(ACCELERATED_COMPOSITING)
     bool acceleratedRenderingInUse();
diff --git a/Source/WebKit/chromium/src/WebOptionElement.cpp b/Source/WebKit/chromium/src/WebOptionElement.cpp
index c71f7b565..1d50a053e 100644
--- a/Source/WebKit/chromium/src/WebOptionElement.cpp
+++ b/Source/WebKit/chromium/src/WebOptionElement.cpp
@@ -44,7 +44,7 @@ namespace WebKit {
 
 void WebOptionElement::setValue(const WebString& newValue)
 {
-    return unwrap<HTMLOptionElement>()->setValue(newValue);
+    unwrap<HTMLOptionElement>()->setValue(newValue);
 }
 
 WebString WebOptionElement::value() const
@@ -69,7 +69,7 @@ bool WebOptionElement::defaultSelected() const
 
 void WebOptionElement::setDefaultSelected(bool newSelected)
 {
-    return unwrap<HTMLOptionElement>()->setAttribute(selectedAttr, newSelected ? "" : 0);
+    unwrap<HTMLOptionElement>()->setAttribute(selectedAttr, newSelected ? "" : 0);
 }
 
 WebString WebOptionElement::label() const
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index e10e0ae81..040eb6384 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -71,6 +71,7 @@
 #include "ScrollAnimator.h"
 #include "ScrollView.h"
 #include "ScrollbarTheme.h"
+#include "TouchEvent.h"
 #include "UserGestureIndicator.h"
 #include "WebPrintParams.h"
 #include "WheelEvent.h"
@@ -185,6 +186,8 @@ void WebPluginContainerImpl::handleEvent(Event* event)
         handleWheelEvent(static_cast<WheelEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+    else if (eventNames().isTouchEventType(event->type()))
+        handleTouchEvent(static_cast<TouchEvent*>(event));
 
     // FIXME: it would be cleaner if Widget::handleEvent returned true/false and
     // HTMLPluginElement called setDefaultHandled or defaultEventHandler.
@@ -461,8 +464,8 @@ void WebPluginContainerImpl::setOpaque(bool opaque)
 
 bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
 {
-    Page* page = m_element->document()->page();
-    if (!page)
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
         return false;
 
     // hitTestResultAtPoint() takes a padding rectangle.
@@ -471,14 +474,25 @@ bool WebPluginContainerImpl::isRectTopmost(const WebRect& rect)
     LayoutPoint center = documentRect.center();
     // Make the rect we're checking (the point surrounded by padding rects) contained inside the requested rect. (Note that -1/2 is 0.)
     LayoutSize padding((documentRect.width() - 1) / 2, (documentRect.height() - 1) / 2);
-    HitTestResult result =
-        page->mainFrame()->eventHandler()->hitTestResultAtPoint(center, false, false, DontHitTestScrollbars, HitTestRequest::ReadOnly | HitTestRequest::Active, padding);
+    HitTestResult result = frame->eventHandler()->hitTestResultAtPoint(center, false, false, DontHitTestScrollbars, HitTestRequest::ReadOnly | HitTestRequest::Active, padding);
     const HitTestResult::NodeSet& nodes = result.rectBasedTestResult();
     if (nodes.size() != 1)
         return false;
     return (nodes.first().get() == m_element);
 }
 
+void WebPluginContainerImpl::setIsAcceptingTouchEvents(bool acceptingTouchEvents)
+{
+    if (m_isAcceptingTouchEvents == acceptingTouchEvents)
+        return;
+    m_isAcceptingTouchEvents = acceptingTouchEvents;
+    if (m_isAcceptingTouchEvents) {
+        m_element->document()->didAddTouchEventHandler();
+        m_element->document()->addListenerType(Document::TOUCH_LISTENER);
+    } else
+        m_element->document()->didRemoveTouchEventHandler();
+}
+
 void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
 {
     // Make sure that the plugin receives window geometry before data, or else
@@ -577,11 +591,15 @@ WebPluginContainerImpl::WebPluginContainerImpl(WebCore::HTMLPlugInElement* eleme
     , m_textureId(0)
     , m_ioSurfaceId(0)
 #endif
+    , m_isAcceptingTouchEvents(false)
 {
 }
 
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
+    if (m_isAcceptingTouchEvents)
+        m_element->document()->didRemoveTouchEventHandler();
+
     for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
         m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
@@ -683,6 +701,17 @@ void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
         event->setDefaultHandled();
 }
 
+void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
+{
+    WebTouchEventBuilder webEvent(this, *event);
+    if (webEvent.type == WebInputEvent::Undefined)
+        return;
+    WebCursorInfo cursorInfo;
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+        event->setDefaultHandled();
+    // FIXME: Can a plugin change the cursor from a touch-event callback?
+}
+
 void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
                                                IntRect& windowRect,
                                                IntRect& clipRect,
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 415cc544b..a151f7090 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -52,6 +52,7 @@ class LayerChromium;
 class MouseEvent;
 class ResourceError;
 class ResourceResponse;
+class TouchEvent;
 class WheelEvent;
 
 #if ENABLE(GESTURE_EVENTS)
@@ -109,6 +110,7 @@ public:
     virtual void zoomLevelChanged(double zoomLevel);    
     virtual void setOpaque(bool);
     virtual bool isRectTopmost(const WebRect&);
+    virtual void setIsAcceptingTouchEvents(bool);
 
     // This cannot be null.
     WebPlugin* plugin() { return m_webPlugin; }
@@ -160,6 +162,7 @@ private:
     void handleMouseEvent(WebCore::MouseEvent*);
     void handleWheelEvent(WebCore::WheelEvent*);
     void handleKeyboardEvent(WebCore::KeyboardEvent*);
+    void handleTouchEvent(WebCore::TouchEvent*);
 
     void calculateGeometry(const WebCore::IntRect& frameRect,
                            WebCore::IntRect& windowRect,
@@ -186,6 +189,8 @@ private:
     // The associated scrollbar group object, created lazily. Used for Pepper
     // scrollbars.
     OwnPtr<ScrollbarGroup> m_scrollbarGroup;
+
+    bool m_isAcceptingTouchEvents;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 5f8776b58..e4d3ad835 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -338,6 +338,11 @@ void WebSettingsImpl::setExperimentalCSSCustomFilterEnabled(bool enabled)
     m_settings->setCSSCustomFilterEnabled(enabled);
 }
 
+void WebSettingsImpl::setExperimentalCSSVariablesEnabled(bool enabled)
+{
+    m_settings->setCSSVariablesEnabled(enabled);
+}
+
 void WebSettingsImpl::setOpenGLMultisamplingEnabled(bool enabled)
 {
     m_settings->setOpenGLMultisamplingEnabled(enabled);
@@ -622,5 +627,9 @@ void WebSettingsImpl::setSyncXHRInDocumentsEnabled(bool enabled)
     m_settings->setSyncXHRInDocumentsEnabled(enabled);
 }
 
+void WebSettingsImpl::setCookieEnabled(bool enabled)
+{
+    m_settings->setCookieEnabled(enabled);
+}
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 2b58c0443..ddd89114f 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -97,6 +97,7 @@ public:
     virtual void setExperimentalCSSRegionsEnabled(bool);
     virtual void setExperimentalCSSGridLayoutEnabled(bool);
     virtual void setExperimentalCSSCustomFilterEnabled(bool);
+    virtual void setExperimentalCSSVariablesEnabled(bool);
     virtual void setOpenGLMultisamplingEnabled(bool);
     virtual void setPrivilegedWebGLExtensionsEnabled(bool);
     virtual void setWebGLErrorsToConsoleEnabled(bool);
@@ -149,6 +150,7 @@ public:
     virtual void setMediaPlaybackRequiresUserGesture(bool);
     virtual bool viewportEnabled() const { return m_viewportEnabled; }
     virtual void setSyncXHRInDocumentsEnabled(bool);
+    virtual void setCookieEnabled(bool);
 
     bool showFPSCounter() const { return m_showFPSCounter; }
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 67b7c041e..d2393c31c 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -1351,10 +1351,28 @@ void WebViewImpl::resize(const WebSize& newSize)
 {
     if (m_shouldAutoResize || m_size == newSize)
         return;
+
+    FrameView* view = mainFrameImpl()->frameView();
+    if (!view)
+        return;
+
+    WebSize oldSize = m_size;
+    float oldPageScaleFactor = pageScaleFactor();
+    IntSize oldScrollOffset = view->scrollOffset();
+    int oldFixedLayoutWidth = fixedLayoutSize().width;
+
     m_size = newSize;
 
 #if ENABLE(VIEWPORT)
     if (settings()->viewportEnabled()) {
+        // Fallback width is used to layout sites designed for desktop. The
+        // conventional size used by all mobile browsers is 980. When a mobile
+        // device has a particularly wide screen (such as a 10" tablet held in
+        // landscape), it can be larger.
+        const int standardFallbackWidth = 980;
+        int dpiIndependentViewportWidth = newSize.width / page()->deviceScaleFactor();
+        settings()->setLayoutFallbackWidth(std::max(standardFallbackWidth, dpiIndependentViewportWidth));
+
         ViewportArguments viewportArguments = mainFrameImpl()->frame()->document()->viewportArguments();
         m_page->chrome()->client()->dispatchViewportPropertiesDidChange(viewportArguments);
     }
@@ -1369,6 +1387,33 @@ void WebViewImpl::resize(const WebSize& newSize)
             webFrame->frameView()->resize(newSize.width, newSize.height);
     }
 
+#if ENABLE(VIEWPORT)
+    if (settings()->viewportEnabled()) {
+        // Relayout immediately to obtain the new content width, which is needed
+        // to calculate the minimum scale limit.
+        view->layout();
+        computePageScaleFactorLimits();
+        // When the device rotates:
+        // - If the page width is unchanged, then zoom by new width/old width
+        //   such as to keep the same content horizontally onscreen.
+        // - If the page width stretches proportionally to the change in
+        //   screen width, then don't zoom at all (assuming the content has
+        //   scaled uniformly, then the same content will be horizontally
+        //   onscreen).
+        //   - If the page width partially stretches, then zoom partially to
+        //   make up the difference.
+        // In all cases try to keep the same content at the top of the screen.
+        float viewportWidthRatio = !oldSize.width ? 1 : newSize.width / (float) oldSize.width;
+        float fixedLayoutWidthRatio = !oldFixedLayoutWidth ? 1 : fixedLayoutSize().width / (float) oldFixedLayoutWidth;
+        float scaleMultiplier = viewportWidthRatio / fixedLayoutWidthRatio;
+        if (scaleMultiplier != 1) {
+            IntSize scrollOffsetAtNewScale = oldScrollOffset;
+            scrollOffsetAtNewScale.scale(scaleMultiplier);
+            setPageScaleFactor(oldPageScaleFactor * scaleMultiplier, IntPoint(scrollOffsetAtNewScale));
+        }
+    }
+#endif
+
     sendResizeEventAndRepaint();
 }
 
@@ -2086,6 +2131,19 @@ bool WebViewImpl::selectionTextDirection(WebTextDirection& start, WebTextDirecti
     return true;
 }
 
+bool WebViewImpl::setEditableSelectionOffsets(int start, int end)
+{
+    const Frame* focused = focusedWebCoreFrame();
+    if (!focused)
+        return false;
+
+    Editor* editor = focused->editor();
+    if (!editor || !editor->canEdit())
+        return false;
+
+    return editor->setSelectionOffsets(start, end);
+}
+
 bool WebViewImpl::caretOrSelectionRange(size_t* location, size_t* length)
 {
     const Frame* focused = focusedWebCoreFrame();
@@ -2341,6 +2399,11 @@ void WebViewImpl::scrollFocusedNodeIntoRect(const WebRect& rect)
     frame->view()->scrollElementToRect(elementNode, IntRect(rect.x, rect.y, rect.width, rect.height));
 }
 
+void WebViewImpl::advanceFocus(bool reverse)
+{
+    page()->focusController()->advanceFocus(reverse ? FocusDirectionBackward : FocusDirectionForward, 0);
+}
+
 double WebViewImpl::zoomLevel()
 {
     return m_zoomLevel;
@@ -3479,6 +3542,8 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
                 setDeviceScaleFactor(m_deviceScaleInCompositor);
             }
 
+            bool visible = page()->visibilityState() == PageVisibilityStateVisible;
+            m_layerTreeView.setVisible(visible);
             m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
             if (m_compositorSurfaceReady)
                 m_layerTreeView.setSurfaceReady();
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 4f5c048d9..d4527da0d 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -150,6 +150,7 @@ public:
     virtual bool compositionRange(size_t* location, size_t* length);
     virtual WebTextInputInfo textInputInfo();
     virtual WebTextInputType textInputType();
+    virtual bool setEditableSelectionOffsets(int start, int end);
     virtual bool selectionBounds(WebRect& start, WebRect& end) const;
     virtual bool selectionTextDirection(WebTextDirection& start, WebTextDirection& end) const;
     virtual bool caretOrSelectionRange(size_t* location, size_t* length);
@@ -194,6 +195,7 @@ public:
     virtual void clearFocusedNode();
     virtual void scrollFocusedNodeIntoView();
     virtual void scrollFocusedNodeIntoRect(const WebRect&);
+    virtual void advanceFocus(bool reverse);
     virtual double zoomLevel();
     virtual double setZoomLevel(bool textOnly, double zoomLevel);
     virtual void zoomLimitsChanged(double minimumZoomLevel,
diff --git a/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
index 423c668d9..b35819759 100644
--- a/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTestCommon.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 
 #include "CCLayerTestCommon.h"
+#include "cc/CCDrawQuad.h"
 
 #include <gtest/gtest.h>
 #include <wtf/Vector.h>
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index 89d211e81..78448a517 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -28,6 +28,7 @@
 
 #include "CCAnimationTestCommon.h"
 #include "CCLayerTreeTestCommon.h"
+#include "ContentLayerChromium.h"
 #include "LayerChromium.h"
 #include "TranslateTransformOperation.h"
 #include "cc/CCLayerAnimationController.h"
@@ -3662,6 +3663,98 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayerLists)
     EXPECT_EQ(4, resultLayer->id());
 }
 
+class MockContentLayerDelegate : public ContentLayerDelegate {
+public:
+    MockContentLayerDelegate() { }
+    virtual ~MockContentLayerDelegate() { }
+    virtual void paintContents(SkCanvas*, const IntRect& clip, IntRect& opaque) { }
+};
+
+PassRefPtr<ContentLayerChromium> createDrawableContentLayerChromium(ContentLayerDelegate* delegate)
+{
+    RefPtr<ContentLayerChromium> toReturn = ContentLayerChromium::create(delegate);
+    toReturn->setIsDrawable(true);
+    return toReturn.release();
+}
+
+TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
+{
+    MockContentLayerDelegate delegate;
+    WebTransformationMatrix identityMatrix;
+    WebTransformationMatrix parentMatrix;
+
+    RefPtr<ContentLayerChromium> parent = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(30, 30), true);
+
+    RefPtr<ContentLayerChromium> child = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(2, 2), IntSize(10, 10), true);
+
+    WebTransformationMatrix replicaTransform;
+    replicaTransform.scaleNonUniform(1, -1);
+    RefPtr<ContentLayerChromium> replica = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(replica.get(), replicaTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(2, 2), IntSize(10, 10), true);
+
+    parent->addChild(child);
+    child->setReplicaLayer(replica.get());
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->createRenderSurface();
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
+    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    renderSurfaceLayerList.append(parent.get());
+
+    const double deviceScaleFactor = 1.5;
+    parentMatrix.scale(deviceScaleFactor);
+    parent->setContentsScale(deviceScaleFactor);
+    child->setContentsScale(deviceScaleFactor);
+    replica->setContentsScale(deviceScaleFactor);
+
+    CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), parentMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    // We should have two render surfaces. The root's render surface and child's
+    // render surface (it needs one because it has a replica layer).
+    EXPECT_EQ(2u, renderSurfaceLayerList.size());
+
+    WebTransformationMatrix expectedDrawTransform;
+    expectedDrawTransform.setM11(deviceScaleFactor);
+    expectedDrawTransform.setM22(deviceScaleFactor);
+    expectedDrawTransform.setM41(0.5 * deviceScaleFactor * child->bounds().width());
+    expectedDrawTransform.setM42(0.5 * deviceScaleFactor * child->bounds().height());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedDrawTransform, child->drawTransform());
+
+    WebTransformationMatrix expectedRenderSurfaceDrawTransform;
+    expectedRenderSurfaceDrawTransform.translate(deviceScaleFactor * (child->position().x() + 0.5 * child->bounds().width()), deviceScaleFactor * (child->position().y() + 0.5 * child->bounds().height()));
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedRenderSurfaceDrawTransform, child->renderSurface()->drawTransform());
+
+    WebTransformationMatrix expectedOriginTransform;
+    expectedOriginTransform.translate(deviceScaleFactor * 2, deviceScaleFactor * 2);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedOriginTransform, child->renderSurface()->originTransform());
+
+    WebTransformationMatrix expectedScreenSpaceTransform;
+    expectedScreenSpaceTransform.translate(deviceScaleFactor * 2, deviceScaleFactor * 2);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedScreenSpaceTransform, child->renderSurface()->screenSpaceTransform());
+
+    WebTransformationMatrix expectedReplicaDrawTransform;
+    expectedReplicaDrawTransform.setM22(-1);
+    expectedReplicaDrawTransform.setM41(13.5);
+    expectedReplicaDrawTransform.setM42(-1.5);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedReplicaDrawTransform, child->renderSurface()->replicaDrawTransform());
+
+    WebTransformationMatrix expectedReplicaOriginTransform = expectedReplicaDrawTransform;
+    expectedReplicaOriginTransform.setM41(6);
+    expectedReplicaOriginTransform.setM42(6);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedReplicaOriginTransform, child->renderSurface()->replicaOriginTransform());
+
+    WebTransformationMatrix expectedReplicaScreenSpaceTransform;
+    expectedReplicaScreenSpaceTransform.setM22(-1);
+    expectedReplicaScreenSpaceTransform.setM41(6);
+    expectedReplicaScreenSpaceTransform.setM42(6);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedReplicaScreenSpaceTransform, child->renderSurface()->replicaScreenSpaceTransform());
+}
+
 TEST(CCLayerTreeHostCommonTest, verifySubtreeSearch)
 {
     RefPtr<LayerChromium> root = LayerChromium::create();
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index 738c88190..d19b036bb 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -32,6 +32,7 @@
 #include "FakeWebGraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
 #include "LayerRendererChromium.h"
+#include "ManagedTexture.h"
 #include "cc/CCIOSurfaceLayerImpl.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTilingData.h"
@@ -80,7 +81,6 @@ public:
     virtual void setNeedsRedrawOnImplThread() OVERRIDE { m_didRequestRedraw = true; }
     virtual void setNeedsCommitOnImplThread() OVERRIDE { m_didRequestCommit = true; }
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE { }
-    virtual void postSetContentsMemoryAllocationLimitBytesToMainThreadOnImplThread(size_t) OVERRIDE { }
 
     PassOwnPtr<CCLayerTreeHostImpl> createLayerTreeHost(bool partialSwap, PassRefPtr<CCGraphicsContext> graphicsContext, PassOwnPtr<CCLayerImpl> rootPtr)
     {
@@ -1791,7 +1791,7 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapNoUpdate)
     Mock::VerifyAndClearExpectations(&mockContext);
 }
 
-class PartialSwapContext: public FakeWebGraphicsContext3D {
+class PartialSwapContext : public FakeWebGraphicsContext3D {
 public:
     WebString getString(WGC3Denum name)
     {
@@ -2040,12 +2040,17 @@ private:
 // FakeWebGraphicsContext3D have an id of 1).
 class StrictWebGraphicsContext3D : public FakeWebGraphicsContext3D {
 public:
+    StrictWebGraphicsContext3D()
+        : FakeWebGraphicsContext3D()
+    {
+        m_nextTextureId = 7; // Start allocating texture ids larger than any other resource IDs so we can tell if someone's mixing up their resource types.
+    }
+
     virtual WebGLId createBuffer() { return 2; }
     virtual WebGLId createFramebuffer() { return 3; }
     virtual WebGLId createProgram() { return 4; }
     virtual WebGLId createRenderbuffer() { return 5; }
     virtual WebGLId createShader(WGC3Denum) { return 6; }
-    virtual WebGLId createTexture() { return 7; }
 
     virtual void deleteBuffer(WebGLId id)
     {
@@ -2077,10 +2082,17 @@ public:
             ADD_FAILURE() << "Trying to delete shader id " << id;
     }
 
+    virtual WebGLId createTexture()
+    {
+        unsigned textureId = FakeWebGraphicsContext3D::createTexture();
+        m_allocatedTextureIds.add(textureId);
+        return textureId;
+    }
     virtual void deleteTexture(WebGLId id)
     {
-        if (id != 7)
+        if (!m_allocatedTextureIds.contains(id))
             ADD_FAILURE() << "Trying to delete texture id " << id;
+        m_allocatedTextureIds.remove(id);
     }
 
     virtual void bindBuffer(WGC3Denum, WebGLId id)
@@ -2115,7 +2127,7 @@ public:
 
     virtual void bindTexture(WGC3Denum, WebGLId id)
     {
-        if (id != 7 && id)
+        if (id && !m_allocatedTextureIds.contains(id))
             ADD_FAILURE() << "Trying to bind texture id " << id;
     }
 
@@ -2123,6 +2135,9 @@ public:
     {
         return GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new StrictWebGraphicsContext3D()), GraphicsContext3D::RenderDirectlyToHostWindow);
     }
+
+private:
+    HashSet<unsigned> m_allocatedTextureIds;
 };
 
 // Fake video frame that represents a 4x4 YUV video frame.
@@ -2262,14 +2277,13 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
 class TrackingWebGraphicsContext3D : public FakeWebGraphicsContext3D {
 public:
     TrackingWebGraphicsContext3D()
-        : m_nextTextureId(1)
+        : FakeWebGraphicsContext3D()
         , m_numTextures(0)
     { }
 
     virtual WebGLId createTexture() OVERRIDE
     {
-        WebGLId id = m_nextTextureId;
-        ++m_nextTextureId;
+        WebGLId id = FakeWebGraphicsContext3D::createTexture();
 
         m_textures.set(id, true);
         ++m_numTextures;
@@ -2301,7 +2315,6 @@ public:
     unsigned numTextures() const { return m_numTextures; }
 
 private:
-    WebGLId m_nextTextureId;
     HashMap<WebGLId, bool> m_textures;
     unsigned m_numTextures;
 };
@@ -2409,20 +2422,15 @@ TEST_F(CCLayerTreeHostImplTest, hasTransparentBackground)
     Mock::VerifyAndClearExpectations(&mockContext);
 }
 
-TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
+static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl, CCLayerImpl*& rootPtr, CCLayerImpl*& intermediateLayerPtr, CCLayerImpl*& surfaceLayerPtr, CCLayerImpl*& childPtr)
 {
-    CCSettings::setPartialSwapEnabled(true);
-    
-    CCLayerTreeSettings settings;
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
-    
     RefPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new PartialSwapContext()), GraphicsContext3D::RenderDirectlyToHostWindow));
 
-    myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(100, 100));
+    layerTreeHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
+    layerTreeHostImpl->setViewportSize(IntSize(100, 100));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    CCLayerImpl* rootPtr = root.get();
+    rootPtr = root.get();
 
     root->setAnchorPoint(FloatPoint(0, 0));
     root->setPosition(FloatPoint(0, 0));
@@ -2430,11 +2438,11 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     root->setContentBounds(IntSize(100, 100));
     root->setVisibleLayerRect(IntRect(0, 0, 100, 100));
     root->setDrawsContent(true);
-    myHostImpl->setRootLayer(root.release());
+    layerTreeHostImpl->setRootLayer(root.release());
 
     // Intermediate layer does not own a surface, and does not draw content.
     OwnPtr<CCLayerImpl> intermediateLayer = CCLayerImpl::create(2);
-    CCLayerImpl* intermediateLayerPtr = intermediateLayer.get();
+    intermediateLayerPtr = intermediateLayer.get();
 
     intermediateLayerPtr->setAnchorPoint(FloatPoint(0, 0));
     intermediateLayerPtr->setPosition(FloatPoint(10, 10));
@@ -2445,7 +2453,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     rootPtr->addChild(intermediateLayer.release());
 
     OwnPtr<CCLayerImpl> surfaceLayer = CCLayerImpl::create(3);
-    CCLayerImpl* surfaceLayerPtr = surfaceLayer.get();
+    surfaceLayerPtr = surfaceLayer.get();
 
     // Surface layer is the layer that changes its opacity
     // It will contain other layers that draw content.
@@ -2460,7 +2468,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
 
     // Child of the surface layer will produce some quads
     OwnPtr<FakeLayerWithQuads> child = FakeLayerWithQuads::create(4);
-    FakeLayerWithQuads* childPtr = child.get();
+    childPtr = child.get();
 
     childPtr->setAnchorPoint(FloatPoint(0, 0));
     childPtr->setPosition(FloatPoint(5, 5));
@@ -2470,6 +2478,21 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     childPtr->setDrawsContent(true);
 
     surfaceLayerPtr->addChild(child.release());
+}
+
+TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
+{
+    CCSettings::setPartialSwapEnabled(true);
+
+    CCLayerTreeSettings settings;
+    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
+
+    CCLayerImpl* rootPtr;
+    CCLayerImpl* intermediateLayerPtr;
+    CCLayerImpl* surfaceLayerPtr;
+    CCLayerImpl* childPtr;
+
+    setupLayersForTextureCaching(myHostImpl.get(), rootPtr, intermediateLayerPtr, surfaceLayerPtr, childPtr);
 
     {
         CCLayerTreeHostImpl::FrameData frame;
@@ -2614,6 +2637,165 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     }
 }
 
+TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
+{
+    CCSettings::setPartialSwapEnabled(false);
+
+    CCLayerTreeSettings settings;
+    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
+
+    CCLayerImpl* rootPtr;
+    CCLayerImpl* intermediateLayerPtr;
+    CCLayerImpl* surfaceLayerPtr;
+    CCLayerImpl* childPtr;
+
+    setupLayersForTextureCaching(myHostImpl.get(), rootPtr, intermediateLayerPtr, surfaceLayerPtr, childPtr);
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Must receive two render passes, each with one quad
+        ASSERT_EQ(2U, frame.renderPasses.size());
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
+
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
+        EXPECT_TRUE(quad->renderPass()->targetSurface()->contentsChanged());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Draw without any change
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Even though there was no change, we set the damage to entire viewport.
+        // One of the passes should be culled as a result, since contents didn't change
+        // and we have cached texture.
+        ASSERT_EQ(1U, frame.renderPasses.size());
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Change opacity and draw
+    surfaceLayerPtr->setOpacity(0.6f);
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Must receive one render pass, as the other one should be culled
+        ASSERT_EQ(1U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        EXPECT_FALSE(quad->renderPass()->targetSurface()->contentsChanged());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Change less benign property and draw - should have contents changed flag
+    surfaceLayerPtr->setStackingOrderChanged(true);
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Must receive two render passes, each with one quad
+        ASSERT_EQ(2U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::SolidColor, frame.renderPasses[0]->quadList()[0]->material());
+
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
+        EXPECT_TRUE(quad->renderPass()->targetSurface()->contentsChanged());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Change opacity again, but evict the cached surface texture
+    surfaceLayerPtr->setOpacity(0.5f);
+    ManagedTexture* contentsTexture = surfaceLayerPtr->renderSurface()->contentsTexture();
+    ASSERT_TRUE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
+    CCRenderer* renderer = myHostImpl->layerRenderer();
+    TextureManager* textureManager = renderer->implTextureManager();
+    size_t maxMemoryLimit = textureManager->maxMemoryLimitBytes();
+
+    // This should evice all cached surfaces
+    textureManager->setMaxMemoryLimitBytes(0);
+
+    // Restore original limit
+    textureManager->setMaxMemoryLimitBytes(maxMemoryLimit);
+
+    // Was our surface evicted?
+    ASSERT_FALSE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
+
+    // Change opacity and draw
+    surfaceLayerPtr->setOpacity(0.6f);
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Must receive two render passes
+        ASSERT_EQ(2U, frame.renderPasses.size());
+
+        // Even though not enough properties changed, the entire thing must be
+        // redrawn as we don't have cached textures
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
+
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
+        EXPECT_FALSE(quad->renderPass()->targetSurface()->contentsChanged());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Draw without any change, to make sure the state is clear
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Even though there was no change, we set the damage to entire viewport.
+        // One of the passes should be culled as a result, since contents didn't change
+        // and we have cached texture.
+        ASSERT_EQ(1U, frame.renderPasses.size());
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // Change opacity on the intermediate layer
+    WebTransformationMatrix transform = intermediateLayerPtr->transform();
+    transform.setM11(1.0001);
+    intermediateLayerPtr->setTransform(transform);
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+
+        // Must receive one render pass, as the other one should be culled.
+        ASSERT_EQ(1U, frame.renderPasses.size());
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        EXPECT_FALSE(quad->renderPass()->targetSurface()->contentsChanged());
+
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+}
+
 struct RenderPassCacheEntry {
     mutable OwnPtr<CCRenderPass> renderPassPtr;
     CCRenderPass* renderPass;
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index 544eca88b..d2773790e 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -31,6 +31,7 @@
 #include "CCThreadedTest.h"
 #include "ContentLayerChromium.h"
 #include "GraphicsContext3DPrivate.h"
+#include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCSettings.h"
 #include "cc/CCTextureUpdater.h"
@@ -485,6 +486,40 @@ TEST_F(CCLayerTreeHostTestCompositeAndReadbackWhileInvisible, runMultiThread)
     runTestThreaded();
 }
 
+class CCLayerTreeHostTestAbortFrameWhenInvisible : public CCLayerTreeHostTestThreadOnly {
+public:
+    CCLayerTreeHostTestAbortFrameWhenInvisible()
+    {
+    }
+
+    virtual void beginTest()
+    {
+        // Request a commit (from the main thread), which will trigger the commit flow from the impl side.
+        m_layerTreeHost->setNeedsCommit();
+        // Then mark ourselves as not visible before processing any more messages on the main thread.
+        m_layerTreeHost->setVisible(false);
+        // If we make it without kicking a frame, we pass!
+        endTestAfterDelay(1);
+    }
+
+    virtual void layout() OVERRIDE
+    {
+        ASSERT_FALSE(true);
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+
+private:
+};
+
+TEST_F(CCLayerTreeHostTestAbortFrameWhenInvisible, runMultiThread)
+{
+    runTestThreaded();
+}
+
 
 // Trigger a frame with setNeedsCommit. Then, inside the resulting animate
 // callback, requet another frame using setNeedsAnimate. End the test when
@@ -996,113 +1031,6 @@ TEST_F(CCLayerTreeHostTestCommit, runTest)
     runTest(true);
 }
 
-class CCLayerTreeHostTestVisibilityAndAllocationControlDrawing : public CCLayerTreeHostTest {
-public:
-
-    CCLayerTreeHostTestVisibilityAndAllocationControlDrawing() { }
-
-    virtual void beginTest()
-    {
-        postSetNeedsCommitToMainThread();
-    }
-
-    virtual void didCommitAndDrawFrame()
-    {
-        int lastFrame = m_layerTreeHost->frameNumber() - 1;
-
-        // These frames should draw.
-        switch (lastFrame) {
-        case 0:
-            // Set the tree invisible, this should not draw.
-            m_layerTreeHost->setVisible(false);
-            break;
-        case 2:
-            // Set the tree invisible and give a non-visible allocation, this
-            // should not draw.
-            m_layerTreeHost->setVisible(false);
-            m_layerTreeHost->setContentsMemoryAllocationLimitBytes(0);
-            break;
-        case 5:
-            // Give a memory allocation not for display, but while we are
-            // visible. This should not be used and we should remain
-            // ready for display and it should draw.
-            m_layerTreeHost->setContentsMemoryAllocationLimitBytes(0);
-            break;
-        case 6:
-            endTest();
-            break;
-
-        default:
-            ASSERT_NOT_REACHED();
-        }
-    }
-
-    virtual void didCommit()
-    {
-        int lastFrame = m_layerTreeHost->frameNumber() - 1;
-
-        // These frames should not draw.
-        switch (lastFrame) {
-        case 1:
-            // Set the tree visible, this should draw.
-            m_layerTreeHost->setVisible(true);
-            break;
-        case 3:
-            // Set visible without giving a visible memory allocation, this
-            // shouldn't make the impl side ready for display, so it should
-            // not draw.
-            m_layerTreeHost->setVisible(true);
-            break;
-        case 4:
-            // Now give a memory allocation for display, this should draw.
-            m_layerTreeHost->setContentsMemoryAllocationLimitBytes(1);
-            break;
-        }
-    }
-
-    virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl* impl)
-    {
-        switch (impl->sourceFrameNumber()) {
-        case 0:
-            // The host starts out visible and able to display before we do any commit.
-            EXPECT_TRUE(impl->visible());
-            EXPECT_TRUE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 1:
-            // We still have a memory allocation for display.
-            EXPECT_FALSE(impl->visible());
-            EXPECT_TRUE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 2:
-            EXPECT_TRUE(impl->visible());
-            EXPECT_TRUE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 3:
-            EXPECT_FALSE(impl->visible());
-            EXPECT_FALSE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 4:
-            EXPECT_TRUE(impl->visible());
-            EXPECT_FALSE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 5:
-            EXPECT_TRUE(impl->visible());
-            EXPECT_TRUE(impl->sourceFrameCanBeDrawn());
-            break;
-        case 6:
-            EXPECT_TRUE(impl->visible());
-            EXPECT_TRUE(impl->sourceFrameCanBeDrawn());
-            break;
-        }
-    }
-
-    virtual void afterTest()
-    {
-    }
-};
-
-SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestVisibilityAndAllocationControlDrawing)
-
 // Verifies that startPageScaleAnimation events propagate correctly from CCLayerTreeHost to
 // CCLayerTreeHostImpl in the MT compositor.
 class CCLayerTreeHostTestStartPageScaleAnimation : public CCLayerTreeHostTest {
@@ -1731,8 +1659,9 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
         CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1749,7 +1678,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1767,7 +1696,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1787,7 +1716,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1809,7 +1738,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1831,7 +1760,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1854,7 +1783,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1877,7 +1806,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1938,8 +1867,9 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
         CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1966,7 +1896,7 @@ public:
 
         m_layerTreeHost->setRootLayer(rootLayer);
         m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -2026,8 +1956,9 @@ public:
 
         m_layerTreeHost->setRootLayer(layers[0].get());
         m_layerTreeHost->setViewportSize(layers[0]->bounds());
+        ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
         CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater);
+        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         for (int i = 0; i < numSurfaces-1; ++i) {
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index 8631b1942..ee5e2907d 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -36,6 +36,7 @@
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCMathUtil.h"
+#include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -257,6 +258,7 @@ protected:
         ASSERT(root == m_root.get());
         Vector<CCLayerImpl*> dummyLayerList;
         int dummyMaxTextureSize = 512;
+        CCLayerSorter layerSorter;
 
         ASSERT(!root->renderSurface());
         root->createRenderSurface();
@@ -264,7 +266,7 @@ protected:
         root->setClipRect(IntRect(IntPoint::zero(), root->bounds()));
         m_renderSurfaceLayerListImpl.append(m_root.get());
 
-        CCLayerTreeHostCommon::calculateDrawTransforms(root, root, identityMatrix, identityMatrix, m_renderSurfaceLayerListImpl, dummyLayerList, 0, dummyMaxTextureSize);
+        CCLayerTreeHostCommon::calculateDrawTransforms(root, root, identityMatrix, identityMatrix, m_renderSurfaceLayerListImpl, dummyLayerList, &layerSorter, dummyMaxTextureSize);
 
         CCLayerTreeHostCommon::calculateVisibleAndScissorRects(m_renderSurfaceLayerListImpl, root->renderSurface()->contentRect());
 
@@ -435,6 +437,9 @@ private:
 #define MAIN_THREAD_TEST(ClassName) \
     RUN_TEST_MAIN_THREAD_OPAQUE_LAYERS(ClassName)
 
+#define IMPL_THREAD_TEST(ClassName) \
+    RUN_TEST_IMPL_THREAD_OPAQUE_LAYERS(ClassName)
+
 #define MAIN_AND_IMPL_THREAD_TEST(ClassName) \
     RUN_TEST_MAIN_THREAD_OPAQUE_LAYERS(ClassName) \
     RUN_TEST_IMPL_THREAD_OPAQUE_LAYERS(ClassName)
@@ -1872,6 +1877,44 @@ protected:
 MAIN_AND_IMPL_THREAD_TEST(CCOcclusionTrackerTest3dTransform);
 
 template<class Types, bool opaqueLayers>
+class CCOcclusionTrackerTestUnsorted3dLayers : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+protected:
+    void runMyTest()
+    {
+        // Currently, the main thread layer iterator does not iterate over 3d items in
+        // sorted order, because layer sorting is not performed on the main thread.
+        // Because of this, the occlusion tracker cannot assume that a 3d layer occludes
+        // other layers that have not yet been iterated over. For now, the expected
+        // behavior is that a 3d layer simply does not add any occlusion to the occlusion
+        // tracker.
+
+        WebTransformationMatrix translationToFront;
+        translationToFront.translate3d(0, 0, -10);
+        WebTransformationMatrix translationToBack;
+        translationToFront.translate3d(0, 0, -100);
+
+        typename Types::ContentLayerType* parent = this->createRoot(this->identityMatrix, FloatPoint(0, 0), IntSize(300, 300));
+        typename Types::ContentLayerType* child1 = this->createDrawingLayer(parent, translationToBack, FloatPoint(0, 0), IntSize(100, 100), true);
+        typename Types::ContentLayerType* child2 = this->createDrawingLayer(parent, translationToFront, FloatPoint(50, 50), IntSize(100, 100), true);
+        parent->setPreserves3D(true);
+
+        this->calcDrawEtc(parent);
+
+        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        this->visitLayer(child2, occlusion);
+        EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+        EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+
+        this->visitLayer(child1, occlusion);
+        EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
+        EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
+    }
+};
+
+// This test will have different layer ordering on the impl thread; the test will only work on the main thread.
+MAIN_THREAD_TEST(CCOcclusionTrackerTestUnsorted3dLayers);
+
+template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestPerspectiveTransform : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
@@ -1896,7 +1939,8 @@ protected:
     }
 };
 
-MAIN_THREAD_TEST(CCOcclusionTrackerTestPerspectiveTransform);
+// This test requires accumulating occlusion of 3d layers, which are skipped by the occlusion tracker on the main thread. So this test should run on the impl thread.
+IMPL_THREAD_TEST(CCOcclusionTrackerTestPerspectiveTransform);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestPerspectiveTransformBehindCamera : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -1928,7 +1972,8 @@ protected:
     }
 };
 
-MAIN_THREAD_TEST(CCOcclusionTrackerTestPerspectiveTransformBehindCamera);
+// This test requires accumulating occlusion of 3d layers, which are skipped by the occlusion tracker on the main thread. So this test should run on the impl thread.
+IMPL_THREAD_TEST(CCOcclusionTrackerTestPerspectiveTransformBehindCamera);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestLayerBehindCameraDoesNotOcclude : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -1957,7 +2002,8 @@ protected:
     }
 };
 
-MAIN_THREAD_TEST(CCOcclusionTrackerTestLayerBehindCameraDoesNotOcclude);
+// This test requires accumulating occlusion of 3d layers, which are skipped by the occlusion tracker on the main thread. So this test should run on the impl thread.
+IMPL_THREAD_TEST(CCOcclusionTrackerTestLayerBehindCameraDoesNotOcclude);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -1982,14 +2028,15 @@ protected:
         // Ensure that those pixels don't occlude things outside the clipRect.
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
-        EXPECT_EQ(IntRect(0, 0, 100, 100), occlusion.occlusionInTargetSurface().bounds());
+        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), occlusion.occlusionInTargetSurface().bounds());
         EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
-        EXPECT_EQ(IntRect(0, 0, 100, 100), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), occlusion.occlusionInScreenSpace().bounds());
         EXPECT_EQ(1u, occlusion.occlusionInScreenSpace().rects().size());
     }
 };
 
-MAIN_THREAD_TEST(CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect);
+// This test requires accumulating occlusion of 3d layers, which are skipped by the occlusion tracker on the main thread. So this test should run on the impl thread.
+IMPL_THREAD_TEST(CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestAnimationOpacity1OnMainThread : public CCOcclusionTrackerTest<Types, opaqueLayers> {
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index 1a119d708..10eeb0f74 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -26,6 +26,7 @@
 
 #include "cc/CCQuadCuller.h"
 
+#include "cc/CCLayerTilingData.h"
 #include "cc/CCOcclusionTracker.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h"
diff --git a/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp b/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
index a99149ba9..2e31d44d0 100644
--- a/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSchedulerStateMachineTest.cpp
@@ -807,7 +807,7 @@ TEST(CCSchedulerStateMachineTest, TestRequestCommitInvisible)
     EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
 }
 
-TEST(CCSchedulerStateMachineTest, TestGoesInvisibleMidCommit)
+TEST(CCSchedulerStateMachineTest, TestGoesInvisibleBeforeBeginFrameCompletes)
 {
     StateMachine state;
     state.setCanBeginFrame(true);
@@ -823,33 +823,12 @@ TEST(CCSchedulerStateMachineTest, TestGoesInvisibleMidCommit)
     EXPECT_FALSE(state.needsCommit());
     EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
 
-    // Become invisible
+    // Become invisible and abort the beginFrame.
     state.setVisible(false);
+    state.beginFrameAborted();
 
-    // Tell the scheduler the frame finished
-    state.beginFrameComplete();
-    EXPECT_EQ(CCSchedulerStateMachine::COMMIT_STATE_UPDATING_RESOURCES, state.commitState());
-    EXPECT_EQ(CCSchedulerStateMachine::ACTION_BEGIN_UPDATE_MORE_RESOURCES, state.nextAction());
-
-    // Tell the scheduler the update began and finished
-    state.updateState(CCSchedulerStateMachine::ACTION_BEGIN_UPDATE_MORE_RESOURCES);
-    state.beginUpdateMoreResourcesComplete(false);
-    EXPECT_EQ(CCSchedulerStateMachine::COMMIT_STATE_READY_TO_COMMIT, state.commitState());
-    EXPECT_EQ(CCSchedulerStateMachine::ACTION_COMMIT, state.nextAction());
-
-    // Commit in invisible state should leave us:
-    // - COMMIT_STATE_WAITING_FOR_FIRST_DRAW
-    // - Waiting for redraw.
-    // - No commit needed
-    state.updateState(CCSchedulerStateMachine::ACTION_COMMIT);
-    EXPECT_EQ(CCSchedulerStateMachine::COMMIT_STATE_WAITING_FOR_FIRST_DRAW, state.commitState());
-    EXPECT_TRUE(state.needsRedraw());
-    EXPECT_FALSE(state.needsCommit());
-
-    // Expect to do nothing, both in and out of vsync.
-    state.didLeaveVSync();
-    EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
-    state.didEnterVSync();
+    // We should now be back in the idle state as if we didn't start a frame at all.
+    EXPECT_EQ(CCSchedulerStateMachine::COMMIT_STATE_IDLE, state.commitState());
     EXPECT_EQ(CCSchedulerStateMachine::ACTION_NONE, state.nextAction());
 }
 
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
index 48a46dae1..85daea86b 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
@@ -28,6 +28,7 @@
 
 #include "CCLayerTestCommon.h"
 #include "MockCCQuadCuller.h"
+#include "cc/CCLayerTilingData.h"
 #include "cc/CCSingleThreadProxy.h"
 #include "cc/CCTileDrawQuad.h"
 #include <gmock/gmock.h>
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
index 68fef6420..614e1eeb2 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
@@ -150,8 +150,9 @@ protected:
 
 class FakeTextureAllocator : public WebCore::TextureAllocator {
 public:
-    virtual unsigned createTexture(const WebCore::IntSize&, GC3Denum) { return 1; }
-    virtual void deleteTexture(unsigned, const WebCore::IntSize&, GC3Denum) { }
+    virtual unsigned createTexture(const WebCore::IntSize&, GC3Denum) OVERRIDE { return 1; }
+    virtual void deleteTexture(unsigned, const WebCore::IntSize&, GC3Denum) OVERRIDE { }
+    virtual void deleteAllTextures() OVERRIDE { }
 };
 
 class FakeTextureCopier : public WebCore::TextureCopier {
diff --git a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
index 191d05f5f..b864c35fd 100644
--- a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
@@ -35,6 +35,11 @@ namespace WebKit {
 // All operations are no-ops (returning 0 if necessary).
 class FakeWebGraphicsContext3D : public WebGraphicsContext3D {
 public:
+    FakeWebGraphicsContext3D()
+        : m_nextTextureId(1)
+    {
+    }
+
     virtual bool makeContextCurrent() { return true; }
 
     virtual int width() { return 0; }
@@ -246,7 +251,7 @@ public:
     virtual WebGLId createProgram() { return 1; }
     virtual WebGLId createRenderbuffer() { return 1; }
     virtual WebGLId createShader(WGC3Denum) { return 1; }
-    virtual WebGLId createTexture() { return 1; }
+    virtual WebGLId createTexture() { return m_nextTextureId++; }
 
     virtual void deleteBuffer(WebGLId) { }
     virtual void deleteFramebuffer(WebGLId) { }
@@ -267,6 +272,7 @@ public:
     virtual void getQueryObjectuivEXT(WebGLId, GC3Denum, GC3Duint*) { }
 
 protected:
+    unsigned m_nextTextureId;
     Attributes m_attrs;
 };
 
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index 4fdcf4f41..410c45d78 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -57,6 +57,7 @@ class MockGraphicsLayerClient : public GraphicsLayerClient {
     virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) OVERRIDE { }
     virtual bool showDebugBorders(const GraphicsLayer*) const OVERRIDE { return false; }
     virtual bool showRepaintCounter(const GraphicsLayer*) const OVERRIDE { return false; }
+    virtual float deviceScaleFactor() const OVERRIDE { return 2; }
 };
 
 class MockLayerTreeHostClient : public CCLayerTreeHostClient {
@@ -395,4 +396,9 @@ TEST_F(GraphicsLayerChromiumTest, createReversedAlternatingAnimation)
     expectTranslateX(2, curve->getValue(duration));
 }
 
+TEST_F(GraphicsLayerChromiumTest, shouldStartWithCorrectContentsScale)
+{
+    EXPECT_EQ(2, m_platformLayer->contentsScale());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
index 098a7327f..17dd24bc6 100644
--- a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
@@ -67,6 +67,70 @@ TEST(IDBDatabaseBackendTest, BackingStoreRetention)
     EXPECT_TRUE(backingStore->hasOneRef());
 }
 
+class MockIDBCallbacks : public IDBCallbacks {
+public:
+    static PassRefPtr<MockIDBCallbacks> create() { return adoptRef(new MockIDBCallbacks()); }
+    virtual ~MockIDBCallbacks()
+    {
+        EXPECT_TRUE(m_wasSuccessDBCalled);
+    }
+    virtual void onError(PassRefPtr<IDBDatabaseError>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<DOMStringList>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) OVERRIDE
+    {
+        m_wasSuccessDBCalled = true;
+    }
+    virtual void onSuccess(PassRefPtr<IDBKey>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>) OVERRIDE { }
+    virtual void onSuccessWithContinuation() OVERRIDE { }
+    virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) OVERRIDE { }
+    virtual void onBlocked() OVERRIDE { }
+private:
+    MockIDBCallbacks()
+        : m_wasSuccessDBCalled(false) { }
+    bool m_wasSuccessDBCalled;
+};
+
+class FakeIDBDatabaseCallbacks : public IDBDatabaseCallbacks {
+public:
+    static PassRefPtr<FakeIDBDatabaseCallbacks> create() { return adoptRef(new FakeIDBDatabaseCallbacks()); }
+    virtual ~FakeIDBDatabaseCallbacks() { }
+    virtual void onVersionChange(const String& version) OVERRIDE { }
+private:
+    FakeIDBDatabaseCallbacks() { }
+};
+
+TEST(IDBDatabaseBackendTest, ConnectionLifecycle)
+{
+    RefPtr<IDBFakeBackingStore> backingStore = adoptRef(new IDBFakeBackingStore());
+    EXPECT_TRUE(backingStore->hasOneRef());
+
+    IDBTransactionCoordinator* coordinator = 0;
+    IDBFactoryBackendImpl* factory = 0;
+    RefPtr<IDBDatabaseBackendImpl> db = IDBDatabaseBackendImpl::create("db", backingStore.get(), coordinator, factory, "uniqueid");
+    EXPECT_GT(backingStore->refCount(), 1);
+
+    RefPtr<MockIDBCallbacks> request1 = MockIDBCallbacks::create();
+    db->openConnection(request1);
+
+    RefPtr<FakeIDBDatabaseCallbacks> connection1 = FakeIDBDatabaseCallbacks::create();
+    db->registerFrontendCallbacks(connection1);
+
+    RefPtr<MockIDBCallbacks> request2 = MockIDBCallbacks::create();
+    db->openConnection(request2);
+
+    db->close(connection1);
+    EXPECT_GT(backingStore->refCount(), 1);
+
+    RefPtr<FakeIDBDatabaseCallbacks> connection2 = FakeIDBDatabaseCallbacks::create();
+    db->registerFrontendCallbacks(connection2);
+
+    db->close(connection2);
+    EXPECT_TRUE(backingStore->hasOneRef());
+}
+
 } // namespace
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
index 9934e5c79..a34b436bd 100644
--- a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
@@ -139,6 +139,9 @@ TEST(IDBLevelDBCodingTest, EncodeInt)
     EXPECT_EQ(static_cast<size_t>(1), encodeInt(255).size());
     EXPECT_EQ(static_cast<size_t>(2), encodeInt(256).size());
     EXPECT_EQ(static_cast<size_t>(4), encodeInt(0xffffffff).size());
+#ifdef NDEBUG
+    EXPECT_EQ(static_cast<size_t>(8), encodeInt(-1).size());
+#endif
 }
 
 TEST(IDBLevelDBCodingTest, DecodeBool)
@@ -166,6 +169,9 @@ TEST(IDBLevelDBCodingTest, DecodeInt)
     testCases.append(655536);
     testCases.append(7711192431755665792ll);
     testCases.append(0x7fffffffffffffffll);
+#ifdef NDEBUG
+    testCases.append(-3);
+#endif
 
     for (size_t i = 0; i < testCases.size(); ++i) {
         int64_t n = testCases[i];
@@ -181,6 +187,9 @@ TEST(IDBLevelDBCodingTest, EncodeVarInt)
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(255).size());
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(256).size());
     EXPECT_EQ(static_cast<size_t>(5), encodeVarInt(0xffffffff).size());
+#ifdef NDEBUG
+    EXPECT_EQ(static_cast<size_t>(8), encodeInt(-100).size());
+#endif
 }
 
 TEST(IDBLevelDBCodingTest, DecodeVarInt)
@@ -194,6 +203,9 @@ TEST(IDBLevelDBCodingTest, DecodeVarInt)
     testCases.append(655536);
     testCases.append(7711192431755665792ll);
     testCases.append(0x7fffffffffffffffll);
+#ifdef NDEBUG
+    testCases.append(-3);
+#endif
 
     for (size_t i = 0; i < testCases.size(); ++i) {
         int64_t n = testCases[i];
diff --git a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
index ca17786bc..a5ca55124 100644
--- a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
@@ -28,6 +28,7 @@
 
 #include "GraphicsLayer.h"
 #include "GraphicsLayerChromium.h"
+#include "Image.h"
 #include "NativeImageSkia.h"
 #include <gtest/gtest.h>
 #include <wtf/PassOwnPtr.h>
diff --git a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
index 9269217c3..e4650961b 100644
--- a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
 #include "WebCompositor.h"
+#include "cc/CCDrawQuad.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
 
@@ -83,12 +84,13 @@ public:
     }
 
     // CCRendererClient methods.
-    virtual const IntSize& deviceViewportSize() const OVERRIDE { static IntSize fakeSize; return fakeSize; }
+    virtual const IntSize& deviceViewportSize() const OVERRIDE { static IntSize fakeSize(1, 1); return fakeSize; }
     virtual const CCLayerTreeSettings& settings() const OVERRIDE { static CCLayerTreeSettings fakeSettings; return fakeSettings; }
     virtual void didLoseContext() OVERRIDE { }
     virtual void onSwapBuffersComplete() OVERRIDE { }
     virtual void setFullRootLayerDamage() OVERRIDE { m_setFullRootLayerDamageCount++; }
-    virtual void setContentsMemoryAllocationLimitBytes(size_t bytes) OVERRIDE { m_memoryAllocationLimitBytes = bytes; }
+    virtual void releaseContentsTextures() OVERRIDE { }
+    virtual void setMemoryAllocationLimitBytes(size_t bytes) OVERRIDE { m_memoryAllocationLimitBytes = bytes; }
 
     // Methods added for test.
     int setFullRootLayerDamageCount() const { return m_setFullRootLayerDamageCount; }
@@ -167,20 +169,34 @@ TEST_F(LayerRendererChromiumTest, SuggestBackbufferYesWhenItAlreadyExistsShouldD
 }
 
 // Test LayerRendererChromium discardFramebuffer functionality:
-// Suggest discarding framebuffer when one exists.
+// Suggest discarding framebuffer when one exists and the renderer is not visible.
 // Expected: it is discarded and damage tracker is reset.
-TEST_F(LayerRendererChromiumTest, SuggestBackbufferNoShouldDiscardBackbufferAndDamageRootLayer)
+TEST_F(LayerRendererChromiumTest, SuggestBackbufferNoShouldDiscardBackbufferAndDamageRootLayerWhileNotVisible)
 {
+    m_layerRendererChromium.setVisible(false);
     m_mockContext.setMemoryAllocation(m_suggestHaveBackbufferNo);
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
     EXPECT_TRUE(m_layerRendererChromium.isFramebufferDiscarded());
 }
 
 // Test LayerRendererChromium discardFramebuffer functionality:
+// Suggest discarding framebuffer when one exists and the renderer is visible.
+// Expected: the allocation is ignored.
+TEST_F(LayerRendererChromiumTest, SuggestBackbufferNoDoNothingWhenVisible)
+{
+    m_layerRendererChromium.setVisible(true);
+    m_mockContext.setMemoryAllocation(m_suggestHaveBackbufferNo);
+    EXPECT_EQ(0, m_mockClient.setFullRootLayerDamageCount());
+    EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
+}
+
+
+// Test LayerRendererChromium discardFramebuffer functionality:
 // Suggest discarding framebuffer when one does not exist.
 // Expected: it does nothing.
 TEST_F(LayerRendererChromiumTest, SuggestBackbufferNoWhenItDoesntExistShouldDoNothing)
 {
+    m_layerRendererChromium.setVisible(false);
     m_mockContext.setMemoryAllocation(m_suggestHaveBackbufferNo);
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
     EXPECT_TRUE(m_layerRendererChromium.isFramebufferDiscarded());
@@ -191,37 +207,37 @@ TEST_F(LayerRendererChromiumTest, SuggestBackbufferNoWhenItDoesntExistShouldDoNo
 }
 
 // Test LayerRendererChromium discardFramebuffer functionality:
-// Suggest discarding framebuffer, then try to swapBuffers.
-// Expected: framebuffer is discarded, swaps are ignored, and damage is reset after discard and after each swap.
-TEST_F(LayerRendererChromiumTest, SwapBuffersWhileBackbufferDiscardedShouldIgnoreSwapAndDamageRootLayer)
+// Begin drawing a frame while a framebuffer is discarded.
+// Expected: will recreate framebuffer.
+TEST_F(LayerRendererChromiumTest, DiscardedBackbufferIsRecreatedForScopeDuration)
 {
+    m_layerRendererChromium.setVisible(false);
     m_mockContext.setMemoryAllocation(m_suggestHaveBackbufferNo);
     EXPECT_TRUE(m_layerRendererChromium.isFramebufferDiscarded());
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
-    swapBuffers();
-    EXPECT_EQ(0, m_mockContext.frameCount());
-    EXPECT_EQ(2, m_mockClient.setFullRootLayerDamageCount());
+    m_layerRendererChromium.setVisible(true);
+    m_layerRendererChromium.beginDrawingFrame(m_mockClient.rootRenderPass());
+    EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
     swapBuffers();
-    EXPECT_EQ(0, m_mockContext.frameCount());
-    EXPECT_EQ(3, m_mockClient.setFullRootLayerDamageCount());
+    EXPECT_EQ(1, m_mockContext.frameCount());
 }
 
-// Test LayerRendererChromium discardFramebuffer functionality:
-// Begin drawing a frame while a framebuffer is discarded.
-// Expected: will recreate framebuffer.
-TEST_F(LayerRendererChromiumTest, DiscardedBackbufferIsRecreatredForScopeDuration)
+TEST_F(LayerRendererChromiumTest, FramebufferDiscardedAfterReadbackWhenNotVisible)
 {
+    m_layerRendererChromium.setVisible(false);
     m_mockContext.setMemoryAllocation(m_suggestHaveBackbufferNo);
     EXPECT_TRUE(m_layerRendererChromium.isFramebufferDiscarded());
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
+    char pixels[4];
     m_layerRendererChromium.beginDrawingFrame(m_mockClient.rootRenderPass());
     EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
-    swapBuffers();
-    EXPECT_EQ(1, m_mockContext.frameCount());
+    m_layerRendererChromium.getFramebufferPixels(pixels, IntRect(0, 0, 1, 1));
+    EXPECT_TRUE(m_layerRendererChromium.isFramebufferDiscarded());
+    EXPECT_EQ(2, m_mockClient.setFullRootLayerDamageCount());
 }
 
 class ForbidSynchronousCallContext : public FakeWebGraphicsContext3D {
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index 5e301d8eb..9495e706a 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -31,6 +31,7 @@
 #include "CCTiledLayerTestCommon.h"
 #include "FakeCCLayerTreeHostClient.h"
 #include "WebCompositor.h"
+#include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
 #include <gtest/gtest.h>
 #include <public/WebTransformationMatrix.h>
@@ -798,6 +799,7 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
     WebKit::WebCompositor::initialize(0);
     FakeCCLayerTreeHostClient fakeCCLayerTreeHostClient;
     OwnPtr<CCLayerTreeHost> ccLayerTreeHost = CCLayerTreeHost::create(&fakeCCLayerTreeHostClient, CCLayerTreeSettings());
+    ASSERT_TRUE(ccLayerTreeHost->initializeLayerRendererIfNeeded());
 
     // Create two 300 x 300 tiled layers.
     IntSize contentBounds(300, 300);
@@ -822,8 +824,7 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
 
     ccLayerTreeHost->setRootLayer(rootLayer);
     ccLayerTreeHost->setViewportSize(IntSize(300, 300));
-    textureManager->setMaxMemoryLimitBytes(memoryLimit);
-    ccLayerTreeHost->updateLayers(updater);
+    ccLayerTreeHost->updateLayers(updater, memoryLimit);
 
     // We'll skip the root layer.
     EXPECT_TRUE(rootLayer->skipsDraw());
@@ -835,7 +836,7 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
     // Remove the child layer.
     rootLayer->removeAllChildren();
 
-    ccLayerTreeHost->updateLayers(updater);
+    ccLayerTreeHost->updateLayers(updater, memoryLimit);
     EXPECT_FALSE(rootLayer->skipsDraw());
 
     ccLayerTreeHost->setRootLayer(0);
@@ -881,6 +882,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
 
     FakeCCLayerTreeHostClient fakeCCLayerTreeHostClient;
     OwnPtr<CCLayerTreeHost> ccLayerTreeHost = CCLayerTreeHost::create(&fakeCCLayerTreeHostClient, settings);
+    ASSERT_TRUE(ccLayerTreeHost->initializeLayerRendererIfNeeded());
 
     // Create one 500 x 300 tiled layer.
     IntSize contentBounds(300, 200);
@@ -901,7 +903,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     ccLayerTreeHost->setViewportSize(IntSize(300, 200));
 
     // Full update of all 6 tiles.
-    ccLayerTreeHost->updateLayers(updater);
+    ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
@@ -919,7 +921,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
 
     // Full update of 3 tiles and partial update of 3 tiles.
     layer->invalidateRect(IntRect(0, 0, 300, 150));
-    ccLayerTreeHost->updateLayers(updater);
+    ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
@@ -940,7 +942,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-        ccLayerTreeHost->updateLayers(updater);
+        ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         updater.update(0, &allocator, &copier, &uploader, 4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
@@ -967,7 +969,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-        ccLayerTreeHost->updateLayers(updater);
+        ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         updater.update(0, &allocator, &copier, &uploader, 4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
@@ -985,7 +987,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-        ccLayerTreeHost->updateLayers(updater);
+        ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
         updater.update(0, &allocator, &copier, &uploader, 4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
diff --git a/Source/WebKit/chromium/tests/WebViewTest.cpp b/Source/WebKit/chromium/tests/WebViewTest.cpp
index aef5c94ce..f858fe7b5 100644
--- a/Source/WebKit/chromium/tests/WebViewTest.cpp
+++ b/Source/WebKit/chromium/tests/WebViewTest.cpp
@@ -306,4 +306,23 @@ TEST_F(WebViewTest, DISABLED_TextInputType)
 
 }
 
+TEST_F(WebViewTest, SetEditableSelectionOffsets)
+{
+    FrameTestHelpers::registerMockedURLLoad(m_baseURL, "input_field_populated.html");
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "input_field_populated.html");
+    webView->setInitialFocus(false);
+    webView->setEditableSelectionOffsets(5, 13);
+    WebFrameImpl* frame = static_cast<WebFrameImpl*>(webView->mainFrame());
+    EXPECT_EQ("56789abc", frame->selectionAsText());
+    webView->close();
+
+    FrameTestHelpers::registerMockedURLLoad(m_baseURL, "content_editable_populated.html");
+    webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "content_editable_populated.html");
+    webView->setInitialFocus(false);
+    webView->setEditableSelectionOffsets(8, 19);
+    frame = static_cast<WebFrameImpl*>(webView->mainFrame());
+    EXPECT_EQ("89abcdefghi", frame->selectionAsText());
+    webView->close();
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/data/content_editable_populated.html b/Source/WebKit/chromium/tests/data/content_editable_populated.html
new file mode 100644
index 000000000..f0d2a59a7
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/content_editable_populated.html
@@ -0,0 +1 @@
+<span contenteditable="true">0123456789abcdefghijklmnopqrstuvwxyz</span>
diff --git a/Source/WebKit/chromium/tests/data/input_field_populated.html b/Source/WebKit/chromium/tests/data/input_field_populated.html
new file mode 100644
index 000000000..4889ad491
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/input_field_populated.html
@@ -0,0 +1 @@
+<input value='0123456789abcdefghijklmnopqrstuvwxyz'/>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 63120b94a..2273bb34c 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,58 @@
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_script_execute):
+        * ewk/ewk_view.cpp:
+        (ewk_view_js_object_add):
+
+2012-06-22  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Support keyboard event
+        https://bugs.webkit.org/show_bug.cgi?id=89268
+
+        Reviewed by Chang Shu.
+
+        Extract keyDownCommandsMap and keyPressCommandsMap to share WebKit1/Efl and WebKit2/Efl.
+
+        * WebCoreSupport/EditorClientEfl.cpp:
+        (WebCore::EditorClientEfl::interpretKeyEvent):
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_script_execute):
+        * ewk/ewk_view.cpp:
+        (ewk_view_js_object_add):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+        
+        * WebCoreSupport/DeviceOrientationClientEfl.h:
+        (DeviceOrientationClientEfl):
+
 2012-06-19  Sergio Villar Senin  <svillar@igalia.com>
 
         Calling nativeImageForCurrentFrame() causes assertion failure: m_verifier.isSafeToUse()
diff --git a/Source/WebKit/efl/WebCoreSupport/DeviceOrientationClientEfl.h b/Source/WebKit/efl/WebCoreSupport/DeviceOrientationClientEfl.h
index b80077ca5..0bb197cb7 100644
--- a/Source/WebKit/efl/WebCoreSupport/DeviceOrientationClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DeviceOrientationClientEfl.h
@@ -20,8 +20,8 @@
 #ifndef DeviceOrientationClientEfl_h
 #define DeviceOrientationClientEfl_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 
 namespace WebCore {
 
@@ -33,7 +33,7 @@ public:
     virtual void setController(DeviceOrientationController*);
     virtual void startUpdating();
     virtual void stopUpdating();
-    virtual DeviceOrientation* lastOrientation() const;
+    virtual DeviceOrientationData* lastOrientation() const;
     virtual void deviceOrientationControllerDestroyed();
 
 private:
diff --git a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
index 82ec8456c..1846cc50c 100644
--- a/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/EditorClientEfl.cpp
@@ -25,6 +25,7 @@
 
 #include "DumpRenderTreeSupportEfl.h"
 #include "Editor.h"
+#include "EflKeyboardUtilities.h"
 #include "EventNames.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -279,110 +280,14 @@ void EditorClientEfl::toggleGrammarChecking()
     notImplemented();
 }
 
-static const unsigned CtrlKey = 1 << 0;
-static const unsigned AltKey = 1 << 1;
-static const unsigned ShiftKey = 1 << 2;
-
-struct KeyDownEntry {
-    unsigned virtualKey;
-    unsigned modifiers;
-    const char* name;
-};
-
-struct KeyPressEntry {
-    unsigned charCode;
-    unsigned modifiers;
-    const char* name;
-};
-
-static const KeyDownEntry keyDownEntries[] = {
-    { VK_LEFT,   0,                  "MoveLeft"                                    },
-    { VK_LEFT,   ShiftKey,           "MoveLeftAndModifySelection"                  },
-    { VK_LEFT,   CtrlKey,            "MoveWordLeft"                                },
-    { VK_LEFT,   CtrlKey | ShiftKey, "MoveWordLeftAndModifySelection"              },
-    { VK_RIGHT,  0,                  "MoveRight"                                   },
-    { VK_RIGHT,  ShiftKey,           "MoveRightAndModifySelection"                 },
-    { VK_RIGHT,  CtrlKey,            "MoveWordRight"                               },
-    { VK_RIGHT,  CtrlKey | ShiftKey, "MoveWordRightAndModifySelection"             },
-    { VK_UP,     0,                  "MoveUp"                                      },
-    { VK_UP,     ShiftKey,           "MoveUpAndModifySelection"                    },
-    { VK_PRIOR,  ShiftKey,           "MovePageUpAndModifySelection"                },
-    { VK_DOWN,   0,                  "MoveDown"                                    },
-    { VK_DOWN,   ShiftKey,           "MoveDownAndModifySelection"                  },
-    { VK_NEXT,   ShiftKey,           "MovePageDownAndModifySelection"              },
-    { VK_PRIOR,  0,                  "MovePageUp"                                  },
-    { VK_NEXT,   0,                  "MovePageDown"                                },
-    { VK_HOME,   0,                  "MoveToBeginningOfLine"                       },
-    { VK_HOME,   ShiftKey,           "MoveToBeginningOfLineAndModifySelection"     },
-    { VK_HOME,   CtrlKey,            "MoveToBeginningOfDocument"                   },
-    { VK_HOME,   CtrlKey | ShiftKey, "MoveToBeginningOfDocumentAndModifySelection" },
-
-    { VK_END,    0,                  "MoveToEndOfLine"                             },
-    { VK_END,    ShiftKey,           "MoveToEndOfLineAndModifySelection"           },
-    { VK_END,    CtrlKey,            "MoveToEndOfDocument"                         },
-    { VK_END,    CtrlKey | ShiftKey, "MoveToEndOfDocumentAndModifySelection"       },
-
-    { VK_BACK,   0,                  "DeleteBackward"                              },
-    { VK_BACK,   ShiftKey,           "DeleteBackward"                              },
-    { VK_DELETE, 0,                  "DeleteForward"                               },
-    { VK_BACK,   CtrlKey,            "DeleteWordBackward"                          },
-    { VK_DELETE, CtrlKey,            "DeleteWordForward"                           },
-
-    { 'B',       CtrlKey,            "ToggleBold"                                  },
-    { 'I',       CtrlKey,            "ToggleItalic"                                },
-
-    { VK_ESCAPE, 0,                  "Cancel"                                      },
-    { VK_OEM_PERIOD, CtrlKey,        "Cancel"                                      },
-    { VK_TAB,    0,                  "InsertTab"                                   },
-    { VK_TAB,    ShiftKey,           "InsertBacktab"                               },
-    { VK_RETURN, 0,                  "InsertNewline"                               },
-    { VK_RETURN, CtrlKey,            "InsertNewline"                               },
-    { VK_RETURN, AltKey,             "InsertNewline"                               },
-    { VK_RETURN, AltKey | ShiftKey,  "InsertNewline"                               },
-};
-
-static const KeyPressEntry keyPressEntries[] = {
-    { '\t',   0,                  "InsertTab"                                   },
-    { '\t',   ShiftKey,           "InsertBacktab"                               },
-    { '\r',   0,                  "InsertNewline"                               },
-    { '\r',   CtrlKey,            "InsertNewline"                               },
-    { '\r',   AltKey,             "InsertNewline"                               },
-    { '\r',   AltKey | ShiftKey,  "InsertNewline"                               },
-};
-
 const char* EditorClientEfl::interpretKeyEvent(const KeyboardEvent* event)
 {
     ASSERT(event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent);
 
-    static HashMap<int, const char*>* keyDownCommandsMap = 0;
-    static HashMap<int, const char*>* keyPressCommandsMap = 0;
-
-    if (!keyDownCommandsMap) {
-        keyDownCommandsMap = new HashMap<int, const char*>;
-        keyPressCommandsMap = new HashMap<int, const char*>;
-
-        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyDownEntries); ++i)
-            keyDownCommandsMap->set(keyDownEntries[i].modifiers << 16 | keyDownEntries[i].virtualKey, keyDownEntries[i].name);
-
-        for (size_t i = 0; i < WTF_ARRAY_LENGTH(keyPressEntries); ++i)
-            keyPressCommandsMap->set(keyPressEntries[i].modifiers << 16 | keyPressEntries[i].charCode, keyPressEntries[i].name);
-    }
-
-    unsigned modifiers = 0;
-    if (event->shiftKey())
-        modifiers |= ShiftKey;
-    if (event->altKey())
-        modifiers |= AltKey;
-    if (event->ctrlKey())
-        modifiers |= CtrlKey;
-
-    if (event->type() == eventNames().keydownEvent) {
-        int mapKey = modifiers << 16 | event->keyCode();
-        return mapKey ? keyDownCommandsMap->get(mapKey) : 0;
-    }
+    if (event->type() == eventNames().keydownEvent)
+        return getKeyDownCommandName(event);
 
-    int mapKey = modifiers << 16 | event->charCode();
-    return mapKey ? keyPressCommandsMap->get(mapKey) : 0;
+    return getKeyPressCommandName(event);
 }
 
 bool EditorClientEfl::handleEditingKeyboardEvent(KeyboardEvent* event)
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 661716e51..0d08434c9 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,121 @@
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::gcCountJavascriptObjects):
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::gcCountJavascriptObjects):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+        
+        * WebCoreSupport/DeviceOrientationClientGtk.h:
+        (DeviceOrientationClientGtk):
+
+2012-06-21  Daniel Drake  <dsd@laptop.org>
+
+        [GTK] Backport run-file-chooser to WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=87283
+
+        Reviewed by Gustavo Noronha Silva.
+
+        This is a relatively straightforward backport of Mario Sanchez
+        Prada's WebKit2 run-file-chooser signal work, intended for use by
+        OLPC and others who are not quite ready to move to WebKit2.
+
+        Add a new public class to the API, WebKitFileChooserRequest, to be
+        emitted along with a new WebKitWebView::run-file-chooser signal to
+        let client applications to provide their own file chooser dialog
+        when the use interacts with HTML Input elements of type 'file'.
+
+        * GNUmakefile.am: Added new source files and headers.
+        * webkit/webkitfilechooserrequest.cpp: Added.
+        (_WebKitFileChooserRequestPrivate):
+        (webkit_file_chooser_request_init):
+        (webkit_file_chooser_request_finalize):
+        (webkit_file_chooser_request_get_property):
+        (webkit_file_chooser_request_class_init):
+        (webkit_file_chooser_request_create):
+        (webkit_file_chooser_request_get_mime_types):
+        (webkit_file_chooser_request_get_mime_types_filter):
+        (webkit_file_chooser_request_get_select_multiple):
+        (webkit_file_chooser_request_select_files):
+        (webkit_file_chooser_request_get_selected_files):
+        * webkit/webkitfilechooserrequest.h: Added.
+        (_WebKitFileChooserRequest):
+        (_WebKitFileChooserRequestClass):
+        * webkit/webkitfilechooserrequestprivate.h: Added, 
+        containing the prototype of webkit_file_chooser_request_create.
+
+        Provide private API to make a file chooser request from the
+        WebView, and provide a default handler for it.
+
+        * webkit/webkitwebview.cpp:
+        (fileChooserDialogResponseCallback): Handler for the 'response'
+        signal for the GtkFileChooserDialog used in the default
+        handler. It will call to webkit_file_chooser_request_select_files
+        or webkit_file_chooser_request_cancel as needed.
+        (webkitWebViewRealRunFileChooser): Default handler for the new
+        'run-file-chooser' signal. It will create a GtkFileChooserDialog,
+        connect to the 'response' signal and show it.
+        (webkit_web_view_class_init): Connect the 'run-file-chooser'
+        signal to the default handler, webkitWebViewRunFileChooser.
+        (webkit_web_view_new):
+        (webkitWebViewRunFileChooserRequest):
+        * webkit/webkitwebview.h:
+        (_WebKitWebViewClass): Added prototype for the handler of the new
+        'run-file-chooser' signal.
+        * webkit/webkitwebviewprivate.h: Added prototype for
+        private new function webkitWebViewRunFileChooserRequest.
+
+        Update runOpenPanel to use the new API, including a default handler
+        with similar behaviour to before.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::runOpenPanel): Now creates an instance of
+        WebKitFileChooserRequest and asks the WebView to emit the
+        new 'run-file-chooser' signal with it.
+
+        Added the new public header to the main header.
+
+        * webkit/webkit.h: Added webkitfilechooserrequest.h
+
+        New unit tests for the new WebKitFileChooserRequest API.
+
+        * tests/testwebview.c: Various WebKitFileChooserRequest tests,
+        including MIME type filtering and selection handling.
+
+        Updated documentation related files with the new API.
+
+        * docs/webkitgtk-docs.sgml: Added new section.
+        * docs/webkitgtk-sections.txt: Added new API.
+        * docs/webkitgtk.types: Added get_type function.
+
 2012-06-19  Chang Wan Hong  <jourmoon@company100.net>
 
         Refine syncLayersTimeoutCallback for Accelerated Compositing.
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index f24c7a967..12ee765a3 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -114,6 +114,7 @@ webkitgtk_static_h_api += \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitdownload.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkiterror.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitfavicondatabase.h \
+	$(srcdir)/Source/WebKit/gtk/webkit/webkitfilechooserrequest.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitgeolocationpolicydecision.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkitglobals.h \
 	$(srcdir)/Source/WebKit/gtk/webkit/webkithittestresult.h \
@@ -221,6 +222,9 @@ webkitgtk_sources += \
 	Source/WebKit/gtk/webkit/webkiterror.cpp \
 	Source/WebKit/gtk/webkit/webkitfavicondatabase.cpp \
 	Source/WebKit/gtk/webkit/webkitfavicondatabaseprivate.h \
+	Source/WebKit/gtk/webkit/webkitfilechooserrequest.cpp \
+	Source/WebKit/gtk/webkit/webkitfilechooserrequest.h \
+	Source/WebKit/gtk/webkit/webkitfilechooserrequestprivate.h \
 	Source/WebKit/gtk/webkit/webkitgeolocationpolicydecision.cpp \
 	Source/WebKit/gtk/webkit/webkitgeolocationpolicydecisionprivate.h \
 	Source/WebKit/gtk/webkit/webkitglobals.cpp \
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 1a991b936..3b309f8b8 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -55,6 +55,7 @@
 #include "WebKitDOMBinding.h"
 #include "WebKitDOMHTMLElementPrivate.h"
 #include "WindowFeatures.h"
+#include "webkitfilechooserrequestprivate.h"
 #include "webkitgeolocationpolicydecision.h"
 #include "webkitgeolocationpolicydecisionprivate.h"
 #include "webkitnetworkrequest.h"
@@ -815,40 +816,8 @@ void ChromeClient::reachedApplicationCacheOriginQuota(SecurityOrigin*, int64_t)
 
 void ChromeClient::runOpenPanel(Frame*, PassRefPtr<FileChooser> prpFileChooser)
 {
-    RefPtr<FileChooser> chooser = prpFileChooser;
-
-    GtkWidget* toplevel = gtk_widget_get_toplevel(GTK_WIDGET(m_webView));
-    if (!widgetIsOnscreenToplevelWindow(toplevel))
-        toplevel = 0;
-
-    GtkWidget* dialog = gtk_file_chooser_dialog_new(_("Upload File"),
-                                                    toplevel ? GTK_WINDOW(toplevel) : 0,
-                                                    GTK_FILE_CHOOSER_ACTION_OPEN,
-                                                    GTK_STOCK_CANCEL, GTK_RESPONSE_CANCEL,
-                                                    GTK_STOCK_OPEN, GTK_RESPONSE_ACCEPT,
-                                                    NULL);
-
-    gtk_file_chooser_set_select_multiple(GTK_FILE_CHOOSER(dialog), chooser->settings().allowsMultipleFiles);
-
-    if (gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_ACCEPT) {
-        if (gtk_file_chooser_get_select_multiple(GTK_FILE_CHOOSER(dialog))) {
-            GOwnPtr<GSList> filenames(gtk_file_chooser_get_filenames(GTK_FILE_CHOOSER(dialog)));
-            Vector<String> names;
-            for (GSList* item = filenames.get() ; item ; item = item->next) {
-                if (!item->data)
-                    continue;
-                names.append(filenameToString(static_cast<char*>(item->data)));
-                g_free(item->data);
-            }
-            chooser->chooseFiles(names);
-        } else {
-            gchar* filename = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(dialog));
-            if (filename)
-                chooser->chooseFile(filenameToString(filename));
-            g_free(filename);
-        }
-    }
-    gtk_widget_destroy(dialog);
+    GRefPtr<WebKitFileChooserRequest> request = adoptGRef(webkit_file_chooser_request_create(prpFileChooser));
+    webkitWebViewRunFileChooserRequest(m_webView, request.get());
 }
 
 void ChromeClient::loadIconForFiles(const Vector<WTF::String>& filenames, WebCore::FileIconLoader* loader)
diff --git a/Source/WebKit/gtk/WebCoreSupport/DeviceOrientationClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/DeviceOrientationClientGtk.h
index 2c529495f..fcaa2d2e8 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DeviceOrientationClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DeviceOrientationClientGtk.h
@@ -21,8 +21,8 @@
 #ifndef DeviceOrientationClientGtk_h
 #define DeviceOrientationClientGtk_h
 
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClient.h"
+#include "DeviceOrientationData.h"
 
 namespace WebKit {
 
@@ -34,7 +34,7 @@ public:
     virtual void setController(WebCore::DeviceOrientationController*);
     virtual void startUpdating();
     virtual void stopUpdating();
-    virtual WebCore::DeviceOrientation* lastOrientation() const;
+    virtual WebCore::DeviceOrientationData* lastOrientation() const;
     virtual void deviceOrientationControllerDestroyed();
 
 private:
diff --git a/Source/WebKit/gtk/docs/webkitgtk-docs.sgml b/Source/WebKit/gtk/docs/webkitgtk-docs.sgml
index b4eb26d65..72106522f 100644
--- a/Source/WebKit/gtk/docs/webkitgtk-docs.sgml
+++ b/Source/WebKit/gtk/docs/webkitgtk-docs.sgml
@@ -41,6 +41,7 @@
     <xi:include href="xml/webkiticondatabase.xml"/>
     <xi:include href="xml/webkitspellchecker.xml"/>
     <xi:include href="xml/webkitfavicondatabase.xml"/>
+    <xi:include href="xml/webkitfilechooserrequest.xml"/>
   </chapter>
 
   <chapter>
diff --git a/Source/WebKit/gtk/docs/webkitgtk-sections.txt b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
index c97489b6c..f6589a22f 100644
--- a/Source/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -703,6 +703,30 @@ WebKitFaviconDatabasePrivate
 </SECTION>
 
 <SECTION>
+<FILE>webkitfilechooserrequest</FILE>
+<TITLE>WebKitFileChooserRequest</TITLE>
+WebKitFileChooserRequest
+webkit_file_chooser_request_get_select_multiple
+webkit_file_chooser_request_get_mime_types
+webkit_file_chooser_request_get_mime_types_filter
+webkit_file_chooser_request_get_selected_files
+webkit_file_chooser_request_select_files
+
+<SUBSECTION Standard>
+WEBKIT_TYPE_FILE_CHOOSER_REQUEST
+WEBKIT_FILE_CHOOSER_REQUEST
+WEBKIT_IS_FILE_CHOOSER_REQUEST
+WEBKIT_FILE_CHOOSER_REQUEST_CLASS
+WEBKIT_IS_FILE_CHOOSER_REQUEST_CLASS
+WEBKIT_FILE_CHOOSER_REQUEST_GET_CLASS
+
+<SUBSECTION Private>
+WebKitFileChooserRequestClass
+WebKitFileChooserRequestPrivate
+webkit_file_chooser_request_get_type
+</SECTION>
+
+<SECTION>
 <FILE>webkitdefines</FILE>
 WEBKIT_API
 WEBKITGTK_API_VERSION
diff --git a/Source/WebKit/gtk/docs/webkitgtk.types b/Source/WebKit/gtk/docs/webkitgtk.types
index 2be1a8c74..8049b5c04 100644
--- a/Source/WebKit/gtk/docs/webkitgtk.types
+++ b/Source/WebKit/gtk/docs/webkitgtk.types
@@ -1,6 +1,7 @@
 #include <webkit/webkit.h>
 webkit_download_get_type
 webkit_favicon_database_get_type
+webkit_file_chooser_request_get_type
 webkit_geolocation_policy_decision_get_type
 webkit_hit_test_result_get_type
 webkit_icon_database_get_type
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index 22dff131c..f71aa42b4 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -506,6 +506,186 @@ static void test_webkit_web_view_fullscreen(gconstpointer blocked)
     gtk_widget_destroy(window);
 }
 
+static gboolean checkMimeTypeForFilter(GtkFileFilter* filter, const gchar* mimeType)
+{
+    GtkFileFilterInfo filter_info;
+    filter_info.contains = GTK_FILE_FILTER_MIME_TYPE;
+    filter_info.mime_type = mimeType;
+    return gtk_file_filter_filter(filter, &filter_info);
+}
+
+static gboolean runFileChooserCbNoMultiselNoMime(WebKitWebView* webview, WebKitFileChooserRequest* request, gpointer data)
+{
+    g_assert(!webkit_file_chooser_request_get_select_multiple(request));
+
+    const gchar* const* mimeTypes = webkit_file_chooser_request_get_mime_types(request);
+    g_assert(!mimeTypes);
+    GtkFileFilter* filter = webkit_file_chooser_request_get_mime_types_filter(request);
+    g_assert(!filter);
+
+    const gchar* const* selectedFiles = webkit_file_chooser_request_get_selected_files(request);
+    g_assert(!selectedFiles);
+
+    g_main_loop_quit(loop);
+    return TRUE;
+}
+
+static gboolean runFileChooserCbMultiselNoMime(WebKitWebView* webview, WebKitFileChooserRequest* request, gpointer data)
+{
+    g_assert(webkit_file_chooser_request_get_select_multiple(request));
+
+    const gchar* const* mimeTypes = webkit_file_chooser_request_get_mime_types(request);
+    g_assert(!mimeTypes);
+    GtkFileFilter* filter = webkit_file_chooser_request_get_mime_types_filter(request);
+    g_assert(!filter);
+    const gchar* const* selectedFiles = webkit_file_chooser_request_get_selected_files(request);
+    g_assert(!selectedFiles);
+
+    // Select some files.
+    const gchar* filesToSelect[4] = { "/foo", "/foo/bar", "/foo/bar/baz", 0 };
+    webkit_file_chooser_request_select_files(request, filesToSelect);
+
+    // Check the files that have been just selected.
+    selectedFiles = webkit_file_chooser_request_get_selected_files(request);
+    g_assert(selectedFiles);
+    g_assert_cmpstr(selectedFiles[0], ==, "/foo");
+    g_assert_cmpstr(selectedFiles[1], ==, "/foo/bar");
+    g_assert_cmpstr(selectedFiles[2], ==, "/foo/bar/baz");
+    g_assert(!selectedFiles[3]);
+
+    g_main_loop_quit(loop);
+    return TRUE;
+}
+
+static gboolean runFileChooserCbSelectionRetained(WebKitWebView* webview, WebKitFileChooserRequest* request, gpointer data)
+{
+    const gchar* const* selectedFiles = webkit_file_chooser_request_get_selected_files(request);
+    g_assert(selectedFiles);
+    g_assert_cmpstr(selectedFiles[0], ==, "/foo");
+    g_assert_cmpstr(selectedFiles[1], ==, "/foo/bar");
+    g_assert_cmpstr(selectedFiles[2], ==, "/foo/bar/baz");
+    g_assert(!selectedFiles[3]);
+
+    g_main_loop_quit(loop);
+    return TRUE;
+}
+
+static gboolean runFileChooserCbNoMultiselAcceptTypes(WebKitWebView* webview, WebKitFileChooserRequest* request, gpointer data)
+{
+    g_assert(!webkit_file_chooser_request_get_select_multiple(request));
+
+    const gchar* const* mimeTypes = webkit_file_chooser_request_get_mime_types(request);
+    g_assert(mimeTypes);
+    g_assert_cmpstr(mimeTypes[0], ==, "audio/*");
+    g_assert_cmpstr(mimeTypes[1], ==, "video/*");
+    g_assert_cmpstr(mimeTypes[2], ==, "image/*");
+    g_assert(!mimeTypes[3]);
+
+    GtkFileFilter* filter = webkit_file_chooser_request_get_mime_types_filter(request);
+    g_assert(GTK_IS_FILE_FILTER(filter));
+    g_assert(checkMimeTypeForFilter(filter, "audio/*"));
+    g_assert(checkMimeTypeForFilter(filter, "video/*"));
+    g_assert(checkMimeTypeForFilter(filter, "image/*"));
+
+    const gchar* const* selectedFiles = webkit_file_chooser_request_get_selected_files(request);
+    g_assert(!selectedFiles);
+
+    g_main_loop_quit(loop);
+    return TRUE;
+}
+
+void doMouseButtonEvent(GtkWidget* widget, GdkEventType eventType, int x, int y, unsigned int button, unsigned int modifiers)
+{
+    g_assert(gtk_widget_get_realized(widget));
+
+    GdkEvent* event = gdk_event_new(eventType);
+    event->button.window = gtk_widget_get_window(widget);
+    g_object_ref(event->button.window);
+
+    event->button.time = GDK_CURRENT_TIME;
+    event->button.x = x;
+    event->button.y = y;
+    event->button.axes = 0;
+    event->button.state = modifiers;
+    event->button.button = button;
+
+    event->button.device = gdk_device_manager_get_client_pointer(gdk_display_get_device_manager(gtk_widget_get_display(widget)));
+
+    int xRoot, yRoot;
+    gdk_window_get_root_coords(gtk_widget_get_window(widget), x, y, &xRoot, &yRoot);
+    event->button.x_root = xRoot;
+    event->button.y_root = yRoot;
+    gtk_main_do_event(event);
+}
+
+static void clickMouseButton(GtkWidget* widget, int x, int y, unsigned int button, unsigned int modifiers)
+{
+    doMouseButtonEvent(widget, GDK_BUTTON_PRESS, x, y, button, modifiers);
+    doMouseButtonEvent(widget, GDK_BUTTON_RELEASE, x, y, button, modifiers);
+}
+
+static gboolean clickMouseButtonAndWaitForFileChooserRequest(WebKitWebView* webView)
+{
+    clickMouseButton(GTK_WIDGET(webView), 5, 5, 1, 0);
+    return TRUE;
+}
+
+static void test_webkit_web_view_file_chooser()
+{
+    const gchar* htmlFormatBase = "<html><body>"
+            "<input style='position:absolute;left:0;top:0;margin:0;padding:0' type='file' %s/>"
+            "</body></html>";
+
+    GtkWidget* window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
+    GtkWidget* webView = webkit_web_view_new();
+    gtk_container_add(GTK_CONTAINER(window), webView);
+    gtk_widget_show_all(window);
+
+    loop = g_main_loop_new(NULL, TRUE);
+
+    // Multiple selections not allowed, no MIME filtering.
+    gulong handler = g_signal_connect(webView, "run-file-chooser", G_CALLBACK(runFileChooserCbNoMultiselNoMime), NULL);
+    gchar* htmlFormat = g_strdup_printf(htmlFormatBase, "");
+    webkit_web_view_load_string(WEBKIT_WEB_VIEW(webView), htmlFormat, NULL, NULL, NULL);
+    g_free(htmlFormat);
+
+    g_timeout_add(100, (GSourceFunc) clickMouseButtonAndWaitForFileChooserRequest, WEBKIT_WEB_VIEW(webView));
+    g_main_loop_run(loop);
+
+    g_signal_handler_disconnect(webView, handler);
+
+    // Multiple selections allowed, no MIME filtering, some pre-selected files.
+    handler = g_signal_connect(webView, "run-file-chooser", G_CALLBACK(runFileChooserCbMultiselNoMime), NULL);
+    htmlFormat = g_strdup_printf(htmlFormatBase, "multiple");
+    webkit_web_view_load_string(WEBKIT_WEB_VIEW(webView), htmlFormat, NULL, NULL, NULL);
+    g_free(htmlFormat);
+
+    g_timeout_add(100, (GSourceFunc) clickMouseButtonAndWaitForFileChooserRequest, WEBKIT_WEB_VIEW(webView));
+    g_main_loop_run(loop);
+
+    g_signal_handler_disconnect(webView, handler);
+
+    // Perform another request to check if the list of files selected
+    // in the previous step appears now as part of the new request.
+    handler = g_signal_connect(webView, "run-file-chooser", G_CALLBACK(runFileChooserCbSelectionRetained), NULL);
+    g_timeout_add(100, (GSourceFunc) clickMouseButtonAndWaitForFileChooserRequest, WEBKIT_WEB_VIEW(webView));
+    g_main_loop_run(loop);
+
+    g_signal_handler_disconnect(webView, handler);
+
+    // Multiple selections not allowed, only accept images, audio and video files.
+    handler = g_signal_connect(webView, "run-file-chooser", G_CALLBACK(runFileChooserCbNoMultiselAcceptTypes), NULL);
+    htmlFormat = g_strdup_printf(htmlFormatBase, "accept='audio/*,video/*,image/*'");
+    webkit_web_view_load_string(WEBKIT_WEB_VIEW(webView), htmlFormat, NULL, NULL, NULL);
+    g_free(htmlFormat);
+
+    g_timeout_add(100, (GSourceFunc) clickMouseButtonAndWaitForFileChooserRequest, WEBKIT_WEB_VIEW(webView));
+    g_main_loop_run(loop);
+
+    g_signal_handler_disconnect(webView, handler);
+    gtk_widget_destroy(window);
+}
+
 int main(int argc, char** argv)
 {
     SoupServer* server;
@@ -537,6 +717,7 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/webview/webview-does-not-steal-focus", test_webkit_web_view_does_not_steal_focus);
     g_test_add_data_func("/webkit/webview/fullscreen", GINT_TO_POINTER(FALSE), test_webkit_web_view_fullscreen);
     g_test_add_data_func("/webkit/webview/fullscreen-blocked", GINT_TO_POINTER(TRUE), test_webkit_web_view_fullscreen);
+    g_test_add_func("/webkit/webview/file-chooser", test_webkit_web_view_file_chooser);
 
     return g_test_run ();
 }
diff --git a/Source/WebKit/gtk/webkit/webkit.h b/Source/WebKit/gtk/webkit/webkit.h
index c7e95e8ed..aa7b93dbd 100644
--- a/Source/WebKit/gtk/webkit/webkit.h
+++ b/Source/WebKit/gtk/webkit/webkit.h
@@ -28,6 +28,7 @@
 #include <webkit/webkitdownload.h>
 #include <webkit/webkitenumtypes.h>
 #include <webkit/webkitfavicondatabase.h>
+#include <webkit/webkitfilechooserrequest.h>
 #include <webkit/webkitgeolocationpolicydecision.h>
 #include <webkit/webkitglobals.h>
 #include <webkit/webkithittestresult.h>
diff --git a/Source/WebKit/gtk/webkit/webkitfilechooserrequest.cpp b/Source/WebKit/gtk/webkit/webkitfilechooserrequest.cpp
new file mode 100644
index 000000000..c1373ed49
--- /dev/null
+++ b/Source/WebKit/gtk/webkit/webkitfilechooserrequest.cpp
@@ -0,0 +1,367 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "webkitfilechooserrequest.h"
+
+#include "FileChooser.h"
+#include "FileSystem.h"
+#include "webkitfilechooserrequestprivate.h"
+#include "webkitglobalsprivate.h"
+#include <glib/gi18n-lib.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
+#include <wtf/text/CString.h>
+
+using namespace WebCore;
+
+/**
+ * SECTION:webkitfilechooserrequest
+ * @Short_description: A request to open a file chooser
+ * @Title: WebKitFileChooserRequest
+ * @See_also: #WebKitWebView
+ *
+ * Whenever the user interacts with an &lt;input type='file' /&gt;
+ * HTML element, WebKit will need to show a dialog to choose one or
+ * more files to be uploaded to the server along with the rest of the
+ * form data. For that to happen in a general way, instead of just
+ * opening a #GtkFileChooserDialog (which might be not desirable in
+ * some cases, such as when an embedding applications prefers to use
+ * its own file chooser dialog), WebKit will fire the
+ * #WebKitWebView::run-file-chooser signal with a
+ * #WebKitFileChooserRequest object, which will allow the client
+ * application to specify the files to be selected, to inspect the
+ * details of the request (e.g. if multiple selection should be
+ * allowed) and to cancel the request, in case nothing was selected.
+ *
+ * In case the client application does not wish to handle this signal,
+ * WebKit will provide a default handler which will asynchronously run
+ * a regular #GtkFileChooserDialog for the user to interact with.
+ */
+G_DEFINE_TYPE(WebKitFileChooserRequest, webkit_file_chooser_request, G_TYPE_OBJECT)
+
+struct _WebKitFileChooserRequestPrivate {
+    RefPtr<FileChooser> chooser;
+    GRefPtr<GtkFileFilter> filter;
+    GRefPtr<GPtrArray> mimeTypes;
+    GRefPtr<GPtrArray> selectedFiles;
+};
+
+enum {
+    PROP_0,
+    PROP_FILTER,
+    PROP_MIME_TYPES,
+    PROP_SELECT_MULTIPLE,
+    PROP_SELECTED_FILES,
+};
+
+static void webkit_file_chooser_request_init(WebKitFileChooserRequest* request)
+{
+    request->priv = G_TYPE_INSTANCE_GET_PRIVATE(request, WEBKIT_TYPE_FILE_CHOOSER_REQUEST, WebKitFileChooserRequestPrivate);
+    new (request->priv) WebKitFileChooserRequestPrivate();
+}
+
+static void webkit_file_chooser_request_finalize(GObject* object)
+{
+    WebKitFileChooserRequest* request = WEBKIT_FILE_CHOOSER_REQUEST(object);
+
+    request->priv->~WebKitFileChooserRequestPrivate();
+    G_OBJECT_CLASS(webkit_file_chooser_request_parent_class)->finalize(object);
+}
+
+static void webkit_file_chooser_request_get_property(GObject* object, guint propId, GValue* value, GParamSpec* paramSpec)
+{
+    WebKitFileChooserRequest* request = WEBKIT_FILE_CHOOSER_REQUEST(object);
+    switch (propId) {
+    case PROP_FILTER:
+        g_value_set_object(value, webkit_file_chooser_request_get_mime_types_filter(request));
+        break;
+    case PROP_MIME_TYPES:
+        g_value_set_boxed(value, webkit_file_chooser_request_get_mime_types(request));
+        break;
+    case PROP_SELECT_MULTIPLE:
+        g_value_set_boolean(value, webkit_file_chooser_request_get_select_multiple(request));
+        break;
+    case PROP_SELECTED_FILES:
+        g_value_set_boxed(value, webkit_file_chooser_request_get_selected_files(request));
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
+        break;
+    }
+}
+
+static void webkit_file_chooser_request_class_init(WebKitFileChooserRequestClass* requestClass)
+{
+    GObjectClass* objectClass = G_OBJECT_CLASS(requestClass);
+    objectClass->finalize = webkit_file_chooser_request_finalize;
+    objectClass->get_property = webkit_file_chooser_request_get_property;
+    g_type_class_add_private(requestClass, sizeof(WebKitFileChooserRequestPrivate));
+
+    /**
+     * WebKitFileChooserRequest:filter:
+     *
+     * The filter currently associated with the request. See
+     * webkit_file_chooser_request_get_mime_types_filter() for more
+     * details.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_FILTER,
+                                    g_param_spec_object("filter",
+                                                      _("MIME types filter"),
+                                                      _("The filter currently associated with the request"),
+                                                      GTK_TYPE_FILE_FILTER,
+                                                      WEBKIT_PARAM_READABLE));
+    /**
+     * WebKitFileChooserRequest:mime-types:
+     *
+     * A %NULL-terminated array of strings containing the list of MIME
+     * types the file chooser dialog should handle. See
+     * webkit_file_chooser_request_get_mime_types() for more details.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_MIME_TYPES,
+                                    g_param_spec_boxed("mime-types",
+                                                      _("MIME types"),
+                                                      _("The list of MIME types associated with the request"),
+                                                      G_TYPE_STRV,
+                                                      WEBKIT_PARAM_READABLE));    /**
+     * WebKitFileChooserRequest:select-multiple:
+     *
+     * Whether the file chooser should allow selecting multiple
+     * files. See
+     * webkit_file_chooser_request_get_select_multiple() for
+     * more details.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_SELECT_MULTIPLE,
+                                    g_param_spec_boolean("select-multiple",
+                                                       _("Select multiple files"),
+                                                       _("Whether the file chooser should allow selecting multiple files"),
+                                                       FALSE,
+                                                       WEBKIT_PARAM_READABLE));
+    /**
+     * WebKitFileChooserRequest:selected-files:
+     *
+     * A %NULL-terminated array of strings containing the list of
+     * selected files associated to the current request. See
+     * webkit_file_chooser_request_get_selected_files() for more details.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_SELECTED_FILES,
+                                    g_param_spec_boxed("selected-files",
+                                                      _("Selected files"),
+                                                      _("The list of selected files associated with the request"),
+                                                      G_TYPE_STRV,
+                                                      WEBKIT_PARAM_READABLE));
+}
+
+WebKitFileChooserRequest* webkit_file_chooser_request_create(PassRefPtr<FileChooser> chooser)
+{
+    WebKitFileChooserRequest* request = WEBKIT_FILE_CHOOSER_REQUEST(g_object_new(WEBKIT_TYPE_FILE_CHOOSER_REQUEST, NULL));
+    request->priv->chooser = chooser;
+    return request;
+}
+
+/**
+ * webkit_file_chooser_request_get_mime_types:
+ * @request: a #WebKitFileChooserRequest
+ *
+ * Get the list of MIME types the file chooser dialog should handle,
+ * in the format specified in RFC 2046 for "media types". Its contents
+ * depend on the value of the 'accept' attribute for HTML input
+ * elements. This function should normally be called before presenting
+ * the file chooser dialog to the user, to decide whether to allow the
+ * user to select multiple files at once or only one.
+ *
+ * Returns: (array zero-terminated=1) (transfer none): a
+ * %NULL-terminated array of strings if a list of accepted MIME types
+ * is defined or %NULL otherwise, meaning that any MIME type should be
+ * accepted. This array and its contents are owned by WebKitGTK+ and
+ * should not be modified or freed.
+ *
+ * Since: 1.10
+ */
+const gchar* const* webkit_file_chooser_request_get_mime_types(WebKitFileChooserRequest* request)
+{
+    g_return_val_if_fail(WEBKIT_IS_FILE_CHOOSER_REQUEST(request), 0);
+    if (request->priv->mimeTypes)
+        return reinterpret_cast<gchar**>(request->priv->mimeTypes->pdata);
+
+    FileChooserSettings settings = request->priv->chooser->settings();
+    size_t numOfMimeTypes = settings.acceptMIMETypes.size();
+    if (!numOfMimeTypes)
+        return 0;
+
+    request->priv->mimeTypes = adoptGRef(g_ptr_array_new_with_free_func(g_free));
+    for (size_t i = 0; i < numOfMimeTypes; ++i) {
+        String mimeTypeString = settings.acceptMIMETypes[i];
+        if (mimeTypeString.isEmpty())
+            continue;
+        g_ptr_array_add(request->priv->mimeTypes.get(), g_strdup(mimeTypeString.utf8().data()));
+    }
+    g_ptr_array_add(request->priv->mimeTypes.get(), 0);
+
+    return reinterpret_cast<gchar**>(request->priv->mimeTypes->pdata);
+}
+
+/**
+ * webkit_file_chooser_request_get_mime_types_filter:
+ * @request: a #WebKitFileChooserRequest
+ *
+ * Get the filter currently associated with the request, ready to be
+ * used by #GtkFileChooser. This function should normally be called
+ * before presenting the file chooser dialog to the user, to decide
+ * whether to apply a filter so the user would not be allowed to
+ * select files with other MIME types.
+ *
+ * See webkit_file_chooser_request_get_mime_types() if you are
+ * interested in getting the list of accepted MIME types.
+ *
+ * Returns: (transfer none): a #GtkFileFilter if a list of accepted
+ * MIME types is defined or %NULL otherwise. The returned object is
+ * owned by WebKitGTK+ should not be modified or freed.
+ *
+ * Since: 1.10
+ */
+GtkFileFilter* webkit_file_chooser_request_get_mime_types_filter(WebKitFileChooserRequest* request)
+{
+    g_return_val_if_fail(WEBKIT_IS_FILE_CHOOSER_REQUEST(request), 0);
+    if (request->priv->filter)
+        return request->priv->filter.get();
+
+    FileChooserSettings settings = request->priv->chooser->settings();
+    size_t numOfMimeTypes = settings.acceptMIMETypes.size();
+    if (!numOfMimeTypes)
+        return 0;
+
+    // Do not use adoptGRef here, since we want to sink the floating
+    // reference for the new instance of GtkFileFilter, so we make
+    // sure we keep the ownership during the lifetime of the request.
+    request->priv->filter = gtk_file_filter_new();
+    for (size_t i = 0; i < numOfMimeTypes; ++i) {
+        String mimeTypeString = settings.acceptMIMETypes[i];
+        if (mimeTypeString.isEmpty())
+            continue;
+        gtk_file_filter_add_mime_type(request->priv->filter.get(), mimeTypeString.utf8().data());
+    }
+
+    return request->priv->filter.get();
+}
+
+/**
+ * webkit_file_chooser_request_get_select_multiple:
+ * @request: a #WebKitFileChooserRequest
+ *
+ * Determine whether the file chooser associated to this
+ * #WebKitFileChooserRequest should allow selecting multiple files,
+ * which depends on the HTML input element having a 'multiple'
+ * attribute defined.
+ *
+ * Returns: %TRUE if the file chooser should allow selecting multiple files or %FALSE otherwise.
+ *
+ * Since: 1.10
+ */
+gboolean webkit_file_chooser_request_get_select_multiple(WebKitFileChooserRequest* request)
+{
+    g_return_val_if_fail(WEBKIT_IS_FILE_CHOOSER_REQUEST(request), FALSE);
+    return request->priv->chooser->settings().allowsMultipleFiles;
+}
+
+/**
+ * webkit_file_chooser_request_select_files:
+ * @request: a #WebKitFileChooserRequest
+ * @files: (array zero-terminated=1) (transfer none): a
+ * %NULL-terminated array of strings, containing paths to local files.
+ *
+ * Ask WebKit to select local files for upload and complete the
+ * request.
+ *
+ * Since: 1.10
+ */
+void webkit_file_chooser_request_select_files(WebKitFileChooserRequest* request, const gchar* const* files)
+{
+    g_return_if_fail(WEBKIT_IS_FILE_CHOOSER_REQUEST(request));
+    g_return_if_fail(files);
+
+    Vector<String> names;
+    GRefPtr<GPtrArray> selectedFiles = adoptGRef(g_ptr_array_new_with_free_func(g_free));
+
+    for (int i = 0; files[i]; i++) {
+        names.append(filenameToString(files[i]));
+        g_ptr_array_add(selectedFiles.get(), g_strdup(files[i]));
+    }
+
+    g_ptr_array_add(selectedFiles.get(), 0);
+    request->priv->chooser->chooseFiles(names);
+    request->priv->selectedFiles = selectedFiles;
+}
+
+/**
+ * webkit_file_chooser_request_get_selected_files:
+ * @request: a #WebKitFileChooserRequest
+ *
+ * Get the list of selected files currently associated to the
+ * request. Initially, the return value of this method contains any
+ * files selected in previous file chooser requests for this HTML
+ * input element. Once webkit_file_chooser_request_select_files, the
+ * value will reflect whatever files are given.
+ *
+ * This function should normally be called only before presenting the
+ * file chooser dialog to the user, to decide whether to perform some
+ * extra action, like pre-selecting the files from a previous request.
+ *
+ * Returns: (array zero-terminated=1) (transfer none): a
+ * %NULL-terminated array of strings if there are selected files
+ * associated with the request or %NULL otherwise. This array and its
+ * contents are owned by WebKitGTK+ and should not be modified or
+ * freed.
+ *
+ * Since: 1.10
+ */
+const gchar* const* webkit_file_chooser_request_get_selected_files(WebKitFileChooserRequest* request)
+{
+    g_return_val_if_fail(WEBKIT_IS_FILE_CHOOSER_REQUEST(request), 0);
+    if (request->priv->selectedFiles)
+        return reinterpret_cast<gchar**>(request->priv->selectedFiles->pdata);
+
+    FileChooserSettings settings = request->priv->chooser->settings();
+    size_t numOfFiles = settings.selectedFiles.size();
+    if (!numOfFiles)
+        return 0;
+
+    request->priv->selectedFiles = adoptGRef(g_ptr_array_new_with_free_func(g_free));
+    for (size_t i = 0; i < numOfFiles; ++i) {
+        if (settings.selectedFiles[i].isEmpty())
+            continue;
+        CString filename = fileSystemRepresentation(settings.selectedFiles[i]);
+        g_ptr_array_add(request->priv->selectedFiles.get(), g_strdup(filename.data()));
+    }
+    g_ptr_array_add(request->priv->selectedFiles.get(), 0);
+
+    return reinterpret_cast<gchar**>(request->priv->selectedFiles->pdata);
+}
diff --git a/Source/WebKit/gtk/webkit/webkitfilechooserrequest.h b/Source/WebKit/gtk/webkit/webkitfilechooserrequest.h
new file mode 100644
index 000000000..dea94c860
--- /dev/null
+++ b/Source/WebKit/gtk/webkit/webkitfilechooserrequest.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitfilechooserrequest_h
+#define webkitfilechooserrequest_h
+
+#include <gtk/gtk.h>
+#include <webkit/webkitdefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_FILE_CHOOSER_REQUEST            (webkit_file_chooser_request_get_type())
+#define WEBKIT_FILE_CHOOSER_REQUEST(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_FILE_CHOOSER_REQUEST, WebKitFileChooserRequest))
+#define WEBKIT_FILE_CHOOSER_REQUEST_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_FILE_CHOOSER_REQUEST, WebKitFileChooserRequestClass))
+#define WEBKIT_IS_FILE_CHOOSER_REQUEST(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_FILE_CHOOSER_REQUEST))
+#define WEBKIT_IS_FILE_CHOOSER_REQUEST_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_FILE_CHOOSER_REQUEST))
+#define WEBKIT_FILE_CHOOSER_REQUEST_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_FILE_CHOOSER_REQUEST, WebKitFileChooserRequestClass))
+
+typedef struct _WebKitFileChooserRequest        WebKitFileChooserRequest;
+typedef struct _WebKitFileChooserRequestClass   WebKitFileChooserRequestClass;
+typedef struct _WebKitFileChooserRequestPrivate WebKitFileChooserRequestPrivate;
+
+struct _WebKitFileChooserRequest {
+    GObject parent;
+
+    /*< private >*/
+    WebKitFileChooserRequestPrivate *priv;
+};
+
+struct _WebKitFileChooserRequestClass {
+    GObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_file_chooser_request_get_type                  (void);
+
+WEBKIT_API const gchar * const *
+webkit_file_chooser_request_get_mime_types        (WebKitFileChooserRequest *request);
+
+WEBKIT_API GtkFileFilter *
+webkit_file_chooser_request_get_mime_types_filter (WebKitFileChooserRequest *request);
+
+WEBKIT_API gboolean
+webkit_file_chooser_request_get_select_multiple   (WebKitFileChooserRequest *request);
+
+WEBKIT_API void
+webkit_file_chooser_request_select_files          (WebKitFileChooserRequest *request,
+                                                   const gchar * const      *files);
+
+WEBKIT_API const gchar * const *
+webkit_file_chooser_request_get_selected_files    (WebKitFileChooserRequest *request);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit/gtk/webkit/webkitfilechooserrequestprivate.h b/Source/WebKit/gtk/webkit/webkitfilechooserrequestprivate.h
new file mode 100644
index 000000000..a41cc79f6
--- /dev/null
+++ b/Source/WebKit/gtk/webkit/webkitfilechooserrequestprivate.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef webkitfilechooserrequestprivate_h
+#define webkitfilechooserrequestprivate_h
+
+#include "FileChooser.h"
+#include "webkitfilechooserrequest.h"
+
+using namespace WebCore;
+
+WebKitFileChooserRequest* webkit_file_chooser_request_create(PassRefPtr<FileChooser> chooser);
+
+#endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 00625cdef..aac487f23 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -216,6 +216,7 @@ enum {
     ENTERING_FULLSCREEN,
     LEAVING_FULLSCREEN,
     CONTEXT_MENU,
+    RUN_FILE_CHOOSER,
 
     LAST_SIGNAL
 };
@@ -1294,6 +1295,48 @@ static gboolean webkit_web_view_real_leaving_fullscreen(WebKitWebView* webView)
     return FALSE;
 }
 
+static void fileChooserDialogResponseCallback(GtkDialog* dialog, gint responseID, WebKitFileChooserRequest* request)
+{
+    GRefPtr<WebKitFileChooserRequest> adoptedRequest = adoptGRef(request);
+    if (responseID == GTK_RESPONSE_ACCEPT) {
+        GOwnPtr<GSList> filesList(gtk_file_chooser_get_filenames(GTK_FILE_CHOOSER(dialog)));
+        GRefPtr<GPtrArray> filesArray = adoptGRef(g_ptr_array_new());
+        for (GSList* file = filesList.get(); file; file = g_slist_next(file))
+            g_ptr_array_add(filesArray.get(), file->data);
+        g_ptr_array_add(filesArray.get(), 0);
+        webkit_file_chooser_request_select_files(adoptedRequest.get(), reinterpret_cast<const gchar* const*>(filesArray->pdata));
+    }
+
+    gtk_widget_destroy(GTK_WIDGET(dialog));
+}
+
+static gboolean webkitWebViewRealRunFileChooser(WebKitWebView* webView, WebKitFileChooserRequest* request)
+{
+    GtkWidget* toplevel = gtk_widget_get_toplevel(GTK_WIDGET(webView));
+    if (!widgetIsOnscreenToplevelWindow(toplevel))
+        toplevel = 0;
+
+    gboolean allowsMultipleSelection = webkit_file_chooser_request_get_select_multiple(request);
+    GtkWidget* dialog = gtk_file_chooser_dialog_new(allowsMultipleSelection ? _("Select Files") : _("Select File"),
+                                                    toplevel ? GTK_WINDOW(toplevel) : 0,
+                                                    GTK_FILE_CHOOSER_ACTION_OPEN,
+                                                    GTK_STOCK_CANCEL, GTK_RESPONSE_CANCEL,
+                                                    GTK_STOCK_OPEN, GTK_RESPONSE_ACCEPT,
+                                                    NULL);
+
+    if (GtkFileFilter* filter = webkit_file_chooser_request_get_mime_types_filter(request))
+        gtk_file_chooser_set_filter(GTK_FILE_CHOOSER(dialog), filter);
+    gtk_file_chooser_set_select_multiple(GTK_FILE_CHOOSER(dialog), allowsMultipleSelection);
+
+    if (const gchar* const* selectedFiles = webkit_file_chooser_request_get_selected_files(request))
+        gtk_file_chooser_select_filename(GTK_FILE_CHOOSER(dialog), selectedFiles[0]);
+
+    g_signal_connect(dialog, "response", G_CALLBACK(fileChooserDialogResponseCallback), g_object_ref(request));
+    gtk_widget_show(dialog);
+
+    return TRUE;
+}
+
 static void webkit_web_view_dispose(GObject* object)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(object);
@@ -2547,6 +2590,42 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
             G_TYPE_NONE, 1,
             WEBKIT_TYPE_WEB_FRAME);
 
+     /**
+     * WebKitWebView::run-file-chooser:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     * @request: a #WebKitFileChooserRequest
+     *
+     * This signal is emitted when the user interacts with a &lt;input
+     * type='file' /&gt; HTML element, requesting from WebKit to show
+     * a dialog to select one or more files to be uploaded. To let the
+     * application know the details of the file chooser, as well as to
+     * allow the client application to either cancel the request or
+     * perform an actual selection of files, the signal will pass an
+     * instance of the #WebKitFileChooserRequest in the @request
+     * argument.
+     *
+     * The default signal handler will asynchronously run a regular
+     * #GtkFileChooserDialog for the user to interact with.
+     *
+     * If this signal is to be handled asynchronously, you must
+     * call g_object_ref() on the @request, and return %TRUE to indicate
+     * that the request is being handled. When you are ready to complete the
+     * request, call webkit_file_chooser_request_select_files().
+     *
+     * Returns: %TRUE to stop other handlers from being invoked for the event.
+     *   %FALSE to propagate the event further.
+     *
+     */
+    webkit_web_view_signals[RUN_FILE_CHOOSER] =
+        g_signal_new("run-file-chooser",
+                     G_TYPE_FROM_CLASS(webViewClass),
+                     G_SIGNAL_RUN_LAST,
+                     G_STRUCT_OFFSET(WebKitWebViewClass, run_file_chooser),
+                     g_signal_accumulator_true_handled, 0 /* accumulator data */,
+                     webkit_marshal_BOOLEAN__OBJECT,
+                     G_TYPE_BOOLEAN, 1, /* number of parameters */
+                     WEBKIT_TYPE_FILE_CHOOSER_REQUEST);
+
     webkit_web_view_signals[SHOULD_BEGIN_EDITING] = g_signal_new("should-begin-editing",
         G_TYPE_FROM_CLASS(webViewClass), static_cast<GSignalFlags>(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
         G_STRUCT_OFFSET(WebKitWebViewClass, should_allow_editing_action), g_signal_accumulator_first_wins, 0,
@@ -2856,6 +2935,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
     webViewClass->should_allow_editing_action = webkit_web_view_real_should_allow_editing_action;
     webViewClass->entering_fullscreen = webkit_web_view_real_entering_fullscreen;
     webViewClass->leaving_fullscreen = webkit_web_view_real_leaving_fullscreen;
+    webViewClass->run_file_chooser = webkitWebViewRealRunFileChooser;
 
     GObjectClass* objectClass = G_OBJECT_CLASS(webViewClass);
     objectClass->dispose = webkit_web_view_dispose;
@@ -3610,6 +3690,12 @@ GtkWidget* webkit_web_view_new(void)
     return GTK_WIDGET(webView);
 }
 
+void webkitWebViewRunFileChooserRequest(WebKitWebView* webView, WebKitFileChooserRequest* request)
+{
+    gboolean returnValue;
+    g_signal_emit(webView, webkit_web_view_signals[RUN_FILE_CHOOSER], 0, request, &returnValue);
+}
+
 // for internal use only
 void webkit_web_view_notify_ready(WebKitWebView* webView)
 {
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.h b/Source/WebKit/gtk/webkit/webkitwebview.h
index dc578d5fa..87c197acf 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.h
+++ b/Source/WebKit/gtk/webkit/webkitwebview.h
@@ -28,6 +28,7 @@
 
 #include <webkit/webkitdefines.h>
 #include <webkit/webkitdom.h>
+#include <webkit/webkitfilechooserrequest.h>
 #include <webkit/webkitwebbackforwardlist.h>
 #include <webkit/webkitwebframe.h>
 #include <webkit/webkitwebhistoryitem.h>
@@ -178,9 +179,8 @@ struct _WebKitWebViewClass {
     gboolean                   (* should_allow_editing_action) (WebKitWebView   *web_view);
     gboolean                   (* entering_fullscreen) (WebKitWebView   *web_view);
     gboolean                   (* leaving_fullscreen) (WebKitWebView   *web_view);
-
-    /* Padding for future expansion */
-    void (*_webkit_reserved0) (void);
+    gboolean                   (* run_file_chooser)       (WebKitWebView            *web_view,
+                                                           WebKitFileChooserRequest *request);
 };
 
 WEBKIT_API GType
diff --git a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
index a0f7fa677..72a8dbc05 100644
--- a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
@@ -137,6 +137,8 @@ GtkMenu* webkit_web_view_get_context_menu(WebKitWebView*);
 void webViewEnterFullscreen(WebKitWebView* webView, WebCore::Node*);
 void webViewExitFullscreen(WebKitWebView* webView);
 
+void webkitWebViewRunFileChooserRequest(WebKitWebView*, WebKitFileChooserRequest*);
+
 #if ENABLE(ICONDATABASE)
 void webkitWebViewRegisterForIconNotification(WebKitWebView*, bool shouldRegister);
 void webkitWebViewIconLoaded(WebKitFaviconDatabase*, const char* frameURI, WebKitWebView*);
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 2122e5c04..606bceb83 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,169 @@
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * DOM/WebDOMOperations.mm:
+        (JSC):
+        * Misc/WebCoreStatistics.mm:
+        (+[WebCoreStatistics javaScriptObjectsCount]):
+        (+[WebCoreStatistics javaScriptGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectTypeCounts]):
+        (+[WebCoreStatistics javaScriptObjectTypeCounts]):
+        (+[WebCoreStatistics shouldPrintExceptions]):
+        (+[WebCoreStatistics setShouldPrintExceptions:]):
+        (+[WebCoreStatistics memoryStatistics]):
+        (+[WebCoreStatistics javaScriptReferencedObjectsCount]):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        (WebKit::NetscapePluginInstanceProxy::getProperty):
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+        (WebKit::NetscapePluginInstanceProxy::removeProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasMethod):
+        (WebKit::NetscapePluginInstanceProxy::enumerate):
+        (WebKit::NetscapePluginInstanceProxy::addValueToArray):
+        (WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
+        * Plugins/WebNetscapePluginStream.mm:
+        (WebNetscapePluginStream::wantsAllStreams):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView sendEvent:isDrawRect:]):
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebNetscapePluginView setWindowIfNecessary]):
+        (-[WebNetscapePluginView createPluginScriptableObject]):
+        (-[WebNetscapePluginView getFormValue:]):
+        (-[WebNetscapePluginView evaluateJavaScriptPluginRequest:]):
+        (-[WebNetscapePluginView webFrame:didFinishLoadWithReason:]):
+        (-[WebNetscapePluginView loadPluginRequest:]):
+        (-[WebNetscapePluginView _printedPluginBitmap]):
+        * Plugins/WebPluginController.mm:
+        (+[WebPluginController plugInViewWithArguments:fromPluginPackage:]):
+        (-[WebPluginController stopOnePlugin:]):
+        (-[WebPluginController destroyOnePlugin:]):
+        (-[WebPluginController startAllPlugins]):
+        (-[WebPluginController addPlugin:]):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame scopeChain]):
+        (-[WebScriptCallFrame evaluateWebScript:]):
+        * WebView/WebView.mm:
+        (+[WebView _reportException:inContext:]):
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+        (-[WebView _computedStyleIncludingVisitedInfo:forElement:]):
+
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
+
+        Reviewed by Dean Jackson.
+
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * DOM/WebDOMOperations.mm:
+        (JSC):
+        * Misc/WebCoreStatistics.mm:
+        (+[WebCoreStatistics javaScriptObjectsCount]):
+        (+[WebCoreStatistics javaScriptGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectTypeCounts]):
+        (+[WebCoreStatistics javaScriptObjectTypeCounts]):
+        (+[WebCoreStatistics shouldPrintExceptions]):
+        (+[WebCoreStatistics setShouldPrintExceptions:]):
+        (+[WebCoreStatistics memoryStatistics]):
+        (+[WebCoreStatistics javaScriptReferencedObjectsCount]):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        (WebKit::NetscapePluginInstanceProxy::getProperty):
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+        (WebKit::NetscapePluginInstanceProxy::removeProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasMethod):
+        (WebKit::NetscapePluginInstanceProxy::enumerate):
+        (WebKit::NetscapePluginInstanceProxy::addValueToArray):
+        (WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
+        * Plugins/WebNetscapePluginStream.mm:
+        (WebNetscapePluginStream::wantsAllStreams):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView sendEvent:isDrawRect:]):
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebNetscapePluginView setWindowIfNecessary]):
+        (-[WebNetscapePluginView createPluginScriptableObject]):
+        (-[WebNetscapePluginView getFormValue:]):
+        (-[WebNetscapePluginView evaluateJavaScriptPluginRequest:]):
+        (-[WebNetscapePluginView webFrame:didFinishLoadWithReason:]):
+        (-[WebNetscapePluginView loadPluginRequest:]):
+        (-[WebNetscapePluginView _printedPluginBitmap]):
+        * Plugins/WebPluginController.mm:
+        (+[WebPluginController plugInViewWithArguments:fromPluginPackage:]):
+        (-[WebPluginController stopOnePlugin:]):
+        (-[WebPluginController destroyOnePlugin:]):
+        (-[WebPluginController startAllPlugins]):
+        (-[WebPluginController addPlugin:]):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame scopeChain]):
+        (-[WebScriptCallFrame evaluateWebScript:]):
+        * WebView/WebView.mm:
+        (+[WebView _reportException:inContext:]):
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+        (-[WebView _computedStyleIncludingVisitedInfo:forElement:]):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+        * WebCoreSupport/WebDeviceOrientationClient.h:
+        (WebDeviceOrientationClient):
+        * WebCoreSupport/WebDeviceOrientationClient.mm:
+        (WebDeviceOrientationClient::lastOrientation):
+        * WebView/WebDeviceOrientation.mm:
+        * WebView/WebDeviceOrientationInternal.h:
+
+2012-06-20  Garret Kelly  <gdk@chromium.org>
+
+        Moving cookieEnabled/setCookieEnabled from Page to Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=89545
+
+        Reviewed by Adam Barth.
+
+        * WebView/WebView.mm:
+        (-[WebView _cookieEnabled]):
+        (-[WebView _setCookieEnabled:]):
+
 2012-06-19  Dan Bernstein  <mitz@apple.com>
 
         WebKit/mac part of: Paginated display API doesn’t allow setting the page progression direction
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 0ca351439..b1b84966d 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -41,6 +41,7 @@ ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_VARIABLES = ;
diff --git a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.h b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.h
index ed407eb80..7e49871c0 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.h
@@ -46,7 +46,7 @@ public:
     virtual void setController(WebCore::DeviceOrientationController*) OVERRIDE;
     virtual void startUpdating() OVERRIDE;
     virtual void stopUpdating() OVERRIDE;
-    virtual WebCore::DeviceOrientation* lastOrientation() const OVERRIDE;
+    virtual WebCore::DeviceOrientationData* lastOrientation() const OVERRIDE;
     virtual void deviceOrientationControllerDestroyed() OVERRIDE;
 
 private:
diff --git a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
index 3a4d5d7dd..aaa031a4b 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebDeviceOrientationClient.mm
@@ -55,7 +55,7 @@ void WebDeviceOrientationClient::stopUpdating()
     [getProvider() stopUpdating];
 }
 
-DeviceOrientation* WebDeviceOrientationClient::lastOrientation() const
+DeviceOrientationData* WebDeviceOrientationClient::lastOrientation() const
 {
     return core([getProvider() lastOrientation]);
 }
diff --git a/Source/WebKit/mac/WebView/WebDeviceOrientation.mm b/Source/WebKit/mac/WebView/WebDeviceOrientation.mm
index 7be5d0ca3..db7894f9c 100644
--- a/Source/WebKit/mac/WebView/WebDeviceOrientation.mm
+++ b/Source/WebKit/mac/WebView/WebDeviceOrientation.mm
@@ -29,7 +29,7 @@ using namespace WebCore;
 
 @implementation WebDeviceOrientationInternal
 
-- (id)initWithCoreDeviceOrientation:(PassRefPtr<DeviceOrientation>)coreDeviceOrientation
+- (id)initWithCoreDeviceOrientation:(PassRefPtr<DeviceOrientationData>)coreDeviceOrientation
 {
     self = [super init];
     if (!self)
@@ -42,7 +42,7 @@ using namespace WebCore;
 
 @implementation WebDeviceOrientation (Internal)
 
-- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientation>)coreDeviceOrientation
+- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientationData>)coreDeviceOrientation
 {
     self = [super init];
     if (!self)
@@ -55,7 +55,7 @@ using namespace WebCore;
 
 @implementation WebDeviceOrientation
 
-DeviceOrientation* core(WebDeviceOrientation* orientation)
+DeviceOrientationData* core(WebDeviceOrientation* orientation)
 {
     return orientation ? orientation->m_internal->m_orientation.get() : 0;
 }
@@ -65,7 +65,7 @@ DeviceOrientation* core(WebDeviceOrientation* orientation)
     self = [super init];
     if (!self)
         return nil;
-    m_internal = [[WebDeviceOrientationInternal alloc] initWithCoreDeviceOrientation:DeviceOrientation::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma)];
+    m_internal = [[WebDeviceOrientationInternal alloc] initWithCoreDeviceOrientation:DeviceOrientationData::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma)];
     return self;
 }
 
diff --git a/Source/WebKit/mac/WebView/WebDeviceOrientationInternal.h b/Source/WebKit/mac/WebView/WebDeviceOrientationInternal.h
index b7c6aa53b..5dedd080c 100644
--- a/Source/WebKit/mac/WebView/WebDeviceOrientationInternal.h
+++ b/Source/WebKit/mac/WebView/WebDeviceOrientationInternal.h
@@ -25,21 +25,21 @@
 
 #import "WebDeviceOrientation.h"
 
-#import <WebCore/DeviceOrientation.h>
+#import <WebCore/DeviceOrientationData.h>
 #import <wtf/RefPtr.h>
 
 @interface WebDeviceOrientationInternal : NSObject {
 @public
-    RefPtr<WebCore::DeviceOrientation> m_orientation;
+    RefPtr<WebCore::DeviceOrientationData> m_orientation;
 }
 
-- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientation>)coreDeviceOrientation;
+- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientationData>)coreDeviceOrientation;
 @end
 
 @interface WebDeviceOrientation (Internal)
 
-- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientation>)coreDeviceOrientation;
+- (id)initWithCoreDeviceOrientation:(PassRefPtr<WebCore::DeviceOrientationData>)coreDeviceOrientation;
 
 @end
 
-WebCore::DeviceOrientation* core(WebDeviceOrientation*);
+WebCore::DeviceOrientationData* core(WebDeviceOrientation*);
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 0fc8ccaa0..f7a681bc7 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -2243,14 +2243,14 @@ static inline IMP getMethod(id o, SEL s)
 - (BOOL)_cookieEnabled
 {
     if (_private->page)
-        return _private->page->cookieEnabled();
+        return _private->page->settings()->cookieEnabled();
     return YES;
 }
 
 - (void)_setCookieEnabled:(BOOL)enable
 {
     if (_private->page)
-        _private->page->setCookieEnabled(enable);
+        _private->page->settings()->setCookieEnabled(enable);
 }
 
 - (void)_setAdditionalWebPlugInPaths:(NSArray *)newPaths
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index fba92dded..d8a1e5c11 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,67 @@
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::addQtSenderToGlobalObject):
+        (QWebFrame::addToJavaScriptWindowObject):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::injectInternalsObject):
+        (DumpRenderTreeSupportQt::resetInternalsObject):
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::addQtSenderToGlobalObject):
+        (QWebFrame::addToJavaScriptWindowObject):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::injectInternalsObject):
+        (DumpRenderTreeSupportQt::resetInternalsObject):
+
+2012-06-22  Amy Ousterhout  <aousterh@chromium.org>
+
+        Renamed DeviceOrientation to DeviceOrientationData
+        https://bugs.webkit.org/show_bug.cgi?id=88663
+
+        Reviewed by Steve Block.
+
+        Updated files to use the renamed DeviceOrientationData instead of DeviceOrientation.
+        This change makes DeviceOrientationData consistent with DeviceMotionData.
+        
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockDeviceOrientation):
+        
+2012-06-21  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [WK2][Qt] Color chooser API missing
+        https://bugs.webkit.org/show_bug.cgi?id=87749
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added ColorChooser API stub to WebKit. Otherwise
+        it will break the build for Qt WebKit2 (that now has
+        complete support for color chooser) when INPUT_TYPE_COLOR is set.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore):
+        (WebCore::ChromeClientQt::createColorChooser):
+        * WebCoreSupport/ChromeClientQt.h:
+        (ChromeClientQt):
+
 2012-06-20  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Unreviewed build fix
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index c1b816c2a..b21ce9e98 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -31,6 +31,7 @@
 #include "ChromeClientQt.h"
 
 #include "ApplicationCacheStorage.h"
+#include "ColorChooser.h"
 #include "DatabaseTracker.h"
 #include "Document.h"
 #include "FileChooser.h"
@@ -557,6 +558,14 @@ void ChromeClientQt::reachedApplicationCacheOriginQuota(SecurityOrigin* origin,
     emit m_webPage->applicationCacheQuotaExceeded(securityOrigin, defaultOriginQuota, static_cast<quint64>(totalSpaceNeeded));
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassOwnPtr<ColorChooser> ChromeClientQt::createColorChooser(ColorChooserClient*, const Color&)
+{
+    notImplemented();
+    return nullptr;
+}
+#endif
+
 void ChromeClientQt::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> prpFileChooser)
 {
     RefPtr<FileChooser> fileChooser = prpFileChooser;
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 6c26018bc..a7d7dc23e 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -163,6 +163,11 @@ public:
     virtual bool requiresFullscreenForVideoPlayback();
     FullScreenVideoQt* fullScreenVideo();
 #endif
+
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassOwnPtr<ColorChooser> createColorChooser(ColorChooserClient*, const Color&);
+#endif
+
      virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
      virtual void loadIconForFiles(const Vector<String>&, FileIconLoader*);
 
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index a094a25b8..3814d3569 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -33,9 +33,9 @@
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
 #include "ContextMenuController.h"
-#include "DeviceOrientation.h"
 #include "DeviceOrientationClientMock.h"
 #include "DeviceOrientationController.h"
+#include "DeviceOrientationData.h"
 #include "DocumentLoader.h"
 #include "Editor.h"
 #include "EditorClientQt.h"
@@ -769,7 +769,7 @@ void DumpRenderTreeSupportQt::setMockDeviceOrientation(QWebPage* page, bool canP
 #if ENABLE(DEVICE_ORIENTATION)
     Page* corePage = QWebPagePrivate::core(page);
     DeviceOrientationClientMock* mockClient = toDeviceOrientationClientMock(DeviceOrientationController::from(corePage)->client());
-    mockClient->setOrientation(DeviceOrientation::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma));
+    mockClient->setOrientation(DeviceOrientationData::create(canProvideAlpha, alpha, canProvideBeta, beta, canProvideGamma, gamma));
 #endif
 }
 
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index bbbdb75b5..39d4d0796 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,75 @@
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * WebCoreStatistics.cpp:
+        (WebCoreStatistics::javaScriptObjectsCount):
+        (WebCoreStatistics::javaScriptGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectTypeCounts):
+        * WebFrame.cpp:
+        (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):
+        * WebJavaScriptCollector.cpp:
+        (WebJavaScriptCollector::objectCount):
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+        (WebView::reportException):
+        (WebView::elementFromJS):
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * WebCoreStatistics.cpp:
+        (WebCoreStatistics::javaScriptObjectsCount):
+        (WebCoreStatistics::javaScriptGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectTypeCounts):
+        * WebFrame.cpp:
+        (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):
+        * WebJavaScriptCollector.cpp:
+        (WebJavaScriptCollector::objectCount):
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+        (WebView::reportException):
+        (WebView::elementFromJS):
+
+2012-06-20  Garret Kelly  <gdk@chromium.org>
+
+        Moving cookieEnabled/setCookieEnabled from Page to Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=89545
+
+        Reviewed by Adam Barth.
+
+        * WebView.cpp:
+        (WebView::setCookieEnabled):
+        (WebView::cookieEnabled):
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use IntSize in RenderLayer to represent scroll offsets
+        https://bugs.webkit.org/show_bug.cgi?id=89154
+
+        Reviewed by Eric Seidel.
+
+        * WebView.cpp:
+        (WebView::gesture):
+        Updated to pass an IntSize to scrollByRecursively.
+
 2012-06-11  Kaustubh Atrawalkar  <kaustubh@motorola.com>
 
         [DRT] LTC:: counterValueForElementById() could be moved to Internals.
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index cc2df329b..880bc1bd0 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -1652,7 +1652,7 @@ bool WebView::gesture(WPARAM wParam, LPARAM lParam)
             return false;
 
         // We negate here since panning up moves the content up, but moves the scrollbar down.
-        m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(-deltaX, -deltaY);
+        m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(IntSize(-deltaX, -deltaY));
            
         if (!(UpdatePanningFeedbackPtr() && BeginPanningFeedbackPtr() && EndPanningFeedbackPtr())) {
             CloseGestureInfoHandlePtr()(gestureHandle);
@@ -6020,7 +6020,7 @@ HRESULT STDMETHODCALLTYPE WebView::setCookieEnabled(BOOL enable)
     if (!m_page)
         return E_FAIL;
 
-    m_page->setCookieEnabled(enable);
+    m_page->settings()->setCookieEnabled(enable);
     return S_OK;
 }
 
@@ -6032,7 +6032,7 @@ HRESULT STDMETHODCALLTYPE WebView::cookieEnabled(BOOL* enabled)
     if (!m_page)
         return E_FAIL;
 
-    *enabled = m_page->cookieEnabled();
+    *enabled = m_page->settings()->cookieEnabled();
     return S_OK;
 }
 
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 45dbe2430..51f7ec1d7 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -279,6 +279,7 @@ SET(WebKit2_SOURCES
     UIProcess/API/C/WKHitTestResult.cpp
     UIProcess/API/C/WKIconDatabase.cpp
     UIProcess/API/C/WKInspector.cpp
+    UIProcess/API/C/WKIntentData.cpp
     UIProcess/API/C/WKKeyValueStorageManager.cpp
     UIProcess/API/C/WKMediaCacheManager.cpp
     UIProcess/API/C/WKNavigationData.cpp
@@ -401,6 +402,7 @@ SET(WebKit2_SOURCES
     WebProcess/ResourceCache/WebResourceCacheManager.cpp
 
     WebProcess/WebCoreSupport/WebChromeClient.cpp
+    WebProcess/WebCoreSupport/WebColorChooser.cpp
     WebProcess/WebCoreSupport/WebContextMenuClient.cpp
     WebProcess/WebCoreSupport/WebDatabaseManager.cpp
     WebProcess/WebCoreSupport/WebDragClient.cpp
@@ -548,3 +550,4 @@ IF (WebKit2_LINK_FLAGS)
 ENDIF ()
 
 INSTALL(TARGETS ${WebKit2_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
+INSTALL(TARGETS ${WebProcess_EXECUTABLE_NAME} DESTINATION "${EXEC_INSTALL_DIR}")
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 9f76f8a6f..c0fd9d104 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,831 @@
+2012-06-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Test /webkit2/WebKitWebView/permission-requests fails due to a runtime warning
+        https://bugs.webkit.org/show_bug.cgi?id=89858
+
+        Reviewed by Xan Lopez.
+
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewPermissionRequests): Make runtime warnings non-fatal
+        for test /webkit2/WebKitWebView/permission-requests.
+
+2012-06-25  Huang Dongsung  <luxtella@company100.net>
+
+        [GTK] Remove unused code in LayerTreeHostGtk.
+        https://bugs.webkit.org/show_bug.cgi?id=89854
+
+        LayerTreeHostGtk::deviceScaleFactor() is unused and LayerTreeHost does not have
+        virtual float deviceScaleFactor() const;
+
+        Reviewed by Martin Robinson.
+
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.h:
+        (LayerTreeHostGtk):
+
+2012-06-24  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r120329): Intermittent WebProcess shutdowns due to out-of-line DidReceiveEvent messages.
+        <rdar://problem/11686974>
+        <http://webkit.org/b/89659>
+
+        Unreviewed tests assertion fix, handleKeyboardEvent() should call didReceiveKeyEvent()
+        rather than didReceiveEvent().
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::handleKeyboardEvent):
+        (WebKit::WebPageProxy::didReceiveKeyEvent):
+
+2012-06-24  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [WK2][Qt][EFL] Modify Qt specific code to common code
+        https://bugs.webkit.org/show_bug.cgi?id=89839
+
+        Reviewed by Noam Rosenthal.
+
+        Modify paintToGraphicsContext’s first argument QPainter to PlatformGraphicsContext to be used by both Qt and Efl.
+
+        * UIProcess/WebLayerTreeRenderer.cpp:
+        (WebKit::WebLayerTreeRenderer::paintToGraphicsContext):
+
+2012-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Rename isPositioned to isOutOfFlowPositioned for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=89836
+
+        Reviewed by Antti Koivisto.
+        
+        RenderObject and RenderStyle had an isPositioned() method that was
+        confusing, because it excluded relative positioning. Rename to 
+        isOutOfFlowPositioned(), which makes it clearer that it only applies
+        to absolute and fixed positioning.
+
+        Simple rename; no behavior change.
+
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::updateOffsetFromViewportForSelf):
+
+2012-06-24  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r120329): Intermittent WebProcess shutdowns due to out-of-line DidReceiveEvent messages.
+        <rdar://problem/11686974>
+        <http://webkit.org/b/89659>
+
+        Reviewed by Sam Weinig.
+
+        Instead of sending DidReceiveEvent for key events as DispatchMessageEvenWhenWaitingForSyncReply,
+        use proper synchronous messages. This makes the WebProcess block while the UIProcess handles
+        the event but prevents a weird race condition where DidReceiveEvent gets dispatched just before
+        a synchronous DecidePolicyForNavigationAction and something happens below DidReceiveEvent that
+        invalidates the frame ID passed to DecidePolicyForNavigationAction.
+
+        This is a speculative fire-fighting fix.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didReceiveKeyEvent):
+        (WebKit::WebPageProxy::didReceiveEvent):
+        * UIProcess/WebPageProxy.h:
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::keyEvent):
+
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * Shared/mac/WebMemorySampler.mac.mm:
+        (WebKit::WebMemorySampler::sampleWebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::javaScriptObjectsCount):
+        (WebKit::InjectedBundle::reportException):
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::callMethod):
+        (WebKit::JSNPObject::callObject):
+        (WebKit::JSNPObject::callConstructor):
+        (WebKit::JSNPObject::put):
+        (WebKit::JSNPObject::deleteProperty):
+        (WebKit::JSNPObject::getOwnPropertyNames):
+        (WebKit::JSNPObject::propertyGetter):
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::hasMethod):
+        (WebKit::NPJSObject::invoke):
+        (WebKit::NPJSObject::invokeDefault):
+        (WebKit::NPJSObject::hasProperty):
+        (WebKit::NPJSObject::getProperty):
+        (WebKit::NPJSObject::setProperty):
+        (WebKit::NPJSObject::removeProperty):
+        (WebKit::NPJSObject::enumerate):
+        (WebKit::NPJSObject::construct):
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
+        (WebKit::NPRuntimeObjectMap::evaluate):
+        (WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::jsWrapperForWorld):
+        (WebKit::WebFrame::computedStyleIncludingVisitedInfo):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::runJavaScriptInMainFrame):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::getWebCoreStatistics):
+
+2012-06-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed build fix for GTK's WebKit2 build after r121093.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewPopulateContextMenu):
+
+2012-06-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix several GTK+ unit tests.
+
+        GTK+ unit tests using WebViewTest::wait() started to fail due to a
+        bug introduced in r121093.
+
+        * UIProcess/API/gtk/tests/WebViewTest.cpp:
+        (WebViewTest::wait): Use this instead of m_mainLoop as user data
+        for the idle callback.
+
+2012-06-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add ContextMenu API to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=81011
+
+        Reviewed by Martin Robinson.
+
+        Add WebKitWebView::context-menu signal and WebKitContextMenu and
+        WebKitContextMenuItem objects to customize the default menu or
+        buils new menus.
+
+        * GNUmakefile.list.am: Add new files to destination.
+        * UIProcess/API/gtk/WebKitContextMenu.cpp: Added.
+        (webkitContextMenuFinalize):
+        (webkit_context_menu_init):
+        (webkit_context_menu_class_init):
+        (webkitContextMenuPopulate): Populate the given vector of
+        ContextMenuItems with the WebKitContextMenu items releasing the
+        items added to the vector.
+        (webkitContextMenuCreate): Create a new WebKitContextMenu for the
+        given WKArrayRef of WKContextMenuItemRef.
+        (webkitContextMenuSetParentItem): Set the parent menu item of the
+        menu. Used when a menu is added as a submenu of a menu item.
+        (webkitContextMenuGetParentItem): Return the parent menu item of
+        the menu.
+        (webkit_context_menu_new): Create a new WebKitContextMenu.
+        (webkit_context_menu_new_with_items): Create a new
+        WebKitContextMenu using the given list of WebKitContextMenuItem.
+        (webkit_context_menu_prepend): Add item at the beginning.
+        (webkit_context_menu_append): Add item at the end.
+        (webkit_context_menu_insert): Insert item at a random position.
+        (webkit_context_menu_move_item): Move an existing item to a new
+        position.
+        (webkit_context_menu_get_items): Get the list of items.
+        (webkit_context_menu_get_n_items): Get the number of items.
+        (webkit_context_menu_first): Get the first item.
+        (webkit_context_menu_last): Get the last item.
+        (webkit_context_menu_get_item_at_position): Get the item at the
+        given position.
+        (webkit_context_menu_remove): Remove the given item.
+        (webkit_context_menu_remove_all): Remove all items.
+        * UIProcess/API/gtk/WebKitContextMenu.h: Added.
+        * UIProcess/API/gtk/WebKitContextMenuActions.cpp: Added.
+        (webkitContextMenuActionIsCheckable): Check if the given stock
+        action is a toggle action.
+        (webkitContextMenuActionGetActionTag): Get the WebCore
+        ContextMenuAction corresponding to the given stock action.
+        (webkitContextMenuActionGetForContextMenuItem): Get the stock
+        action corresponding to the given WebCore ContextMenuAction.
+        (webkitContextMenuActionGetLabel): Get the label string of the
+        given stock action.
+        * UIProcess/API/gtk/WebKitContextMenuActions.h: Added.
+        * UIProcess/API/gtk/WebKitContextMenuActionsPrivate.h: Added.
+        * UIProcess/API/gtk/WebKitContextMenuItem.cpp: Added.
+        (webkitContextMenuItemFinalize):
+        (webkit_context_menu_item_init):
+        (webkit_context_menu_item_class_init):
+        (checkAndWarnIfMenuHasParentItem): Check whether the given menu
+        is already inside another menu showing a warning in such case.
+        (webkitContextMenuItemSetSubMenu): Set the submenu of a menu item,
+        checking that the menu is not part of another menu and setting the
+        item as the parent of the submenu.
+        (webkitContextMenuItemCreate): Create a new WebKitContextMenuItem
+        for the given WKContextMenuItemRef.
+        (webkitContextMenuItemCreateForGtkItem): Create a new
+        WebKitContextMenuItem using the given GtkMenuItem.
+        (webkitContextMenuItemSetSubMenuFromGtkMenu): Set the given
+        GtkMenu as submenu of the item. This is used only to add Input
+        Methods submenu that is created by GTK.
+        (webkitContextMenuItemRelease): Release the WebCore
+        ContextMenuItem associated to the item.
+        (webkit_context_menu_item_new): Create a new WebKitContextMenuItem
+        for the given GtkAction.
+        (webkit_context_menu_item_new_from_stock_action): Create a new
+        WebKitContextMenuItem for a stock action.
+        (webkit_context_menu_item_new_from_stock_action_with_label):
+        Create a new WebKitContextMenuItem for a stock action using a
+        custom label.
+        (webkit_context_menu_item_new_with_submenu): Create a new
+        WebKitContextMenuItem with a submenu.
+        (webkit_context_menu_item_new_separator): Create a new separator
+        menu item.
+        (webkit_context_menu_item_get_action): Get the GtkAction of the item.
+        (webkit_context_menu_item_get_stock_action): Get the stock action
+        of the item.
+        (webkit_context_menu_item_is_separator): Whether item is a separator.
+        (webkit_context_menu_item_set_submenu): Set or replace the
+        submenu of the item.
+        (webkit_context_menu_item_get_submenu): Get the submenu of the item.
+        * UIProcess/API/gtk/WebKitContextMenuItem.h: Added.
+        * UIProcess/API/gtk/WebKitContextMenuItemPrivate.h: Added.
+        * UIProcess/API/gtk/WebKitContextMenuPrivate.h: Added.
+        * UIProcess/API/gtk/WebKitDefines.h:
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_class_init): Add WebKitWebView::context-menu signal.
+        (getUnicodeMenuItemPosition): Helper function that returns the
+        position of the unicode menu item in the proposed context menu.
+        (webkitWebViewCreateAndAppendInputMethodsMenuItem): Use
+        WebKitContextMenu API to add the input methods submenu to the
+        default context menu.
+        (webkitWebViewPopulateContextMenu): Create a WebKitContextMenu for
+        the default context menu and emit WebKitWebView::context-menu
+        signal. Then populate the context menu proxy with the resulting
+        WebKitContextMenu.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        * UIProcess/API/gtk/WebKitWebViewBase.cpp:
+        (webkitWebViewBaseButtonPressEvent): In case of right click save
+        the event to be used by context menu signal.
+        (webkitWebViewBaseTakeContextMenuEvent): Return and release the
+        saved button event.
+        * UIProcess/API/gtk/WebKitWebViewBasePrivate.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-docs.sgml: Add sections for
+        WebKitContextMenu and WebKitContextMenuItem.
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbols.
+        * UIProcess/API/gtk/docs/webkit2gtk.types: Add
+        webkit_context_menu_get_type and webkit_context_menu_item_get_type.
+        * UIProcess/API/gtk/tests/GNUmakefile.am: Add new test for context menu.
+        * UIProcess/API/gtk/tests/TestContextMenu.cpp: Added.
+        (testContextMenuDefaultMenu):
+        (testContextMenuPopulateMenu):
+        (testContextMenuCustomMenu):
+        (testContextMenuDisableMenu):
+        (testContextMenuSubMenu):
+        (beforeAll):
+        (afterAll):
+        * UIProcess/API/gtk/tests/TestMain.h:
+        (Test::addLogFatalFlag): Add a log level flag to the mask of flags
+        causing the program to abort.
+        (Test::removeLogFatalFlag): Remove a log level flag to the mask of
+        flags causing the program to abort.
+        * UIProcess/API/gtk/tests/WebViewTest.cpp:
+        (WebViewTest::quitMainLoop): Finish the main loop.
+        (WebViewTest::quitMainLoopAfterProcessingPendingEvents): Finish
+        the main loop when all pending events have been processed.
+        (quitMainLoopIdleCallback):
+        (WebViewTest::wait):
+        * UIProcess/API/gtk/tests/WebViewTest.h:
+        * UIProcess/API/gtk/webkit2.h: Include WebKitContextMenu.h,
+        WebKitContextMenuItem.h and WebKitContextMenuActions.h.
+        * UIProcess/API/gtk/webkit2marshal.list:
+        * UIProcess/gtk/WebContextMenuProxyGtk.cpp:
+        (WebKit::WebContextMenuProxyGtk::showContextMenu): Attach the
+        popup menu to the view widget before showing it.
+
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
+
+        Reviewed by Dean Jackson.
+
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-22  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][WK2] Support keyboard event
+        https://bugs.webkit.org/show_bug.cgi?id=89268
+
+        Reviewed by Chang Shu.
+
+        * WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp:
+        (WebKit::WebEditorClient::handleKeyboardEvent): Implemented default behavior.
+        * WebProcess/WebPage/efl/WebPageEfl.cpp:
+        (WebKit::WebPage::interpretKeyEvent): Implemented like WebKit1/Efl did.
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection.
+
+        * Shared/mac/WebMemorySampler.mac.mm:
+        (WebKit::WebMemorySampler::sampleWebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::javaScriptObjectsCount):
+        (WebKit::InjectedBundle::reportException):
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::callMethod):
+        (WebKit::JSNPObject::callObject):
+        (WebKit::JSNPObject::callConstructor):
+        (WebKit::JSNPObject::put):
+        (WebKit::JSNPObject::deleteProperty):
+        (WebKit::JSNPObject::getOwnPropertyNames):
+        (WebKit::JSNPObject::propertyGetter):
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::hasMethod):
+        (WebKit::NPJSObject::invoke):
+        (WebKit::NPJSObject::invokeDefault):
+        (WebKit::NPJSObject::hasProperty):
+        (WebKit::NPJSObject::getProperty):
+        (WebKit::NPJSObject::setProperty):
+        (WebKit::NPJSObject::removeProperty):
+        (WebKit::NPJSObject::enumerate):
+        (WebKit::NPJSObject::construct):
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
+        (WebKit::NPRuntimeObjectMap::evaluate):
+        (WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::jsWrapperForWorld):
+        (WebKit::WebFrame::computedStyleIncludingVisitedInfo):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::runJavaScriptInMainFrame):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::getWebCoreStatistics):
+
+2012-06-22  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] Fix the remote inspector loading problems on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89747
+
+        Reviewed by Simon Hausmann.
+
+        Reverse the creation order of the inter-dependent WebSocketServerConnection
+        and SocketStreamHandle to make sure that the later has a client properly
+        set on construction.
+
+        This is to work around the assert on m_state in SocketStreamHandle::setClient.
+
+        * UIProcess/InspectorServer/WebSocketServer.cpp:
+        (WebKit::WebSocketServer::didAcceptConnection):
+        * UIProcess/InspectorServer/WebSocketServer.h:
+        (WebKit::WebSocketServer::client):
+        (WebSocketServer):
+        * UIProcess/InspectorServer/WebSocketServerConnection.cpp:
+        (WebKit::WebSocketServerConnection::WebSocketServerConnection):
+        (WebKit::WebSocketServerConnection::setSocketHandle):
+        (WebKit):
+        * UIProcess/InspectorServer/WebSocketServerConnection.h:
+        (WebSocketServerConnection):
+        * UIProcess/InspectorServer/qt/WebSocketServerQt.cpp:
+        (WebKit::QtTcpServerHandler::handleNewConnection):
+
+2012-06-22  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2] FindController::hideFindUI should unmark highlighted text matches
+        https://bugs.webkit.org/show_bug.cgi?id=77747
+
+        Reviewed by Carlos Garcia Campos.
+
+        Unmark all text matches whenever FindController::hideFindUI is
+        called to allow callers using the ShowHighlight find option to
+        remove highlighting.
+
+        This patch enables a unit test for the WebKitFindController
+        previously guarded by a #if(0) after r109222.
+
+        * UIProcess/API/gtk/tests/TestWebKitFindController.cpp:
+        (testFindControllerHide):
+        * WebProcess/WebPage/FindController.cpp:
+        (WebKit::FindController::hideFindUI):
+
+2012-06-21  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add C API to inspect a Web Intent
+        https://bugs.webkit.org/show_bug.cgi?id=89275
+
+        Reviewed by Anders Carlsson.
+
+        Add C API for Web Intent so that it can be queried
+        on client side.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/API/C/WKIntentData.cpp: Copied from Source/WebKit2/UIProcess/WebIntentData.cpp.
+        (WKIntentDataGetTypeID):
+        (WKIntentDataCopyAction):
+        (WKIntentDataCopyType):
+        (WKIntentDataCopyService):
+        (WKIntentDataCopySuggestions):
+        (WKIntentDataCopyExtra):
+        (WKIntentDataCopyExtras):
+        * UIProcess/API/C/WKIntentData.h: Copied from Source/WebKit2/UIProcess/WebIntentData.cpp.
+        * UIProcess/WebIntentData.cpp:
+        (WebKit::WebIntentData::suggestions):
+        (WebKit):
+        (WebKit::WebIntentData::extra):
+        (WebKit::WebIntentData::extras):
+        * UIProcess/WebIntentData.h:
+        (WebIntentData):
+
+2012-06-21  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Properly encode/decode service in IntentData
+        https://bugs.webkit.org/show_bug.cgi?id=89460
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update IntentData::encode() and IntentData::decode()
+        so that the "service" member is properly encoded
+        and decoded.
+
+        * Shared/IntentData.cpp:
+        (WebKit::IntentData::encode):
+        (WebKit::IntentData::decode):
+
+2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL][WK2] Make WebKit2/Efl headers and resources installable.
+        https://bugs.webkit.org/show_bug.cgi?id=88207
+
+        Reviewed by Chang Shu.
+
+        * CMakeLists.txt: Install WebProcess.
+        * PlatformEfl.cmake: Generate ewebkit2.pc and install it.
+        * efl/ewebkit2.pc.in: Added.
+
+2012-06-21  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL[WK2] Add WKViewEfl and WebKit2 API Object to represent Evas_Object.
+        https://bugs.webkit.org/show_bug.cgi?id=88935
+
+        Reviewed by Chang Shu.
+
+        Add WKViewEfl to support WTR/Efl.
+
+        * PlatformEfl.cmake:
+        * Shared/API/c/WKBase.h:
+        * Shared/API/c/efl/WKBaseEfl.h: Added.
+        * UIProcess/API/C/WKAPICast.h:
+        * UIProcess/API/C/efl/WKAPICastEfl.h: Added.
+        (WebKit):
+        * UIProcess/API/C/efl/WKView.cpp: Added.
+        (WKViewCreate):
+        (WKViewGetPage):
+        * UIProcess/API/C/efl/WKView.h: Added.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_page_get):
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-06-21  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [Qt] API tests for ColorChooser
+        https://bugs.webkit.org/show_bug.cgi?id=88101
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The test uses the value sanitization to detect if the feature is
+        enabled or disabled and will just pass when disabled.
+
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml: Added.
+        * UIProcess/API/qt/tests/qmltests/common/colorChooser.html: Added.
+
+2012-06-21  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [WK2][Qt] Color chooser API missing
+        https://bugs.webkit.org/show_bug.cgi?id=87749
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added public experimental API for ColorChooser. This will
+        allow the browser to define a custom dialog for selecting
+        color when a input field of type "color" get focus.
+
+        The current implementation gives a model to the QML Component
+        that has methods for canceling a request, selecting a color
+        and fetching what is the current value of the HTML input.
+
+        * Target.pri:
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::QQuickWebViewPrivate):
+        (QQuickWebViewExperimental::colorChooser):
+        (QQuickWebViewExperimental::setColorChooser):
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qquickwebview_p_p.h:
+        (QQuickWebViewPrivate):
+        * UIProcess/qt/QtPageClient.cpp:
+        (WebKit::QtPageClient::createColorChooserProxy):
+        * UIProcess/qt/WebColorChooserProxyQt.cpp: Added.
+        (WebKit):
+        (ColorChooserContextObject):
+        (WebKit::ColorChooserContextObject::ColorChooserContextObject):
+        (WebKit::ColorChooserContextObject::currentColor):
+        (WebKit::ColorChooserContextObject::accept):
+        (WebKit::ColorChooserContextObject::reject):
+        (WebKit::WebColorChooserProxyQt::WebColorChooserProxyQt):
+        (WebKit::WebColorChooserProxyQt::~WebColorChooserProxyQt):
+        (WebKit::WebColorChooserProxyQt::createItem):
+        (WebKit::WebColorChooserProxyQt::createContext):
+        (WebKit::WebColorChooserProxyQt::setSelectedColor):
+        (WebKit::WebColorChooserProxyQt::notifyColorSelected):
+        (WebKit::WebColorChooserProxyQt::endChooser):
+        * UIProcess/qt/WebColorChooserProxyQt.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserProxyQt):
+        (WebKit::WebColorChooserProxyQt::create):
+
+2012-06-21  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add support for window.showModalDialog in WebKit2GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=79500
+
+        Reviewed by Carlos Garcia Campos.
+
+        Implement runModal in WebKitUIClient to make the WebKitWebView
+        emit a 'run-as-modal' signal when requested, creating a new
+        mainloop there to block user interaction with the original window
+        while the modal dialog is showing.
+
+        * UIProcess/API/gtk/WebKitUIClient.cpp:
+        (runModal): Call to the new webkitWebViewRunAsModalPage function.
+        (attachUIClientToView): Add runModal.
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (_WebKitWebViewPrivate): Add an atribute for a new main loop.
+        (webkitWebViewFinalize): Make sure the main loop for main dialogs,
+        if any, is stopped if it was still running.
+        (webkit_web_view_class_init): Declare new signal 'run-as-modal'.
+        (webkitWebViewRunAsModal): Emit the 'run-as-modal' signal and, if
+        handled, create and run a new main loop.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        (_WebKitWebViewClass): New handler for the 'run-as-modal' signal.
+        * UIProcess/API/gtk/WebKitWebViewPrivate.h: Add webkitWebViewRunAsModalPage.
+
+        Allow setting and getting the value of WebPage's canRunModal
+        attribute in the WebProcess from the UIProcess after the creation
+        of a WebPage, to allow using it from WebKitWebView to allow the
+        client application to decide whether to allow create modal
+        dialogs, which would result in launching an additional nested
+        event loop in the web process, after creating the dialog.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy): Initialize the new
+        m_canRunModal attribute, to cache the current status of the
+        WebPage in the WebProcess.
+        (WebKit::WebPageProxy::initializeUIClient): Call the new function
+        setCanRunModal, instead of manually sending the SetCanRunModal message.
+        (WebKit::WebPageProxy::creationParameters): Use m_canRunModal
+        instead of m_uiClient.canRunModal when preparing the parameters.
+        (WebKit::WebPageProxy::setCanRunModal): New public function, it
+        sets the value of m_canRunModal and sends a message to the Web
+        process for updating the WebPage, whenever possible.
+        (WebKit::WebPageProxy::canRunModal): New public function, returns
+        the value of the m_canRunModal attribute.
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy): Added new public functions and private attribute.
+
+        New property in WebKitSettings to be able to decide whether it is
+        allowed to create and run new child webviews as modal dialogs.
+
+        * UIProcess/API/gtk/WebKitSettings.cpp:
+        (_WebKitSettingsPrivate): New attribute allowModalDialogs.
+        (webKitSettingsSetProperty): Handle the new property.
+        (webKitSettingsGetProperty): Ditto.
+        (webkit_settings_class_init): Install the new property.
+        (webkitSettingsAttachSettingsToPage): Make sure the WebPage is
+        initialized with the value of the new property.
+        (webkit_settings_set_allow_modal_dialogs): New setter.
+        (webkit_settings_get_allow_modal_dialogs): New getter.
+        * UIProcess/API/gtk/WebKitSettings.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Added new accessors.
+
+        Connect to the 'notify::allow-modal-dialogs' signal from
+        WebKitSettings to ensure that canRunModal property of the WebPage
+        is kept up to date. Ensure that signal handlers for monitoring
+        settings are disconnected when the webview is finalized.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkitWebViewSetSettings): Connect to the new signal
+        'notify::allow-modal-dialogs', from WebKitSettings.
+        (allowModalDialogsChanged): Callback to update WebPage's
+        canRunModal property when updated through WebKitSettings.
+        (webkitWebViewDisconnectSettingsSignalHandlers): Disconnect signal
+        handlers for monitoring WebKitSettings properties.
+        (webkitWebViewFinalize): Ensure signal handlers are disconnected.
+        (webkit_web_view_set_settings): Ditto.
+        * UIProcess/API/gtk/WebKitWebView.h:
+
+        Add new unit tests to check the 'run-as-modal' signal is emitted
+        only when the new property in WebKitSettings is set to TRUE.
+
+        * UIProcess/API/gtk/tests/TestWebKitWebView.cpp:
+        (testWebViewAllowModalDialogs): New unit test to check that modal
+        dialogs are properly created from JavaScript when allowed.
+        (testWebViewDisallowModalDialogs): New unit test to check that
+        it's not possible to create modal dialogs when not allowed.
+        (beforeAll): Add the new unit test.
+
+2012-06-20  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [WK2] Color chooser API missing
+        https://bugs.webkit.org/show_bug.cgi?id=87495
+
+        Reviewed by Andreas Kling.
+
+        Added ColorChooser API to WebKit2. This API allows the
+        embedder to define a custom color picker for <input type="color">.
+
+        Only one ColorChooser can be active for a page at a time. Although
+        the implementation doesn't not assume a modal dialog, no other
+        color chooser will be created until the active one is closed.
+
+        Also added stubs for all platforms, so it wont break the build when
+        enabling color chooser, even though they don't have the backend
+        implemented yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/API/efl/PageClientImpl.cpp:
+        (WebKit):
+        (WebKit::PageClientImpl::createColorChooserProxy):
+        * UIProcess/API/efl/PageClientImpl.h:
+        (PageClientImpl):
+        * UIProcess/API/gtk/PageClientImpl.cpp:
+        (WebKit):
+        (WebKit::PageClientImpl::createColorChooserProxy):
+        * UIProcess/API/gtk/PageClientImpl.h:
+        (PageClientImpl):
+        * UIProcess/API/mac/PageClientImpl.h:
+        (PageClientImpl):
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit):
+        (WebKit::PageClientImpl::createColorChooserProxy):
+        * UIProcess/PageClient.h:
+        (WebKit):
+        (PageClient):
+        * UIProcess/WebColorChooserProxy.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserProxy):
+        (Client):
+        (WebKit::WebColorChooserProxy::Client::~Client):
+        (WebKit::WebColorChooserProxy::~WebColorChooserProxy):
+        (WebKit::WebColorChooserProxy::invalidate):
+        (WebKit::WebColorChooserProxy::WebColorChooserProxy):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::close):
+        (WebKit):
+        (WebKit::WebPageProxy::showColorChooser):
+        (WebKit::WebPageProxy::setColorChooserColor):
+        (WebKit::WebPageProxy::endColorChooser):
+        (WebKit::WebPageProxy::didChooseColor):
+        (WebKit::WebPageProxy::didEndColorChooser):
+        (WebKit::WebPageProxy::processDidCrash):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * UIProcess/qt/QtPageClient.cpp:
+        (WebKit):
+        (WebKit::QtPageClient::createColorChooserProxy):
+        * UIProcess/qt/QtPageClient.h:
+        (QtPageClient):
+        * UIProcess/win/WebView.cpp:
+        (WebKit):
+        (WebKit::WebView::createColorChooserProxy):
+        * UIProcess/win/WebView.h:
+        (WebView):
+        * WebKit2.xcodeproj/project.pbxproj:
+        * WebProcess/WebCoreSupport/WebChromeClient.cpp:
+        (WebKit::WebChromeClient::createColorChooser):
+        * WebProcess/WebCoreSupport/WebColorChooser.cpp: Added.
+        (WebKit):
+        (WebKit::WebColorChooser::WebColorChooser):
+        (WebKit::WebColorChooser::~WebColorChooser):
+        (WebKit::WebColorChooser::didChooseColor):
+        (WebKit::WebColorChooser::didEndChooser):
+        (WebKit::WebColorChooser::disconnectFromPage):
+        (WebKit::WebColorChooser::setSelectedColor):
+        (WebKit::WebColorChooser::endChooser):
+        * WebProcess/WebCoreSupport/WebColorChooser.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebColorChooser):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+        (WebKit::WebPage::close):
+        (WebKit):
+        (WebKit::WebPage::setActiveColorChooser):
+        (WebKit::WebPage::didEndColorChooser):
+        (WebKit::WebPage::didChooseColor):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit):
+        (WebPage):
+        (WebKit::WebPage::activeColorChooser):
+        * WebProcess/WebPage/WebPage.messages.in:
+        * win/WebKit2.vcproj:
+
+2012-06-20  Brady Eidson  <beidson@apple.com>
+
+        <rdar://problem/11653784> and https://bugs.webkit.org/show_bug.cgi?id=89590
+        showModalDialog message handling is flaky in WebKit2
+
+        Because RunLoop::performWork() swaps the function queue to a temporary Vector before calling
+        the functions an inner run-loop - such as we see with running a modal dialog - does not have
+        a change to handle any of the functions that were queued after the WebPageProxy::RunModal message.
+
+        By servicing the functions in the queue one at a time we can give the RunLoop a chance to pick up
+        where it left off if RunLoop::performWork is re-entered.
+
+        To guarantee RunLoop::performWork is re-entered to handle those functions we also need to signal
+        its source before entering the modal run loop so our RunLoop is woken up.
+
+        Reviewed by Darin Adler.
+
+        * Platform/CoreIPC/Connection.cpp:
+        (CoreIPC::Connection::wakeUpRunLoop): Added so the WebPageProxy can signal the runloop to be woken up
+          before it enters the modal dialog run loop.
+        * Platform/CoreIPC/Connection.h:
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::runModal): Call wakeUpRunLoop() before entering the modal dialog run loop.
+
+2012-06-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Use IntSize in RenderLayer to represent scroll offsets
+        https://bugs.webkit.org/show_bug.cgi?id=89154
+
+        Reviewed by Eric Seidel.
+
+        * WebProcess/WebPage/win/WebPageWin.cpp:
+        (WebKit::WebPage::gestureDidScroll):
+        Updated to pass an IntSize to scrollByRecursively.
+
+2012-06-20  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Implement Web Intent delivery
+        https://bugs.webkit.org/show_bug.cgi?id=88989
+
+        Reviewed by Anders Carlsson.
+
+        Add a deliverIntent() method to the WebFrame so that
+        Web intents can be delivered once matched to a
+        specific service.
+
+        * UIProcess/WebFrameProxy.cpp:
+        (WebKit):
+        (WebKit::WebFrameProxy::deliverIntent):
+        * UIProcess/WebFrameProxy.h:
+        (WebKit):
+        (WebFrameProxy):
+        * UIProcess/WebIntentData.h:
+        (WebKit::WebIntentData::store):
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit):
+        (WebKit::WebFrame::deliverIntent):
+        * WebProcess/WebPage/WebFrame.h:
+        (WebKit):
+        (WebFrame):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit):
+        (WebKit::WebPage::deliverIntentToFrame):
+        * WebProcess/WebPage/WebPage.h:
+        (WebKit):
+        (WebPage):
+        * WebProcess/WebPage/WebPage.messages.in:
+
+2012-06-20  Alexis Menard  <alexis.menard@openbossa.org>
+
+        REGRESSION (120705) : LayerTreeHostQt asserts in debug.
+        https://bugs.webkit.org/show_bug.cgi?id=89487
+
+        Reviewed by Noam Rosenthal.
+
+        We try to call createHandle twice on the same handle when the
+        first matching atlas is full. This patch solved the problem by
+        moving the createHandle call inside UpdateAtlas and call createHandle
+        only when the atlas is not full. We can also remove the surface()
+        getter as it is not used anymore.
+
+        * WebProcess/WebPage/UpdateAtlas.cpp:
+        (WebKit::UpdateAtlas::beginPaintingOnAvailableBuffer):
+        * WebProcess/WebPage/UpdateAtlas.h:
+        (UpdateAtlas):
+        * WebProcess/WebPage/qt/LayerTreeHostQt.cpp:
+        (WebKit::LayerTreeHostQt::beginContentUpdate):
+
 2012-06-19  Ryuan Choi  <ryuan.choi@samsung.com>
 
         [EFL][Regression] Build break after r120786
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index 0ca351439..b1b84966d 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -41,6 +41,7 @@ ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
 ENABLE_CSS_VARIABLES = ;
diff --git a/Source/WebKit2/GNUmakefile.list.am b/Source/WebKit2/GNUmakefile.list.am
index 35239180d..a6bc70d84 100644
--- a/Source/WebKit2/GNUmakefile.list.am
+++ b/Source/WebKit2/GNUmakefile.list.am
@@ -63,6 +63,7 @@ webkit2_h_api += \
 	$(WebKit2)/UIProcess/API/C/WKGrammarDetail.h \
 	$(WebKit2)/UIProcess/API/C/WKHitTestResult.h \
 	$(WebKit2)/UIProcess/API/C/WKInspector.h \
+	$(WebKit2)/UIProcess/API/C/WKIntentData.h \
 	$(WebKit2)/UIProcess/API/C/WKKeyValueStorageManager.h \
 	$(WebKit2)/UIProcess/API/C/WKMediaCacheManager.h \
 	$(WebKit2)/UIProcess/API/C/WKNativeEvent.h \
@@ -88,6 +89,9 @@ webkit2_h_api += \
 webkit2gtk_h_api += \
 	$(WebKit2)/UIProcess/API/gtk/WebKitBackForwardList.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitBackForwardListItem.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitContextMenu.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitContextMenuActions.h \
+	$(WebKit2)/UIProcess/API/gtk/WebKitContextMenuItem.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitCookieManager.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitDefines.h \
 	$(WebKit2)/UIProcess/API/gtk/WebKitDownload.h \
@@ -532,6 +536,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/WKIconDatabase.h \
 	Source/WebKit2/UIProcess/API/C/WKInspector.cpp \
 	Source/WebKit2/UIProcess/API/C/WKInspector.h \
+	Source/WebKit2/UIProcess/API/C/WKIntentData.cpp \
+	Source/WebKit2/UIProcess/API/C/WKIntentData.h \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.cpp \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.h \
 	Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp \
@@ -575,8 +581,17 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListItem.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListItem.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitBackForwardListPrivate.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuPrivate.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActionsPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuClient.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuClient.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.cpp \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.h \
+	Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItemPrivate.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitCookieManager.h \
 	Source/WebKit2/UIProcess/API/gtk/WebKitCookieManager.cpp \
 	Source/WebKit2/UIProcess/API/gtk/WebKitCookieManagerPrivate.h \
@@ -756,6 +771,7 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebBackForwardList.cpp \
 	Source/WebKit2/UIProcess/WebBackForwardList.h \
+	Source/WebKit2/UIProcess/WebColorChooserProxy.h \
 	Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp \
 	Source/WebKit2/UIProcess/WebConnectionToWebProcess.h \
 	Source/WebKit2/UIProcess/WebContext.cpp \
@@ -999,6 +1015,8 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebAlternativeTextClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebContextMenuClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp \
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.cpp b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
index a3aa88c53..d22b8b4c1 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.cpp
@@ -717,4 +717,9 @@ void Connection::dispatchOneMessage()
     dispatchMessage(incomingMessage);
 }
 
+void Connection::wakeUpRunLoop()
+{
+    m_clientRunLoop->wakeUp();
+}
+
 } // namespace CoreIPC
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index 3541b0ad7..773f6e0d1 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -167,6 +167,8 @@ public:
     // All clients should move to the overloads that take a message type.
     template<typename E, typename T> bool deprecatedSend(E messageID, uint64_t destinationID, const T& arguments);
     template<typename E, typename T, typename U> bool deprecatedSendSync(E messageID, uint64_t destinationID, const T& arguments, const U& reply, double timeout = NoTimeout);
+    
+    void wakeUpRunLoop();
 
 private:
     template<typename T> class Message {
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index 472a86a2c..5f6e09e3a 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -25,6 +25,8 @@ LIST(APPEND WebKit2_SOURCES
     Shared/efl/WebEventFactory.cpp
     Shared/efl/WebCoreArgumentCodersEfl.cpp
 
+    UIProcess/API/C/efl/WKView.cpp
+
     UIProcess/API/C/soup/WKContextSoup.cpp
     UIProcess/API/C/soup/WKSoupRequestManager.cpp
 
@@ -85,6 +87,7 @@ LIST(APPEND WebKit2_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/network/soup"
     "${WEBCORE_DIR}/svg/graphics"
     "${WEBKIT2_DIR}/Shared/efl"
+    "${WEBKIT2_DIR}/UIProcess/API/C/efl"
     "${WEBKIT2_DIR}/UIProcess/API/C/soup"
     "${WEBKIT2_DIR}/UIProcess/API/efl"
     "${WEBKIT2_DIR}/UIProcess/soup"
@@ -145,3 +148,13 @@ ADD_CUSTOM_TARGET(forwarding-headerSoup
     COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT2_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include soup
 )
 SET(ForwardingNetworkHeaders_NAME forwarding-headerSoup)
+
+CONFIGURE_FILE(efl/ewebkit2.pc.in ${CMAKE_BINARY_DIR}/WebKit2/efl/ewebkit2.pc @ONLY)
+SET (EWebKit2_HEADERS
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/EWebKit2.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_context.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_view.h"
+)
+
+INSTALL(FILES ${CMAKE_BINARY_DIR}/WebKit2/efl/ewebkit2.pc DESTINATION lib/pkgconfig)
+INSTALL(FILES ${EWebKit2_HEADERS} DESTINATION include/${WebKit2_LIBRARY_NAME}-${PROJECT_VERSION_MAJOR})
diff --git a/Source/WebKit2/Shared/API/c/WKBase.h b/Source/WebKit2/Shared/API/c/WKBase.h
index 37a64f052..8b7e81fbc 100644
--- a/Source/WebKit2/Shared/API/c/WKBase.h
+++ b/Source/WebKit2/Shared/API/c/WKBase.h
@@ -41,6 +41,10 @@
 #include <WebKit2/WKBaseSoup.h>
 #endif
 
+#if defined(BUILDING_EFL__)
+#include <WebKit2/WKBaseEfl.h>
+#endif
+
 /* WebKit2 shared types */
 
 typedef uint32_t WKTypeID;
diff --git a/Source/WebKit2/Shared/API/c/efl/WKBaseEfl.h b/Source/WebKit2/Shared/API/c/efl/WKBaseEfl.h
new file mode 100644
index 000000000..6184c8191
--- /dev/null
+++ b/Source/WebKit2/Shared/API/c/efl/WKBaseEfl.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WKBaseEfl_h
+#define WKBaseEfl_h
+
+#ifndef WKBase_h
+#error "Please #include \"WKBase.h\" instead of this file directly."
+#endif
+
+typedef const struct OpaqueWKView* WKViewRef;
+
+#endif /* WKBaseEfl_h */
diff --git a/Source/WebKit2/Shared/IntentData.cpp b/Source/WebKit2/Shared/IntentData.cpp
index ae0afbd8c..388a3a567 100644
--- a/Source/WebKit2/Shared/IntentData.cpp
+++ b/Source/WebKit2/Shared/IntentData.cpp
@@ -40,6 +40,7 @@ void IntentData::encode(CoreIPC::ArgumentEncoder* encoder) const
 {
     encoder->encode(action);
     encoder->encode(type);
+    encoder->encode(service);
     encoder->encode(CoreIPC::DataReference(data));
     encoder->encode(extras);
     encoder->encode(suggestions);
@@ -51,6 +52,8 @@ bool IntentData::decode(CoreIPC::ArgumentDecoder* decoder, IntentData& intentDat
         return false;
     if (!decoder->decode(intentData.type))
         return false;
+    if (!decoder->decode(intentData.service))
+        return false;
     CoreIPC::DataReference data;
     if (!decoder->decode(data))
         return false;
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index 9e5bc4e37..7b9ab99ef 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -161,6 +161,7 @@ HEADERS += \
     UIProcess/API/C/WKHitTestResult.h \
     UIProcess/API/C/WKIconDatabase.h \
     UIProcess/API/C/WKInspector.h \
+    UIProcess/API/C/WKIntentData.h \
     UIProcess/API/C/WKOpenPanelParameters.h \
     UIProcess/API/C/WKOpenPanelResultListener.h \
     UIProcess/API/C/WKNavigationData.h \
@@ -229,6 +230,7 @@ HEADERS += \
     UIProcess/VisitedLinkProvider.h \
     UIProcess/WebApplicationCacheManagerProxy.h \
     UIProcess/WebBackForwardList.h \
+    UIProcess/WebColorChooserProxy.h \
     UIProcess/WebConnectionToWebProcess.h \
     UIProcess/WebContext.h \
     UIProcess/WebContextConnectionClient.h \
@@ -345,6 +347,7 @@ HEADERS += \
     WebProcess/Plugins/PluginProcessConnection.h \
     WebProcess/Plugins/PluginProcessConnectionManager.h \
     WebProcess/WebCoreSupport/WebChromeClient.h \
+    WebProcess/WebCoreSupport/WebColorChooser.h \
     WebProcess/WebCoreSupport/WebContextMenuClient.h \
     WebProcess/WebCoreSupport/WebDatabaseManager.h \
     WebProcess/WebCoreSupport/WebDragClient.h \
@@ -517,6 +520,7 @@ SOURCES += \
     UIProcess/API/C/WKHitTestResult.cpp \
     UIProcess/API/C/WKIconDatabase.cpp \
     UIProcess/API/C/WKInspector.cpp \
+    UIProcess/API/C/WKIntentData.cpp \
     UIProcess/API/C/WKNotification.cpp \
     UIProcess/API/C/WKNotificationManager.cpp \
     UIProcess/API/C/WKNotificationPermissionRequest.cpp \
@@ -711,6 +715,7 @@ SOURCES += \
     WebProcess/Plugins/PluginProcessConnection.cpp \
     WebProcess/Plugins/PluginProcessConnectionManager.cpp \
     WebProcess/WebCoreSupport/WebChromeClient.cpp \
+    WebProcess/WebCoreSupport/WebColorChooser.cpp \
     WebProcess/WebCoreSupport/WebContextMenuClient.cpp \
     WebProcess/WebCoreSupport/WebDatabaseManager.cpp \
     WebProcess/WebCoreSupport/WebDragClient.cpp \
@@ -806,6 +811,13 @@ contains(DEFINES, ENABLE_TOUCH_EVENTS=1) {
         Shared/qt/NativeWebTouchEventQt.cpp
 }
 
+contains(DEFINES, ENABLE_INPUT_TYPE_COLOR=1) {
+    HEADERS += \
+        UIProcess/qt/WebColorChooserProxyQt.h
+    SOURCES += \
+        UIProcess/qt/WebColorChooserProxyQt.cpp
+}
+
 contains(DEFINES, ENABLE_GEOLOCATION=1): QT += location
 
 plugin_backend_xlib {
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index 9bc9ea607..816f8f1ae 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -368,4 +368,8 @@ inline ProxyingRefPtr<WebGrammarDetail> toAPI(const WebCore::GrammarDetail& gram
 #include "WKAPICastSoup.h"
 #endif
 
+#if defined(BUILDING_EFL__)
+#include "WKAPICastEfl.h"
+#endif
+
 #endif // WKAPICast_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKIntentData.cpp b/Source/WebKit2/UIProcess/API/C/WKIntentData.cpp
new file mode 100644
index 000000000..a42f530ac
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIntentData.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKIntentData.h"
+
+#include "ImmutableArray.h"
+#include "ImmutableDictionary.h"
+#include "WKAPICast.h"
+
+#if ENABLE(WEB_INTENTS)
+#include "WebIntentData.h"
+#endif
+
+using namespace WebKit;
+
+WKTypeID WKIntentDataGetTypeID()
+{
+#if ENABLE(WEB_INTENTS)
+    return toAPI(WebIntentData::APIType);
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentDataCopyAction(WKIntentDataRef intentRef)
+{
+#if ENABLE(WEB_INTENTS)
+    return toCopiedAPI(toImpl(intentRef)->action());
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentDataCopyType(WKIntentDataRef intentRef)
+{
+#if ENABLE(WEB_INTENTS)
+    return toCopiedAPI(toImpl(intentRef)->payloadType());
+#else
+    return 0;
+#endif
+}
+
+WKURLRef WKIntentDataCopyService(WKIntentDataRef intentRef)
+{
+#if ENABLE(WEB_INTENTS)
+    return toCopiedURLAPI(toImpl(intentRef)->service());
+#else
+    return 0;
+#endif
+}
+
+WKArrayRef WKIntentDataCopySuggestions(WKIntentDataRef intentRef)
+{
+#if ENABLE(WEB_INTENTS)
+    return toAPI(toImpl(intentRef)->suggestions().leakRef());
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentDataCopyExtra(WKIntentDataRef intentRef, WKStringRef key)
+{
+#if ENABLE(WEB_INTENTS)
+    return toCopiedAPI(toImpl(intentRef)->extra(toWTFString(key)));
+#else
+    return 0;
+#endif
+}
+
+WKDictionaryRef WKIntentDataCopyExtras(WKIntentDataRef intentRef)
+{
+#if ENABLE(WEB_INTENTS)
+    return toAPI(toImpl(intentRef)->extras().leakRef());
+#else
+    return 0;
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKIntentData.h b/Source/WebKit2/UIProcess/API/C/WKIntentData.h
new file mode 100644
index 000000000..030555b4b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIntentData.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKIntentData_h
+#define WKIntentData_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKIntentDataGetTypeID();
+WK_EXPORT WKStringRef WKIntentDataCopyAction(WKIntentDataRef intentRef);
+WK_EXPORT WKStringRef WKIntentDataCopyType(WKIntentDataRef intentRef);
+WK_EXPORT WKURLRef WKIntentDataCopyService(WKIntentDataRef intentRef);
+WK_EXPORT WKArrayRef WKIntentDataCopySuggestions(WKIntentDataRef intentRef);
+WK_EXPORT WKStringRef WKIntentDataCopyExtra(WKIntentDataRef intentRef, WKStringRef key);
+WK_EXPORT WKDictionaryRef WKIntentDataCopyExtras(WKIntentDataRef intentRef);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKIntentData_h
diff --git a/Source/WebKit2/UIProcess/API/C/efl/WKAPICastEfl.h b/Source/WebKit2/UIProcess/API/C/efl/WKAPICastEfl.h
new file mode 100644
index 000000000..5a068ef36
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/efl/WKAPICastEfl.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WKAPICastEfl_h
+#define WKAPICastEfl_h
+
+#ifndef WKAPICast_h
+#error "Please #include \"WKAPICast.h\" instead of this file directly."
+#endif
+
+typedef struct _Evas_Object Evas_Object;
+
+namespace WebKit {
+
+WK_ADD_API_MAPPING(WKViewRef, Evas_Object)
+
+}
+
+#endif // WKAPICastEfl_h
diff --git a/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp b/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp
new file mode 100644
index 000000000..03f6930dd
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/efl/WKView.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WKView.h"
+
+#include "WKAPICast.h"
+#include "ewk_view_private.h"
+
+using namespace WebKit;
+
+WKViewRef WKViewCreate(Evas* canvas, WKContextRef contextRef, WKPageGroupRef pageGroupRef)
+{
+    return toAPI(ewk_view_base_add(canvas, contextRef, pageGroupRef));
+}
+
+WKPageRef WKViewGetPage(WKViewRef viewRef)
+{
+    return toAPI(ewk_view_page_get(toImpl(viewRef)));
+}
diff --git a/Source/WebKit2/UIProcess/API/C/efl/WKView.h b/Source/WebKit2/UIProcess/API/C/efl/WKView.h
new file mode 100644
index 000000000..1a7961daa
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/efl/WKView.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WKView_h
+#define WKView_h
+
+#include <WebKit2/WKBase.h>
+
+typedef struct _Evas Evas;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKViewRef WKViewCreate(Evas* canvas, WKContextRef context, WKPageGroupRef pageGroup);
+
+WK_EXPORT WKPageRef WKViewGetPage(WKViewRef view);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKView_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
index 567548f5d..e69f87d28 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.cpp
@@ -205,6 +205,14 @@ PassRefPtr<WebContextMenuProxy> PageClientImpl::createContextMenuProxy(WebPagePr
     return 0;
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> PageClientImpl::createColorChooserProxy(WebPageProxy*, const WebCore::Color&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 void PageClientImpl::setFindIndicator(PassRefPtr<FindIndicator>, bool, bool)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
index a4dcd93e3..427ef5297 100644
--- a/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/efl/PageClientImpl.h
@@ -84,6 +84,10 @@ private:
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*);
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& initialColor);
+#endif
+
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool, bool);
 #if USE(ACCELERATED_COMPOSITING)
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
index 01fd5e669..fe384e377 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
@@ -629,3 +629,11 @@ void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const IntSiz
     evas_object_image_size_set(smartData->image, size.width(), size.height());
     evas_object_image_data_copy_set(smartData->image, imageData);
 }
+
+WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    return priv->pageClient->page();
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
index 2b3f476ba..62598e4c0 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
@@ -36,4 +36,6 @@ void ewk_view_title_changed(Evas_Object* ewkView, const char* title);
 
 Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef, WKPageGroupRef);
 
+WebKit::WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView);
+
 #endif // ewk_view_private_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
index 8fbfe73f6..8ecd480e5 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp
@@ -229,6 +229,14 @@ PassRefPtr<WebContextMenuProxy> PageClientImpl::createContextMenuProxy(WebPagePr
     return WebContextMenuProxyGtk::create(m_viewWidget, page);
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> PageClientImpl::createColorChooserProxy(WebPageProxy*, const WebCore::Color&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 void PageClientImpl::setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
index 54ad99f8f..72fc34539 100644
--- a/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h
@@ -81,6 +81,9 @@ private:
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled);
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*);
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& intialColor);
+#endif
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate);
     virtual void didChangeScrollbarsForMainFrame() const;
     virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>& updateRects);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.cpp
new file mode 100644
index 000000000..f05fbf93f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitContextMenu.h"
+
+#include "WebKitContextMenuItemPrivate.h"
+#include "WebKitContextMenuPrivate.h"
+
+using namespace WebKit;
+using namespace WebCore;
+
+struct _WebKitContextMenuPrivate {
+    GList* items;
+    WebKitContextMenuItem* parentItem;
+};
+
+G_DEFINE_TYPE(WebKitContextMenu, webkit_context_menu, G_TYPE_OBJECT)
+
+static void webkitContextMenuFinalize(GObject* object)
+{
+    WebKitContextMenu* menu = WEBKIT_CONTEXT_MENU(object);
+    webkit_context_menu_remove_all(menu);
+    menu->priv->~WebKitContextMenuPrivate();
+    G_OBJECT_CLASS(webkit_context_menu_parent_class)->finalize(object);
+}
+
+static void webkit_context_menu_init(WebKitContextMenu* menu)
+{
+    WebKitContextMenuPrivate* priv = G_TYPE_INSTANCE_GET_PRIVATE(menu, WEBKIT_TYPE_CONTEXT_MENU, WebKitContextMenuPrivate);
+    menu->priv = priv;
+    new (priv) WebKitContextMenuPrivate();
+}
+
+static void webkit_context_menu_class_init(WebKitContextMenuClass* listClass)
+{
+    GObjectClass* gObjectClass = G_OBJECT_CLASS(listClass);
+    gObjectClass->finalize = webkitContextMenuFinalize;
+
+    g_type_class_add_private(listClass, sizeof(WebKitContextMenuPrivate));
+}
+
+void webkitContextMenuPopulate(WebKitContextMenu* menu, Vector<ContextMenuItem>& contextMenuItems)
+{
+    for (GList* item = menu->priv->items; item; item = g_list_next(item)) {
+        WebKitContextMenuItem* menuItem = WEBKIT_CONTEXT_MENU_ITEM(item->data);
+        contextMenuItems.append(ContextMenuItem(webkitContextMenuItemRelease(menuItem)));
+    }
+}
+
+WebKitContextMenu* webkitContextMenuCreate(WKArrayRef wkItems)
+{
+    WebKitContextMenu* menu = webkit_context_menu_new();
+    for (size_t i = 0; i < WKArrayGetSize(wkItems); ++i) {
+        WKContextMenuItemRef wkItem = static_cast<WKContextMenuItemRef>(WKArrayGetItemAtIndex(wkItems, i));
+        webkit_context_menu_prepend(menu, webkitContextMenuItemCreate(wkItem));
+    }
+    menu->priv->items = g_list_reverse(menu->priv->items);
+
+    return menu;
+}
+
+void webkitContextMenuSetParentItem(WebKitContextMenu* menu, WebKitContextMenuItem* item)
+{
+    menu->priv->parentItem = item;
+}
+
+WebKitContextMenuItem* webkitContextMenuGetParentItem(WebKitContextMenu* menu)
+{
+    return menu->priv->parentItem;
+}
+
+/**
+ * webkit_context_menu_new:
+ *
+ * Creates a new #WebKitContextMenu object to be used as a submenu of an existing
+ * #WebKitContextMenu. The context menu of a #WebKitWebView is created by the view
+ * and passed as an argument of #WebKitWebView::context-menu signal.
+ * To add items to the menu use webkit_context_menu_prepend(),
+ * webkit_context_menu_append() or webkit_context_menu_insert().
+ * See also webkit_context_menu_new_with_items() to create a #WebKitContextMenu with
+ * a list of initial items.
+ *
+ * Returns: The newly created #WebKitContextMenu object
+ */
+WebKitContextMenu* webkit_context_menu_new()
+{
+    return WEBKIT_CONTEXT_MENU(g_object_new(WEBKIT_TYPE_CONTEXT_MENU, NULL));
+}
+
+/**
+ * webkit_context_menu_new_with_items:
+ * @items: (element-type WebKitContextMenuItem): a #GList of #WebKitContextMenuItem
+ *
+ * Creates a new #WebKitContextMenu object to be used as a submenu of an existing
+ * #WebKitContextMenu with the given initial items.
+ * See also webkit_context_menu_new()
+ *
+ * Returns: The newly created #WebKitContextMenu object
+ */
+WebKitContextMenu* webkit_context_menu_new_with_items(GList* items)
+{
+    WebKitContextMenu* menu = webkit_context_menu_new();
+    g_list_foreach(items, reinterpret_cast<GFunc>(g_object_ref_sink), 0);
+    menu->priv->items = g_list_copy(items);
+
+    return menu;
+}
+
+/**
+ * webkit_context_menu_prepend:
+ * @menu: a #WebKitContextMenu
+ * @item: the #WebKitContextMenuItem to add
+ *
+ * Adds @item at the beginning of the @menu.
+ */
+void webkit_context_menu_prepend(WebKitContextMenu* menu, WebKitContextMenuItem* item)
+{
+    webkit_context_menu_insert(menu, item, 0);
+}
+
+/**
+ * webkit_context_menu_append:
+ * @menu: a #WebKitContextMenu
+ * @item: the #WebKitContextMenuItem to add
+ *
+ * Adds @item at the end of the @menu.
+ */
+void webkit_context_menu_append(WebKitContextMenu* menu, WebKitContextMenuItem* item)
+{
+    webkit_context_menu_insert(menu, item, -1);
+}
+
+/**
+ * webkit_context_menu_insert:
+ * @menu: a #WebKitContextMenu
+ * @item: the #WebKitContextMenuItem to add
+ * @position: the position to insert the item
+ *
+ * Inserts @item into the @menu at the given position.
+ * If @position is negative, or is larger than the number of items
+ * in the #WebKitContextMenu, the item is added on to the end of
+ * the @menu. The first position is 0.
+ */
+void webkit_context_menu_insert(WebKitContextMenu* menu, WebKitContextMenuItem* item, int position)
+{
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU(menu));
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item));
+
+    g_object_ref_sink(item);
+    menu->priv->items = g_list_insert(menu->priv->items, item, position);
+}
+
+/**
+ * webkit_context_menu_move_item:
+ * @menu: a #WebKitContextMenu
+ * @item: the #WebKitContextMenuItem to add
+ * @position: the new position to move the item
+ *
+ * Moves @item to the given position in the @menu.
+ * If @position is negative, or is larger than the number of items
+ * in the #WebKitContextMenu, the item is added on to the end of
+ * the @menu.
+ * The first position is 0.
+ */
+void webkit_context_menu_move_item(WebKitContextMenu* menu, WebKitContextMenuItem* item, int position)
+{
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU(menu));
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item));
+
+    if (!g_list_find(menu->priv->items, item))
+        return;
+
+    menu->priv->items = g_list_remove(menu->priv->items, item);
+    menu->priv->items = g_list_insert(menu->priv->items, item, position);
+}
+
+/**
+ * webkit_context_menu_get_items:
+ * @menu: a #WebKitContextMenu
+ *
+ * Returns the item list of @menu.
+ *
+ * Returns: (element-type WebKitContextMenuItem) (transfer none): a #GList of
+ *    #WebKitContextMenuItem<!-- -->s
+ */
+GList* webkit_context_menu_get_items(WebKitContextMenu* menu)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(menu), 0);
+
+    return menu->priv->items;
+}
+
+/**
+ * webkit_context_menu_get_n_items:
+ * @menu: a #WebKitContextMenu
+ *
+ * Gets the length of the @menu.
+ *
+ * Returns: the number of #WebKitContextMenuItem<!-- -->s in @menu
+ */
+guint webkit_context_menu_get_n_items(WebKitContextMenu* menu)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(menu), 0);
+
+    return g_list_length(menu->priv->items);
+}
+
+/**
+ * webkit_context_menu_first:
+ * @menu: a #WebKitContextMenu
+ *
+ * Gets the first item in the @menu.
+ *
+ * Returns: (transfer none): the first #WebKitContextMenuItem of @menu,
+ *    or %NULL if the #WebKitContextMenu is empty.
+ */
+WebKitContextMenuItem* webkit_context_menu_first(WebKitContextMenu* menu)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(menu), 0);
+
+    return menu->priv->items ? WEBKIT_CONTEXT_MENU_ITEM(menu->priv->items->data) : 0;
+}
+
+/**
+ * webkit_context_menu_last:
+ * @menu: a #WebKitContextMenu
+ *
+ * Gets the last item in the @menu.
+ *
+ * Returns: (transfer none): the last #WebKitContextMenuItem of @menu,
+ *    or %NULL if the #WebKitContextMenu is empty.
+ */
+WebKitContextMenuItem* webkit_context_menu_last(WebKitContextMenu* menu)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(menu), 0);
+
+    GList* last = g_list_last(menu->priv->items);
+    return last ? WEBKIT_CONTEXT_MENU_ITEM(last->data) : 0;
+}
+
+/**
+ * webkit_context_menu_get_item_at_position:
+ * @menu: a #WebKitContextMenu
+ * @position: the position of the item, counting from 0
+ *
+ * Gets the item at the given position in the @menu.
+ *
+ * Returns: (transfer none): the #WebKitContextMenuItem at position @position in @menu,
+ *    or %NULL if the position is off the end of the @menu.
+ */
+WebKitContextMenuItem* webkit_context_menu_get_item_at_position(WebKitContextMenu* menu, unsigned position)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(menu), 0);
+
+    gpointer item = g_list_nth_data(menu->priv->items, position);
+    return item ? WEBKIT_CONTEXT_MENU_ITEM(item) : 0;
+}
+
+/**
+ * webkit_context_menu_remove:
+ * @menu: a #WebKitContextMenu
+ * @item: the #WebKitContextMenuItem to remove
+ *
+ * Removes @item from the @menu.
+ * See also webkit_context_menu_remove_all() to remove all items.
+ */
+void webkit_context_menu_remove(WebKitContextMenu* menu, WebKitContextMenuItem* item)
+{
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU(menu));
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item));
+
+    if (!g_list_find(menu->priv->items, item))
+        return;
+
+    menu->priv->items = g_list_remove(menu->priv->items, item);
+    g_object_unref(item);
+}
+
+/**
+ * webkit_context_menu_remove_all:
+ * @menu: a #WebKitContextMenu
+ *
+ * Removes all items of the @menu.
+ */
+void webkit_context_menu_remove_all(WebKitContextMenu* menu)
+{
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU(menu));
+
+    g_list_free_full(menu->priv->items, reinterpret_cast<GDestroyNotify>(g_object_unref));
+    menu->priv->items = 0;
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.h
new file mode 100644
index 000000000..9df3f4c11
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenu.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitContextMenu_h
+#define WebKitContextMenu_h
+
+#include <glib-object.h>
+#include <webkit2/WebKitContextMenuItem.h>
+#include <webkit2/WebKitDefines.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_CONTEXT_MENU            (webkit_context_menu_get_type())
+#define WEBKIT_CONTEXT_MENU(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_CONTEXT_MENU, WebKitContextMenu))
+#define WEBKIT_IS_CONTEXT_MENU(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_CONTEXT_MENU))
+#define WEBKIT_CONTEXT_MENU_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_CONTEXT_MENU, WebKitContextMenuClass))
+#define WEBKIT_IS_CONTEXT_MENU_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_CONTEXT_MENU))
+#define WEBKIT_CONTEXT_MENU_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_CONTEXT_MENU, WebKitContextMenuClass))
+
+typedef struct _WebKitContextMenuClass   WebKitContextMenuClass;
+typedef struct _WebKitContextMenuPrivate WebKitContextMenuPrivate;
+
+struct _WebKitContextMenu {
+    GObject parent;
+
+    WebKitContextMenuPrivate *priv;
+};
+
+struct _WebKitContextMenuClass {
+    GObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_context_menu_get_type             (void);
+
+WEBKIT_API WebKitContextMenu *
+webkit_context_menu_new                  (void);
+
+WEBKIT_API WebKitContextMenu *
+webkit_context_menu_new_with_items       (GList                 *items);
+
+WEBKIT_API void
+webkit_context_menu_prepend              (WebKitContextMenu     *menu,
+                                          WebKitContextMenuItem *item);
+
+WEBKIT_API void
+webkit_context_menu_append               (WebKitContextMenu     *menu,
+                                          WebKitContextMenuItem *item);
+
+WEBKIT_API void
+webkit_context_menu_insert               (WebKitContextMenu     *menu,
+                                          WebKitContextMenuItem *item,
+                                          gint                   position);
+
+WEBKIT_API void
+webkit_context_menu_move_item            (WebKitContextMenu     *menu,
+                                          WebKitContextMenuItem *item,
+                                          gint                   position);
+WEBKIT_API GList *
+webkit_context_menu_get_items            (WebKitContextMenu     *menu);
+
+WEBKIT_API guint
+webkit_context_menu_get_n_items          (WebKitContextMenu     *menu);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_first                (WebKitContextMenu     *menu);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_last                 (WebKitContextMenu     *menu);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_get_item_at_position (WebKitContextMenu     *menu,
+                                          guint                  position);
+
+WEBKIT_API void
+webkit_context_menu_remove               (WebKitContextMenu     *menu,
+                                          WebKitContextMenuItem *item);
+
+WEBKIT_API void
+webkit_context_menu_remove_all           (WebKitContextMenu     *menu);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.cpp
new file mode 100644
index 000000000..3793d7c0f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.cpp
@@ -0,0 +1,318 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitContextMenuActions.h"
+
+#include "WebKitContextMenuActionsPrivate.h"
+#include <WebCore/LocalizedStrings.h>
+
+using namespace WebCore;
+
+bool webkitContextMenuActionIsCheckable(WebKitContextMenuAction action)
+{
+    switch (action) {
+    case WEBKIT_CONTEXT_MENU_ACTION_BOLD:
+    case WEBKIT_CONTEXT_MENU_ACTION_ITALIC:
+    case WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE:
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS:
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP:
+        return true;
+    default:
+        return false;
+    }
+}
+
+ContextMenuAction webkitContextMenuActionGetActionTag(WebKitContextMenuAction action)
+{
+    switch (action) {
+    case WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION:
+        return ContextMenuItemTagNoAction;
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK:
+        return ContextMenuItemTagOpenLink;
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW:
+        return ContextMenuItemTagOpenLinkInNewWindow;
+    case WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK:
+        return ContextMenuItemTagDownloadLinkToDisk;
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD:
+        return ContextMenuItemTagCopyLinkToClipboard;
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW:
+        return ContextMenuItemTagOpenImageInNewWindow;
+    case WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK:
+        return ContextMenuItemTagDownloadImageToDisk;
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD:
+        return ContextMenuItemTagCopyImageToClipboard;
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD:
+        return ContextMenuItemTagCopyImageUrlToClipboard;
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_FRAME_IN_NEW_WINDOW:
+        return ContextMenuItemTagOpenFrameInNewWindow;
+    case WEBKIT_CONTEXT_MENU_ACTION_GO_BACK:
+        return ContextMenuItemTagGoBack;
+    case WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD:
+        return ContextMenuItemTagGoForward;
+    case WEBKIT_CONTEXT_MENU_ACTION_STOP:
+        return ContextMenuItemTagStop;
+    case WEBKIT_CONTEXT_MENU_ACTION_RELOAD:
+        return ContextMenuItemTagReload;
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY:
+        return ContextMenuItemTagCopy;
+    case WEBKIT_CONTEXT_MENU_ACTION_CUT:
+        return ContextMenuItemTagCut;
+    case WEBKIT_CONTEXT_MENU_ACTION_PASTE:
+        return ContextMenuItemTagPaste;
+    case WEBKIT_CONTEXT_MENU_ACTION_DELETE:
+        return ContextMenuItemTagDelete;
+    case WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL:
+        return ContextMenuItemTagSelectAll;
+    case WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS:
+        return ContextMenuItemTagInputMethods;
+    case WEBKIT_CONTEXT_MENU_ACTION_UNICODE:
+        return ContextMenuItemTagUnicode;
+    case WEBKIT_CONTEXT_MENU_ACTION_SPELLING_GUESS:
+        return ContextMenuItemTagSpellingGuess;
+    case WEBKIT_CONTEXT_MENU_ACTION_NO_GUESSES_FOUND:
+        return ContextMenuItemTagNoGuessesFound;
+    case WEBKIT_CONTEXT_MENU_ACTION_IGNORE_SPELLING:
+        return ContextMenuItemTagIgnoreSpelling;
+    case WEBKIT_CONTEXT_MENU_ACTION_LEARN_SPELLING:
+        return ContextMenuItemTagLearnSpelling;
+    case WEBKIT_CONTEXT_MENU_ACTION_IGNORE_GRAMMAR:
+        return ContextMenuItemTagIgnoreGrammar;
+    case WEBKIT_CONTEXT_MENU_ACTION_FONT_MENU:
+        return ContextMenuItemTagFontMenu;
+    case WEBKIT_CONTEXT_MENU_ACTION_BOLD:
+        return ContextMenuItemTagBold;
+    case WEBKIT_CONTEXT_MENU_ACTION_ITALIC:
+        return ContextMenuItemTagItalic;
+    case WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE:
+        return ContextMenuItemTagUnderline;
+    case WEBKIT_CONTEXT_MENU_ACTION_OUTLINE:
+        return ContextMenuItemTagOutline;
+    case WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT:
+        return ContextMenuItemTagInspectElement;
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW:
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_AUDIO_IN_NEW_WINDOW:
+        return ContextMenuItemTagOpenMediaInNewWindow;
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD:
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_AUDIO_LINK_TO_CLIPBOARD:
+        return ContextMenuItemTagCopyMediaLinkToClipboard;
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS:
+        return ContextMenuItemTagToggleMediaControls;
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP:
+        return ContextMenuItemTagToggleMediaLoop;
+    case WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN:
+        return ContextMenuItemTagEnterVideoFullscreen;
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY:
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PAUSE:
+        return ContextMenuItemTagMediaPlayPause;
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE:
+        return ContextMenuItemTagMediaMute;
+    case WEBKIT_CONTEXT_MENU_ACTION_CUSTOM:
+        return ContextMenuItemBaseApplicationTag;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return ContextMenuItemBaseApplicationTag;
+}
+
+WebKitContextMenuAction webkitContextMenuActionGetForContextMenuItem(ContextMenuItem* menuItem)
+{
+    switch (menuItem->action()) {
+    case ContextMenuItemTagNoAction:
+        return WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION;
+    case ContextMenuItemTagOpenLink:
+        return WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK;
+    case ContextMenuItemTagOpenLinkInNewWindow:
+        return WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW;
+    case ContextMenuItemTagDownloadLinkToDisk:
+        return WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK;
+    case ContextMenuItemTagCopyLinkToClipboard:
+        return WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD;
+    case ContextMenuItemTagOpenImageInNewWindow:
+        return WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW;
+    case ContextMenuItemTagDownloadImageToDisk:
+        return WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK;
+    case ContextMenuItemTagCopyImageToClipboard:
+        return WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD;
+    case ContextMenuItemTagCopyImageUrlToClipboard:
+        return WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD;
+    case ContextMenuItemTagOpenFrameInNewWindow:
+        return WEBKIT_CONTEXT_MENU_ACTION_OPEN_FRAME_IN_NEW_WINDOW;
+    case ContextMenuItemTagGoBack:
+        return WEBKIT_CONTEXT_MENU_ACTION_GO_BACK;
+    case ContextMenuItemTagGoForward:
+        return WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD;
+    case ContextMenuItemTagStop:
+        return WEBKIT_CONTEXT_MENU_ACTION_STOP;
+    case ContextMenuItemTagReload:
+        return WEBKIT_CONTEXT_MENU_ACTION_RELOAD;
+    case ContextMenuItemTagCopy:
+        return WEBKIT_CONTEXT_MENU_ACTION_COPY;
+    case ContextMenuItemTagCut:
+        return WEBKIT_CONTEXT_MENU_ACTION_CUT;
+    case ContextMenuItemTagPaste:
+        return WEBKIT_CONTEXT_MENU_ACTION_PASTE;
+    case ContextMenuItemTagDelete:
+        return WEBKIT_CONTEXT_MENU_ACTION_DELETE;
+    case ContextMenuItemTagSelectAll:
+        return WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL;
+    case ContextMenuItemTagInputMethods:
+        return WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS;
+    case ContextMenuItemTagUnicode:
+        return WEBKIT_CONTEXT_MENU_ACTION_UNICODE;
+    case ContextMenuItemTagSpellingGuess:
+        return WEBKIT_CONTEXT_MENU_ACTION_SPELLING_GUESS;
+    case ContextMenuItemTagIgnoreSpelling:
+        return WEBKIT_CONTEXT_MENU_ACTION_IGNORE_SPELLING;
+    case ContextMenuItemTagLearnSpelling:
+        return WEBKIT_CONTEXT_MENU_ACTION_LEARN_SPELLING;
+    case ContextMenuItemTagIgnoreGrammar:
+        return WEBKIT_CONTEXT_MENU_ACTION_IGNORE_GRAMMAR;
+    case ContextMenuItemTagFontMenu:
+        return WEBKIT_CONTEXT_MENU_ACTION_FONT_MENU;
+    case ContextMenuItemTagBold:
+        return WEBKIT_CONTEXT_MENU_ACTION_BOLD;
+    case ContextMenuItemTagItalic:
+        return WEBKIT_CONTEXT_MENU_ACTION_ITALIC;
+    case ContextMenuItemTagUnderline:
+        return WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE;
+    case ContextMenuItemTagOutline:
+        return WEBKIT_CONTEXT_MENU_ACTION_OUTLINE;
+    case ContextMenuItemTagInspectElement:
+        return WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT;
+    case ContextMenuItemTagOpenMediaInNewWindow:
+        return menuItem->title() == contextMenuItemTagOpenVideoInNewWindow() ?
+            WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW : WEBKIT_CONTEXT_MENU_ACTION_OPEN_AUDIO_IN_NEW_WINDOW;
+    case ContextMenuItemTagCopyMediaLinkToClipboard:
+        return menuItem->title() == contextMenuItemTagCopyVideoLinkToClipboard() ?
+            WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD : WEBKIT_CONTEXT_MENU_ACTION_COPY_AUDIO_LINK_TO_CLIPBOARD;
+    case ContextMenuItemTagToggleMediaControls:
+        return WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS;
+    case ContextMenuItemTagToggleMediaLoop:
+        return WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP;
+    case ContextMenuItemTagEnterVideoFullscreen:
+        return WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN;
+    case ContextMenuItemTagMediaPlayPause:
+        return menuItem->title() == contextMenuItemTagMediaPlay() ?
+            WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY : WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PAUSE;
+    case ContextMenuItemTagMediaMute:
+        return WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE;
+    case ContextMenuItemBaseApplicationTag:
+        return WEBKIT_CONTEXT_MENU_ACTION_CUSTOM;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return WEBKIT_CONTEXT_MENU_ACTION_CUSTOM;
+}
+
+String webkitContextMenuActionGetLabel(WebKitContextMenuAction action)
+{
+    switch (action) {
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK:
+        return contextMenuItemTagOpenLink();
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW:
+        return contextMenuItemTagOpenLinkInNewWindow();
+    case WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK:
+        return contextMenuItemTagDownloadLinkToDisk();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD:
+        return contextMenuItemTagCopyLinkToClipboard();
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW:
+        return contextMenuItemTagOpenImageInNewWindow();
+    case WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK:
+        return contextMenuItemTagDownloadImageToDisk();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD:
+        return contextMenuItemTagCopyImageToClipboard();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD:
+        return contextMenuItemTagCopyImageUrlToClipboard();
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_FRAME_IN_NEW_WINDOW:
+        return contextMenuItemTagOpenFrameInNewWindow();
+    case WEBKIT_CONTEXT_MENU_ACTION_GO_BACK:
+        return contextMenuItemTagGoBack();
+    case WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD:
+        return contextMenuItemTagGoForward();
+    case WEBKIT_CONTEXT_MENU_ACTION_STOP:
+        return contextMenuItemTagStop();
+    case WEBKIT_CONTEXT_MENU_ACTION_RELOAD:
+        return contextMenuItemTagReload();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY:
+        return contextMenuItemTagCopy();
+    case WEBKIT_CONTEXT_MENU_ACTION_CUT:
+        return contextMenuItemTagCut();
+    case WEBKIT_CONTEXT_MENU_ACTION_PASTE:
+        return contextMenuItemTagPaste();
+    case WEBKIT_CONTEXT_MENU_ACTION_DELETE:
+        return contextMenuItemTagDelete();
+    case WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL:
+        return contextMenuItemTagSelectAll();
+    case WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS:
+        return contextMenuItemTagInputMethods();
+    case WEBKIT_CONTEXT_MENU_ACTION_UNICODE:
+        return contextMenuItemTagUnicode();
+    case WEBKIT_CONTEXT_MENU_ACTION_NO_GUESSES_FOUND:
+        return contextMenuItemTagNoGuessesFound();
+    case WEBKIT_CONTEXT_MENU_ACTION_IGNORE_SPELLING:
+        return contextMenuItemTagIgnoreSpelling();
+    case WEBKIT_CONTEXT_MENU_ACTION_LEARN_SPELLING:
+        return contextMenuItemTagLearnSpelling();
+    case WEBKIT_CONTEXT_MENU_ACTION_IGNORE_GRAMMAR:
+        return contextMenuItemTagIgnoreGrammar();
+    case WEBKIT_CONTEXT_MENU_ACTION_FONT_MENU:
+        return contextMenuItemTagFontMenu();
+    case WEBKIT_CONTEXT_MENU_ACTION_BOLD:
+        return contextMenuItemTagBold();
+    case WEBKIT_CONTEXT_MENU_ACTION_ITALIC:
+        return contextMenuItemTagItalic();
+    case WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE:
+        return contextMenuItemTagUnderline();
+    case WEBKIT_CONTEXT_MENU_ACTION_OUTLINE:
+        return contextMenuItemTagOutline();
+    case WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT:
+        return contextMenuItemTagInspectElement();
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW:
+        return contextMenuItemTagOpenVideoInNewWindow();
+    case WEBKIT_CONTEXT_MENU_ACTION_OPEN_AUDIO_IN_NEW_WINDOW:
+        return contextMenuItemTagOpenAudioInNewWindow();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD:
+        return contextMenuItemTagCopyVideoLinkToClipboard();
+    case WEBKIT_CONTEXT_MENU_ACTION_COPY_AUDIO_LINK_TO_CLIPBOARD:
+        return contextMenuItemTagCopyAudioLinkToClipboard();
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS:
+        return contextMenuItemTagToggleMediaControls();
+    case WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP:
+        return contextMenuItemTagToggleMediaLoop();
+    case WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN:
+        return contextMenuItemTagEnterVideoFullscreen();
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY:
+        return contextMenuItemTagMediaPlay();
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PAUSE:
+        return contextMenuItemTagMediaPause();
+    case WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE:
+        return contextMenuItemTagMediaMute();
+    case WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION:
+    case WEBKIT_CONTEXT_MENU_ACTION_CUSTOM:
+    case WEBKIT_CONTEXT_MENU_ACTION_SPELLING_GUESS:
+        return String();
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return String();
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.h
new file mode 100644
index 000000000..185bd251f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActions.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#include <glib.h>
+
+#ifndef WebKitContextMenuActions_h
+#define WebKitContextMenuActions_h
+
+G_BEGIN_DECLS
+
+/**
+ * WebKitContextMenuAction:
+ * @WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION: No action, used by separator menu items.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK: Open current link.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW: Open current link in a new window.
+ * @WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK: Download link destination.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD: Copy link location to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW: Open current image in a new window.
+ * @WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK: Download current image.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD: Copy current image to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD: Copy curent image location to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_FRAME_IN_NEW_WINDOW: Open current frame in a new window.
+ * @WEBKIT_CONTEXT_MENU_ACTION_GO_BACK: Load the previous history item.
+ * @WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD: Load the next history item.
+ * @WEBKIT_CONTEXT_MENU_ACTION_STOP: Stop any ongoing loading operation.
+ * @WEBKIT_CONTEXT_MENU_ACTION_RELOAD: Reload the conents of current view.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY: Copy current selection the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_CUT: Cut current selection to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_PASTE: Paste clipboard contents.
+ * @WEBKIT_CONTEXT_MENU_ACTION_DELETE: Delete current selection.
+ * @WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL: Select all text.
+ * @WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS: Input methods menu.
+ * @WEBKIT_CONTEXT_MENU_ACTION_UNICODE: Unicode menu.
+ * @WEBKIT_CONTEXT_MENU_ACTION_SPELLING_GUESS: A proposed replacement for a misspelled word.
+ * @WEBKIT_CONTEXT_MENU_ACTION_NO_GUESSES_FOUND: An indicator that spellchecking found no proposed replacements.
+ * @WEBKIT_CONTEXT_MENU_ACTION_IGNORE_SPELLING: Causes the spellchecker to ignore the word for this session.
+ * @WEBKIT_CONTEXT_MENU_ACTION_LEARN_SPELLING: Causes the spellchecker to add the word to the dictionary.
+ * @WEBKIT_CONTEXT_MENU_ACTION_IGNORE_GRAMMAR: Ignore grammar.
+ * @WEBKIT_CONTEXT_MENU_ACTION_FONT_MENU: Font options menu.
+ * @WEBKIT_CONTEXT_MENU_ACTION_BOLD: Bold.
+ * @WEBKIT_CONTEXT_MENU_ACTION_ITALIC: Italic.
+ * @WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE: Underline.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OUTLINE: Outline.
+ * @WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT: Open current element in the inspector.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW: Open current video element in a new window.
+ * @WEBKIT_CONTEXT_MENU_ACTION_OPEN_AUDIO_IN_NEW_WINDOW: Open current audio element in a new window.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD: Copy video link location in to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_COPY_AUDIO_LINK_TO_CLIPBOARD: Copy audio link location in to the clipboard.
+ * @WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS: Enable or disable media controls.
+ * @WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP: Enable or disable media loop.
+ * @WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN: Show current video element in fullscreen mode.
+ * @WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY: Play current media element.
+ * @WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PAUSE: Pause current media element.
+ * @WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE: Mute current media element.
+ * @WEBKIT_CONTEXT_MENU_ACTION_CUSTOM: Custom action defined by applications.
+ *
+ * Enum values used to denote the stock actions for
+ * #WebKitContextMenuItem<!-- -->s
+ */
+typedef enum {
+    WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION = 0,
+
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK,
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW,
+    WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD,
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW,
+    WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD,
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_FRAME_IN_NEW_WINDOW,
+    WEBKIT_CONTEXT_MENU_ACTION_GO_BACK,
+    WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD,
+    WEBKIT_CONTEXT_MENU_ACTION_STOP,
+    WEBKIT_CONTEXT_MENU_ACTION_RELOAD,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY,
+    WEBKIT_CONTEXT_MENU_ACTION_CUT,
+    WEBKIT_CONTEXT_MENU_ACTION_PASTE,
+    WEBKIT_CONTEXT_MENU_ACTION_DELETE,
+    WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL,
+    WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS,
+    WEBKIT_CONTEXT_MENU_ACTION_UNICODE,
+    WEBKIT_CONTEXT_MENU_ACTION_SPELLING_GUESS,
+    WEBKIT_CONTEXT_MENU_ACTION_NO_GUESSES_FOUND,
+    WEBKIT_CONTEXT_MENU_ACTION_IGNORE_SPELLING,
+    WEBKIT_CONTEXT_MENU_ACTION_LEARN_SPELLING,
+    WEBKIT_CONTEXT_MENU_ACTION_IGNORE_GRAMMAR,
+    WEBKIT_CONTEXT_MENU_ACTION_FONT_MENU,
+    WEBKIT_CONTEXT_MENU_ACTION_BOLD,
+    WEBKIT_CONTEXT_MENU_ACTION_ITALIC,
+    WEBKIT_CONTEXT_MENU_ACTION_UNDERLINE,
+    WEBKIT_CONTEXT_MENU_ACTION_OUTLINE,
+    WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT,
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW,
+    WEBKIT_CONTEXT_MENU_ACTION_OPEN_AUDIO_IN_NEW_WINDOW,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD,
+    WEBKIT_CONTEXT_MENU_ACTION_COPY_AUDIO_LINK_TO_CLIPBOARD,
+    WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS,
+    WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP,
+    WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN,
+    WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY,
+    WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PAUSE,
+    WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE,
+
+    WEBKIT_CONTEXT_MENU_ACTION_CUSTOM = 10000
+} WebKitContextMenuAction;
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActionsPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActionsPrivate.h
new file mode 100644
index 000000000..f753bb97c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuActionsPrivate.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitContextMenuActionsPrivate_h
+#define WebKitContextMenuActionsPrivate_h
+
+#include "WebKitContextMenuActions.h"
+#include <WebCore/ContextMenuItem.h>
+
+bool webkitContextMenuActionIsCheckable(WebKitContextMenuAction);
+WebCore::ContextMenuAction webkitContextMenuActionGetActionTag(WebKitContextMenuAction);
+WebKitContextMenuAction webkitContextMenuActionGetForContextMenuItem(WebCore::ContextMenuItem*);
+String webkitContextMenuActionGetLabel(WebKitContextMenuAction);
+
+#endif // WebKitPrintOperationPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.cpp
new file mode 100644
index 000000000..b2b22fe41
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.cpp
@@ -0,0 +1,345 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebKitContextMenuItem.h"
+
+#include "MutableArray.h"
+#include "WebContextMenuItem.h"
+#include "WebContextMenuItemData.h"
+#include "WebKitContextMenuActionsPrivate.h"
+#include "WebKitContextMenuItemPrivate.h"
+#include "WebKitContextMenuPrivate.h"
+#include <WebCore/ContextMenu.h>
+#include <WebCore/ContextMenuItem.h>
+#include <gtk/gtk.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
+
+using namespace WebKit;
+using namespace WebCore;
+
+struct _WebKitContextMenuItemPrivate {
+    OwnPtr<ContextMenuItem> menuItem;
+    GRefPtr<WebKitContextMenu> subMenu;
+};
+
+G_DEFINE_TYPE(WebKitContextMenuItem, webkit_context_menu_item, G_TYPE_INITIALLY_UNOWNED)
+
+static void webkitContextMenuItemFinalize(GObject* object)
+{
+    WebKitContextMenuItemPrivate* priv = WEBKIT_CONTEXT_MENU_ITEM(object)->priv;
+    if (priv->subMenu)
+        webkitContextMenuSetParentItem(priv->subMenu.get(), 0);
+    priv->~WebKitContextMenuItemPrivate();
+    G_OBJECT_CLASS(webkit_context_menu_item_parent_class)->finalize(object);
+}
+
+static void webkit_context_menu_item_init(WebKitContextMenuItem* item)
+{
+    WebKitContextMenuItemPrivate* priv = G_TYPE_INSTANCE_GET_PRIVATE(item, WEBKIT_TYPE_CONTEXT_MENU_ITEM, WebKitContextMenuItemPrivate);
+    item->priv = priv;
+    new (priv) WebKitContextMenuItemPrivate();
+}
+
+static void webkit_context_menu_item_class_init(WebKitContextMenuItemClass* itemClass)
+{
+    GObjectClass* gObjectClass = G_OBJECT_CLASS(itemClass);
+    gObjectClass->finalize = webkitContextMenuItemFinalize;
+    g_type_class_add_private(itemClass, sizeof(WebKitContextMenuItemPrivate));
+}
+
+static bool checkAndWarnIfMenuHasParentItem(WebKitContextMenu* menu)
+{
+    if (menu && webkitContextMenuGetParentItem(menu)) {
+        g_warning("Attempting to set a WebKitContextMenu as submenu of "
+                  "a WebKitContextMenuItem, but the menu is already "
+                  "a submenu of a WebKitContextMenuItem");
+        return true;
+    }
+
+    return false;
+}
+
+static void webkitContextMenuItemSetSubMenu(WebKitContextMenuItem* item, GRefPtr<WebKitContextMenu> subMenu)
+{
+    if (checkAndWarnIfMenuHasParentItem(subMenu.get()))
+        return;
+
+    if (item->priv->subMenu)
+        webkitContextMenuSetParentItem(item->priv->subMenu.get(), 0);
+    item->priv->subMenu = subMenu;
+    if (subMenu)
+        webkitContextMenuSetParentItem(subMenu.get(), item);
+}
+
+WebKitContextMenuItem* webkitContextMenuItemCreate(WKContextMenuItemRef wkItem)
+{
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    WebContextMenuItemData* itemData = toImpl(wkItem)->data();
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(itemData->type(), itemData->action(), itemData->title(), itemData->enabled(), itemData->checked()));
+    const Vector<WebContextMenuItemData>& subMenu = itemData->submenu();
+    if (!subMenu.size())
+        return item;
+
+    RefPtr<MutableArray> subMenuItems = MutableArray::create();
+    subMenuItems->reserveCapacity(subMenu.size());
+    for (size_t i = 0; i < subMenu.size(); ++i)
+        subMenuItems->append(WebContextMenuItem::create(subMenu[i]).get());
+    webkitContextMenuItemSetSubMenu(item, adoptGRef(webkitContextMenuCreate(toAPI(subMenuItems.get()))));
+
+    return item;
+}
+
+static WebKitContextMenuItem* webkitContextMenuItemCreateForGtkItem(GtkMenuItem* menuItem)
+{
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(menuItem));
+    webkitContextMenuItemSetSubMenuFromGtkMenu(item, GTK_MENU(gtk_menu_item_get_submenu(menuItem)));
+
+    return item;
+}
+
+void webkitContextMenuItemSetSubMenuFromGtkMenu(WebKitContextMenuItem* item, GtkMenu* subMenu)
+{
+    if (!subMenu)
+        return;
+
+    GOwnPtr<GList> children(gtk_container_get_children(GTK_CONTAINER(subMenu)));
+    if (!g_list_length(children.get()))
+        return;
+
+    webkitContextMenuItemSetSubMenu(item, adoptGRef(webkit_context_menu_new()));
+    for (GList* listItem = children.get(); listItem; listItem = g_list_next(listItem)) {
+        GRefPtr<GtkWidget> widget = GTK_WIDGET(listItem->data);
+        if (!GTK_IS_MENU_ITEM(widget.get()))
+            continue;
+
+        gtk_container_remove(GTK_CONTAINER(subMenu), widget.get());
+        GtkMenuItem* menuItem = GTK_MENU_ITEM(widget.leakRef());
+        g_object_force_floating(G_OBJECT(menuItem));
+        webkit_context_menu_append(item->priv->subMenu.get(), webkitContextMenuItemCreateForGtkItem(menuItem));
+    }
+}
+
+GtkMenuItem* webkitContextMenuItemRelease(WebKitContextMenuItem* item)
+{
+    if (item->priv->subMenu) {
+        Vector<ContextMenuItem> subMenuItems;
+        webkitContextMenuPopulate(item->priv->subMenu.get(), subMenuItems);
+        ContextMenu subMenu(platformMenuDescription(subMenuItems));
+        item->priv->menuItem->setSubMenu(&subMenu);
+    }
+
+    return item->priv->menuItem->releasePlatformDescription();
+}
+
+/**
+ * webkit_context_menu_item_new:
+ * @action: a #GtkAction
+ *
+ * Creates a new #WebKitContextMenuItem for the given @action.
+ *
+ * Returns: the newly created #WebKitContextMenuItem object.
+ */
+WebKitContextMenuItem* webkit_context_menu_item_new(GtkAction* action)
+{
+    g_return_val_if_fail(GTK_IS_ACTION(action), 0);
+
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(GTK_MENU_ITEM(gtk_action_create_menu_item(action))));
+    item->priv->menuItem->setAction(ContextMenuItemBaseApplicationTag);
+
+    return item;
+}
+
+/**
+ * webkit_context_menu_item_new_from_stock_action:
+ * @action: a #WebKitContextMenuAction stock action
+ *
+ * Creates a new #WebKitContextMenuItem for the given stock action.
+ * Stock actions are handled automatically by WebKit so that, for example,
+ * when a menu item created with a %WEBKIT_CONTEXT_MENU_ACTION_STOP is
+ * activated the action associated will be handled by WebKit and the current
+ * load operation will be stopped. You can get the #GtkAction of a
+ * #WebKitContextMenuItem created with a #WebKitContextMenuAction with
+ * webkit_context_menu_item_get_action() and connect to #GtkAction::activate signal
+ * to be notified when the item is activated. But you can't prevent the asociated
+ * action from being performed.
+ *
+ * Returns: the newly created #WebKitContextMenuItem object.
+ */
+WebKitContextMenuItem* webkit_context_menu_item_new_from_stock_action(WebKitContextMenuAction action)
+{
+    g_return_val_if_fail(action > WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION && action < WEBKIT_CONTEXT_MENU_ACTION_CUSTOM, 0);
+
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    ContextMenuItemType type = webkitContextMenuActionIsCheckable(action) ? CheckableActionType : ActionType;
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(type, webkitContextMenuActionGetActionTag(action), webkitContextMenuActionGetLabel(action)));
+
+    return item;
+}
+
+/**
+ * webkit_context_menu_item_new_from_stock_action_with_label:
+ * @action: a #WebKitContextMenuAction stock action
+ * @label: a custom label text to use instead of the predefined one
+ *
+ * Creates a new #WebKitContextMenuItem for the given stock action using the given @label.
+ * Stock actions have a predefined label, this method can be used to create a
+ * #WebKitContextMenuItem for a #WebKitContextMenuAction but using a custom label.
+ *
+ * Returns: the newly created #WebKitContextMenuItem object.
+ */
+WebKitContextMenuItem* webkit_context_menu_item_new_from_stock_action_with_label(WebKitContextMenuAction action, const gchar* label)
+{
+    g_return_val_if_fail(action > WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION && action < WEBKIT_CONTEXT_MENU_ACTION_CUSTOM, 0);
+
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    ContextMenuItemType type = webkitContextMenuActionIsCheckable(action) ? CheckableActionType : ActionType;
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(type, webkitContextMenuActionGetActionTag(action), String::fromUTF8(label)));
+
+    return item;
+}
+
+/**
+ * webkit_context_menu_item_new_with_submenu:
+ * @label: the menu item label text
+ * @submenu: a #WebKitContextMenu to set
+ *
+ * Creates a new #WebKitContextMenuItem using the given @label with a submenu.
+ *
+ * Returns: the newly created #WebKitContextMenuItem object.
+ */
+WebKitContextMenuItem* webkit_context_menu_item_new_with_submenu(const gchar* label, WebKitContextMenu* submenu)
+{
+    g_return_val_if_fail(label, 0);
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU(submenu), 0);
+
+    if (checkAndWarnIfMenuHasParentItem(submenu))
+        return 0;
+
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(SubmenuType, ContextMenuItemBaseApplicationTag, String::fromUTF8(label)));
+    item->priv->subMenu = submenu;
+    webkitContextMenuSetParentItem(submenu, item);
+
+    return item;
+}
+
+/**
+ * webkit_context_menu_item_new_separator:
+ *
+ * Creates a new #WebKitContextMenuItem representing a separator.
+ *
+ * Returns: the newly created #WebKitContextMenuItem object.
+ */
+WebKitContextMenuItem* webkit_context_menu_item_new_separator(void)
+{
+    WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(g_object_new(WEBKIT_TYPE_CONTEXT_MENU_ITEM, NULL));
+    item->priv->menuItem = WTF::adoptPtr(new ContextMenuItem(SeparatorType, ContextMenuItemTagNoAction, String()));
+
+    return item;
+}
+
+/**
+ * webkit_context_menu_item_get_action:
+ * @item: a #WebKitContextMenuItem
+ *
+ * Gets the action associated to @item.
+ *
+ * Returns: (transfer none): the #GtkAction associated to the #WebKitContextMenuItem,
+ *    or %NULL if @item is a separator.
+ */
+GtkAction* webkit_context_menu_item_get_action(WebKitContextMenuItem* item)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item), 0);
+
+    return item->priv->menuItem->gtkAction();
+}
+
+/**
+ * webkit_context_menu_item_get_stock_action:
+ * @item: a #WebKitContextMenuItem
+ *
+ * Gets the #WebKitContextMenuAction of @item. If the #WebKitContextMenuItem was not
+ * created for a stock action %WEBKIT_CONTEXT_MENU_ACTION_CUSTOM will be
+ * returned. If the #WebKitContextMenuItem is a separator %WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION
+ * will be returned.
+ *
+ * Returns: the #WebKitContextMenuAction of @item
+ */
+WebKitContextMenuAction webkit_context_menu_item_get_stock_action(WebKitContextMenuItem* item)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item), WEBKIT_CONTEXT_MENU_ACTION_NO_ACTION);
+
+    return webkitContextMenuActionGetForContextMenuItem(item->priv->menuItem.get());
+}
+
+/**
+ * webkit_context_menu_item_is_separator:
+ * @item: a #WebKitContextMenuItem
+ *
+ * Checks whether @item is a separator.
+ *
+ * Returns: %TRUE is @item is a separator or %FALSE otherwise
+ */
+gboolean webkit_context_menu_item_is_separator(WebKitContextMenuItem* item)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item), FALSE);
+
+    return item->priv->menuItem->type() == SeparatorType;
+}
+
+/**
+ * webkit_context_menu_item_set_submenu:
+ * @item: a #WebKitContextMenuItem
+ * @submenu: (allow-none): a #WebKitContextMenu
+ *
+ * Sets or replaces the @item submenu. If @submenu is %NULL the current
+ * submenu of @item is removed.
+ */
+void webkit_context_menu_item_set_submenu(WebKitContextMenuItem* item, WebKitContextMenu* submenu)
+{
+    g_return_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item));
+
+    if (item->priv->subMenu == submenu)
+        return;
+
+    webkitContextMenuItemSetSubMenu(item, submenu);
+}
+
+/**
+ * webkit_context_menu_item_get_submenu:
+ * @item: a #WebKitContextMenuItem
+ *
+ * Gets the submenu of @item.
+ *
+ * Returns: (transfer none): the #WebKitContextMenu representing the submenu of
+ *    @item or %NULL if @item doesn't have a submenu.
+ */
+WebKitContextMenu* webkit_context_menu_item_get_submenu(WebKitContextMenuItem* item)
+{
+    g_return_val_if_fail(WEBKIT_IS_CONTEXT_MENU_ITEM(item), 0);
+
+    return item->priv->subMenu.get();
+}
+
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.h
new file mode 100644
index 000000000..52d912843
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItem.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#if !defined(__WEBKIT2_H_INSIDE__) && !defined(WEBKIT2_COMPILATION)
+#error "Only <webkit2/webkit2.h> can be included directly."
+#endif
+
+#ifndef WebKitContextMenuItem_h
+#define WebKitContextMenuItem_h
+
+#include <gtk/gtk.h>
+#include <webkit2/WebKitDefines.h>
+#include <webkit2/WebKitContextMenu.h>
+#include <webkit2/WebKitContextMenuActions.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_CONTEXT_MENU_ITEM            (webkit_context_menu_item_get_type())
+#define WEBKIT_CONTEXT_MENU_ITEM(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_TYPE_CONTEXT_MENU_ITEM, WebKitContextMenuItem))
+#define WEBKIT_IS_CONTEXT_MENU_ITEM(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_TYPE_CONTEXT_MENU_ITEM))
+#define WEBKIT_CONTEXT_MENU_ITEM_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_TYPE_CONTEXT_MENU_ITEM, WebKitContextMenuItemClass))
+#define WEBKIT_IS_CONTEXT_MENU_ITEM_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_TYPE_CONTEXT_MENU_ITEM))
+#define WEBKIT_CONTEXT_MENU_ITEM_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_TYPE_CONTEXT_MENU_ITEM, WebKitContextMenuItemClass))
+
+typedef struct _WebKitContextMenuItemClass   WebKitContextMenuItemClass;
+typedef struct _WebKitContextMenuItemPrivate WebKitContextMenuItemPrivate;
+
+struct _WebKitContextMenuItem {
+    GInitiallyUnowned parent;
+
+    WebKitContextMenuItemPrivate *priv;
+};
+
+struct _WebKitContextMenuItemClass {
+    GInitiallyUnownedClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_context_menu_item_get_type                         (void);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_item_new                              (GtkAction              *action);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_item_new_from_stock_action            (WebKitContextMenuAction action);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_item_new_from_stock_action_with_label (WebKitContextMenuAction action,
+                                                           const gchar            *label);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_item_new_with_submenu                 (const gchar            *label,
+                                                           WebKitContextMenu      *submenu);
+
+WEBKIT_API WebKitContextMenuItem *
+webkit_context_menu_item_new_separator                    (void);
+
+WEBKIT_API GtkAction *
+webkit_context_menu_item_get_action                       (WebKitContextMenuItem  *item);
+
+WEBKIT_API WebKitContextMenuAction
+webkit_context_menu_item_get_stock_action                 (WebKitContextMenuItem  *item);
+
+WEBKIT_API gboolean
+webkit_context_menu_item_is_separator                     (WebKitContextMenuItem  *item);
+
+WEBKIT_API void
+webkit_context_menu_item_set_submenu                      (WebKitContextMenuItem  *item,
+                                                           WebKitContextMenu      *submenu);
+
+WEBKIT_API WebKitContextMenu *
+webkit_context_menu_item_get_submenu                      (WebKitContextMenuItem  *item);
+
+G_END_DECLS
+
+#endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItemPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItemPrivate.h
new file mode 100644
index 000000000..9c88003bf
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuItemPrivate.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitContextMenuItemPrivate_h
+#define WebKitContextMenuItemPrivate_h
+
+#include "WebKitContextMenuItem.h"
+#include "WebKitPrivate.h"
+
+WebKitContextMenuItem* webkitContextMenuItemCreate(WKContextMenuItemRef);
+GtkMenuItem* webkitContextMenuItemRelease(WebKitContextMenuItem*);
+void webkitContextMenuItemSetSubMenuFromGtkMenu(WebKitContextMenuItem*, GtkMenu*);
+
+#endif // WebKitContextMenuItemPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuPrivate.h
new file mode 100644
index 000000000..6d3f18015
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitContextMenuPrivate.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitContextMenuPrivate_h
+#define WebKitContextMenuPrivate_h
+
+#include "WebKitContextMenu.h"
+#include "WebKitPrivate.h"
+
+WebKitContextMenu* webkitContextMenuCreate(WKArrayRef wkItems);
+void webkitContextMenuPopulate(WebKitContextMenu*, Vector<WebCore::ContextMenuItem>&);
+void webkitContextMenuSetParentItem(WebKitContextMenu*, WebKitContextMenuItem*);
+WebKitContextMenuItem* webkitContextMenuGetParentItem(WebKitContextMenu*);
+
+#endif // WebKitContextMenuPrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
index 96bcb4ea2..733bf884c 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitDefines.h
@@ -32,9 +32,11 @@
 
 #include <glib.h>
 
-typedef struct _WebKitPrintOperation WebKitPrintOperation;
-typedef struct _WebKitFindController WebKitFindController;
-typedef struct _WebKitWebView        WebKitWebView;
+typedef struct _WebKitPrintOperation  WebKitPrintOperation;
+typedef struct _WebKitFindController  WebKitFindController;
+typedef struct _WebKitWebView         WebKitWebView;
+typedef struct _WebKitContextMenu     WebKitContextMenu;
+typedef struct _WebKitContextMenuItem WebKitContextMenuItem;
 
 #ifdef G_OS_WIN32
 #    ifdef BUILDING_WEBKIT
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
index 02e82b020..9e24aabb1 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
@@ -33,6 +33,7 @@
 
 #include "WebKitPrivate.h"
 #include "WebKitSettingsPrivate.h"
+#include "WebPageProxy.h"
 #include <glib/gi18n-lib.h>
 #include <wtf/text/CString.h>
 
@@ -46,6 +47,7 @@ struct _WebKitSettingsPrivate {
     CString fantasyFontFamily;
     CString pictographFontFamily;
     CString defaultCharset;
+    bool allowModalDialogs;
     bool zoomTextOnly;
 };
 
@@ -105,6 +107,7 @@ enum {
     PROP_PRINT_BACKGROUNDS,
     PROP_ENABLE_WEBAUDIO,
     PROP_ENABLE_WEBGL,
+    PROP_ALLOW_MODAL_DIALOGS,
     PROP_ZOOM_TEXT_ONLY,
     PROP_JAVASCRIPT_CAN_ACCESS_CLIPBOARD,
     PROP_MEDIA_PLAYBACK_REQUIRES_USER_GESTURE,
@@ -216,6 +219,9 @@ static void webKitSettingsSetProperty(GObject* object, guint propId, const GValu
     case PROP_ENABLE_WEBGL:
         webkit_settings_set_enable_webgl(settings, g_value_get_boolean(value));
         break;
+    case PROP_ALLOW_MODAL_DIALOGS:
+        webkit_settings_set_allow_modal_dialogs(settings, g_value_get_boolean(value));
+        break;
     case PROP_ZOOM_TEXT_ONLY:
         webkit_settings_set_zoom_text_only(settings, g_value_get_boolean(value));
         break;
@@ -341,6 +347,9 @@ static void webKitSettingsGetProperty(GObject* object, guint propId, GValue* val
     case PROP_ENABLE_WEBGL:
         g_value_set_boolean(value, webkit_settings_get_enable_webgl(settings));
         break;
+    case PROP_ALLOW_MODAL_DIALOGS:
+        g_value_set_boolean(value, webkit_settings_get_allow_modal_dialogs(settings));
+        break;
     case PROP_ZOOM_TEXT_ONLY:
         g_value_set_boolean(value, webkit_settings_get_zoom_text_only(settings));
         break;
@@ -853,6 +862,24 @@ static void webkit_settings_class_init(WebKitSettingsClass* klass)
                                                          readWriteConstructParamFlags));
 
     /**
+     * WebKitSettings:allow-modal-dialogs:
+     *
+     * Determine whether it's allowed to create and run modal dialogs
+     * from a #WebKitWebView through JavaScript with
+     * <function>window.showModalDialog</function>. If it's set to
+     * %FALSE, the associated #WebKitWebView won't be able to create
+     * new modal dialogs, so not even the #WebKitWebView::create
+     * signal will be emitted.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_ALLOW_MODAL_DIALOGS,
+                                    g_param_spec_boolean("allow-modal-dialogs",
+                                                         _("Allow modal dialogs"),
+                                                         _("Whether it is possible to create modal dialogs"),
+                                                         FALSE,
+                                                         readWriteConstructParamFlags));
+
+    /**
      * WebKitSettings:zoom-text-only:
      *
      * Whether #WebKitWebView:zoom-level affects only the
@@ -969,6 +996,7 @@ static void webkit_settings_init(WebKitSettings* settings)
 void webkitSettingsAttachSettingsToPage(WebKitSettings* settings, WKPageRef wkPage)
 {
     WKPageGroupSetPreferences(WKPageGetPageGroup(wkPage), settings->priv->preferences.get());
+    WebKit::toImpl(wkPage)->setCanRunModal(settings->priv->allowModalDialogs);
 }
 
 /**
@@ -2189,6 +2217,39 @@ void webkit_settings_set_enable_webgl(WebKitSettings* settings, gboolean enabled
 }
 
 /**
+ * webkit_settings_set_allow_modal_dialogs:
+ * @settings: a #WebKitSettings
+ * @allowed: Value to be set
+ *
+ * Set the #WebKitSettings:allow-modal-dialogs property.
+ */
+void webkit_settings_set_allow_modal_dialogs(WebKitSettings* settings, gboolean allowed)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    if (priv->allowModalDialogs == allowed)
+        return;
+
+    priv->allowModalDialogs = allowed;
+    g_object_notify(G_OBJECT(settings), "allow-modal-dialogs");
+}
+
+/**
+ * webkit_settings_get_allow_modal_dialogs:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:allow-modal-dialogs property.
+ *
+ * Returns: %TRUE if it's allowed to create and run modal dialogs or %FALSE otherwise.
+ */
+gboolean webkit_settings_get_allow_modal_dialogs(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+    return settings->priv->allowModalDialogs;
+}
+
+/**
  * webkit_settings_set_zoom_text_only:
  * @settings: a #WebKitSettings
  * @zoom_text_only: Value to be set
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
index 53ebda299..a86d6bc1e 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
@@ -308,6 +308,13 @@ webkit_settings_set_enable_webgl                               (WebKitSettings *
                                                                 gboolean        enabled);
 
 WEBKIT_API void
+webkit_settings_set_allow_modal_dialogs                        (WebKitSettings *settings,
+                                                                gboolean        allowed);
+
+WEBKIT_API gboolean
+webkit_settings_get_allow_modal_dialogs                        (WebKitSettings *settings);
+
+WEBKIT_API void
 webkit_settings_set_zoom_text_only                             (WebKitSettings *settings,
                                                                 gboolean        zoom_text_only);
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
index 7d4eedfb6..1d985d342 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitUIClient.cpp
@@ -151,6 +151,11 @@ static void decidePolicyForGeolocationPermissionRequest(WKPageRef, WKFrameRef, W
     webkitWebViewMakePermissionRequest(WEBKIT_WEB_VIEW(clientInfo), WEBKIT_PERMISSION_REQUEST(geolocationPermissionRequest.get()));
 }
 
+static void runModal(WKPageRef page, const void* clientInfo)
+{
+    webkitWebViewRunAsModal(WEBKIT_WEB_VIEW(clientInfo));
+}
+
 void attachUIClientToView(WebKitWebView* webView)
 {
     WKPageUIClient wkUIClient = {
@@ -191,7 +196,7 @@ void attachUIClientToView(WebKitWebView* webView)
         0, // drawHeader
         0, // drawFooter
         printFrame,
-        0, // runModal
+        runModal,
         0, // didCompleteRubberBandForMainFrame
         0, // saveDataToFileInDownloadsFolder
         0, // shouldInterruptJavaScript
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index 7f5764e7d..94a94ca09 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -25,6 +25,8 @@
 #include "WebContextMenuItemData.h"
 #include "WebKitBackForwardListPrivate.h"
 #include "WebKitContextMenuClient.h"
+#include "WebKitContextMenuItemPrivate.h"
+#include "WebKitContextMenuPrivate.h"
 #include "WebKitEnumTypes.h"
 #include "WebKitError.h"
 #include "WebKitFullscreenClient.h"
@@ -50,6 +52,7 @@
 #include "WebPageProxy.h"
 #include <JavaScriptCore/APICast.h>
 #include <WebCore/DragIcon.h>
+#include <WebCore/GOwnPtrGtk.h>
 #include <WebCore/GtkUtilities.h>
 #include <glib/gi18n-lib.h>
 #include <wtf/gobject/GOwnPtr.h>
@@ -65,6 +68,7 @@ enum {
 
     CREATE,
     READY_TO_SHOW,
+    RUN_AS_MODAL,
     CLOSE,
 
     SCRIPT_DIALOG,
@@ -83,6 +87,8 @@ enum {
 
     RUN_FILE_CHOOSER,
 
+    CONTEXT_MENU,
+
     LAST_SIGNAL
 };
 
@@ -118,6 +124,8 @@ struct _WebKitWebViewPrivate {
     GRefPtr<WebKitSettings> settings;
     GRefPtr<WebKitWindowProperties> windowProperties;
 
+    GRefPtr<GMainLoop> modalLoop;
+
     GRefPtr<WebKitHitTestResult> mouseTargetHitTestResult;
     unsigned mouseTargetModifiers;
 
@@ -223,6 +231,14 @@ static gboolean webkitWebViewPermissionRequest(WebKitWebView*, WebKitPermissionR
     return TRUE;
 }
 
+static void allowModalDialogsChanged(WebKitSettings* settings, GParamSpec*, WebKitWebView* webView)
+{
+    WebPageProxy* page = webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView));
+    if (!page)
+        return;
+    page->setCanRunModal(webkit_settings_get_allow_modal_dialogs(settings));
+}
+
 static void zoomTextOnlyChanged(WebKitSettings* settings, GParamSpec*, WebKitWebView* webView)
 {
     WKPageRef wkPage = toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView)));
@@ -236,9 +252,18 @@ static void webkitWebViewSetSettings(WebKitWebView* webView, WebKitSettings* set
 {
     webView->priv->settings = settings;
     webkitSettingsAttachSettingsToPage(webView->priv->settings.get(), wkPage);
+    g_signal_connect(settings, "notify::allow-modal-dialogs", G_CALLBACK(allowModalDialogsChanged), webView);
     g_signal_connect(settings, "notify::zoom-text-only", G_CALLBACK(zoomTextOnlyChanged), webView);
 }
 
+static void webkitWebViewDisconnectSettingsSignalHandlers(WebKitWebView* webView)
+{
+    WebKitSettings* settings = webView->priv->settings.get();
+    g_signal_handlers_disconnect_by_func(settings, reinterpret_cast<gpointer>(allowModalDialogsChanged), webView);
+    g_signal_handlers_disconnect_by_func(settings, reinterpret_cast<gpointer>(zoomTextOnlyChanged), webView);
+
+}
+
 static void fileChooserDialogResponseCallback(GtkDialog* dialog, gint responseID, WebKitFileChooserRequest* request)
 {
     GRefPtr<WebKitFileChooserRequest> adoptedRequest = adoptGRef(request);
@@ -353,8 +378,16 @@ static void webkitWebViewGetProperty(GObject* object, guint propId, GValue* valu
 static void webkitWebViewFinalize(GObject* object)
 {
     WebKitWebViewPrivate* priv = WEBKIT_WEB_VIEW(object)->priv;
+
     if (priv->javascriptGlobalContext)
         JSGlobalContextRelease(priv->javascriptGlobalContext);
+
+    // For modal dialogs, make sure the main loop is stopped when finalizing the webView.
+    if (priv->modalLoop && g_main_loop_is_running(priv->modalLoop.get()))
+        g_main_loop_quit(priv->modalLoop.get());
+
+    webkitWebViewDisconnectSettingsSignalHandlers(WEBKIT_WEB_VIEW(object));
+
     priv->~WebKitWebViewPrivate();
     G_OBJECT_CLASS(webkit_web_view_parent_class)->finalize(object);
 }
@@ -604,6 +637,27 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      g_cclosure_marshal_VOID__VOID,
                      G_TYPE_NONE, 0);
 
+     /**
+     * WebKitWebView::run-as-modal:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     *
+     * Emitted after #WebKitWebView::ready-to-show on the newly
+     * created #WebKitWebView when JavaScript code calls
+     * <function>window.showModalDialog</function>. The purpose of
+     * this signal is to allow the client application to prepare the
+     * new view to behave as modal. Once the signal is emitted a new
+     * mainloop will be run to block user interaction in the parent
+     * #WebKitWebView until the new dialog is closed.
+     */
+    signals[RUN_AS_MODAL] =
+            g_signal_new("run-as-modal",
+                         G_TYPE_FROM_CLASS(webViewClass),
+                         G_SIGNAL_RUN_LAST,
+                         G_STRUCT_OFFSET(WebKitWebViewClass, run_as_modal),
+                         0, 0,
+                         g_cclosure_marshal_VOID__VOID,
+                         G_TYPE_NONE, 0);
+
     /**
      * WebKitWebView::close:
      * @webView: the #WebKitWebView on which the signal is emitted
@@ -933,6 +987,62 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      webkit_marshal_BOOLEAN__OBJECT,
                      G_TYPE_BOOLEAN, 1, /* number of parameters */
                      WEBKIT_TYPE_FILE_CHOOSER_REQUEST);
+
+    /**
+     * WebKitWebView::context-menu:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     * @context_menu: the proposed #WebKitContextMenu
+     * @event: the #GdkEvent that triggered the context menu
+     * @hit_test_result: a #WebKitHitTestResult
+     *
+     * Emmited when a context menu is about to be displayed to give the application
+     * a chance to customize the proposed menu, prevent the menu from being displayed
+     * or build its own context menu.
+     * <itemizedlist>
+     * <listitem><para>
+     *  To customize the proposed menu you can use webkit_context_menu_prepend(),
+     *  webkit_context_menu_append() or webkit_context_menu_insert() to add new
+     *  #WebKitContextMenuItem<!-- -->s to @context_menu, webkit_context_menu_move_item()
+     *  to reorder existing items, or webkit_context_menu_remove() to remove an
+     *  existing item. The signal handler should return %FALSE, and the menu represented
+     *  by @context_menu will be shown.
+     * </para></listitem>
+     * <listitem><para>
+     *  To prevent the menu from being displayed you can just connect to this signal
+     *  and return %TRUE so that the proposed menu will not be shown.
+     * </para></listitem>
+     * <listitem><para>
+     *  To build your own menu, you can remove all items from the proposed menu with
+     *  webkit_context_menu_remove_all(), add your own items and return %FALSE so
+     *  that the menu will be shown. You can also ignore the proposed #WebKitContextMenu,
+     *  build your own #GtkMenu and return %TRUE to prevent the proposed menu from being shown.
+     * </para></listitem>
+     * <listitem><para>
+     *  If you just want the default menu to be shown always, simply don't connect to this
+     *  signal because showing the proposed context menu is the default behaviour.
+     * </para></listitem>
+     * </itemizedlist>
+     *
+     * If the signal handler returns %FALSE the context menu represented by @context_menu
+     * will be shown, if it return %TRUE the context menu will not be shown.
+     *
+     * The proposed #WebKitContextMenu passed in @context_menu argument is only valid
+     * during the signal emission.
+     *
+     * Returns: %TRUE to stop other handlers from being invoked for the event.
+     *    %FALSE to propagate the event further.
+     */
+    signals[CONTEXT_MENU] =
+        g_signal_new("context-menu",
+                     G_TYPE_FROM_CLASS(webViewClass),
+                     G_SIGNAL_RUN_LAST,
+                     G_STRUCT_OFFSET(WebKitWebViewClass, context_menu),
+                     g_signal_accumulator_true_handled, 0,
+                     webkit_marshal_BOOLEAN__OBJECT_BOXED_OBJECT,
+                     G_TYPE_BOOLEAN, 3,
+                     WEBKIT_TYPE_CONTEXT_MENU,
+                     GDK_TYPE_EVENT | G_SIGNAL_TYPE_STATIC_SCOPE,
+                     WEBKIT_TYPE_HIT_TEST_RESULT);
 }
 
 static bool updateReplaceContentStatus(WebKitWebView* webView, WebKitLoadEvent loadEvent)
@@ -1034,6 +1144,16 @@ void webkitWebViewReadyToShowPage(WebKitWebView* webView)
     g_signal_emit(webView, signals[READY_TO_SHOW], 0, NULL);
 }
 
+void webkitWebViewRunAsModal(WebKitWebView* webView)
+{
+    g_signal_emit(webView, signals[RUN_AS_MODAL], 0, NULL);
+
+    webView->priv->modalLoop = adoptGRef(g_main_loop_new(0, FALSE));
+    GDK_THREADS_ENTER();
+    g_main_loop_run(webView->priv->modalLoop.get());
+    GDK_THREADS_LEAVE();
+}
+
 void webkitWebViewClosePage(WebKitWebView* webView)
 {
     g_signal_emit(webView, signals[CLOSE], 0, NULL);
@@ -1172,14 +1292,6 @@ void webkitWebViewRunFileChooserRequest(WebKitWebView* webView, WebKitFileChoose
     g_signal_emit(webView, signals[RUN_FILE_CHOOSER], 0, request, &returnValue);
 }
 
-static void webkitWebViewCreateAndAppendDefaultMenuItems(WebKitWebView* webView, WKArrayRef wkProposedMenu, Vector<ContextMenuItem>& contextMenuItems)
-{
-    for (size_t i = 0; i < WKArrayGetSize(wkProposedMenu); ++i) {
-        WKContextMenuItemRef wkItem = static_cast<WKContextMenuItemRef>(WKArrayGetItemAtIndex(wkProposedMenu, i));
-        contextMenuItems.append(toImpl(wkItem)->data()->core());
-    }
-}
-
 static bool webkitWebViewShouldShowInputMethodsMenu(WebKitWebView* webView)
 {
     GtkSettings* settings = gtk_widget_get_settings(GTK_WIDGET(webView));
@@ -1191,33 +1303,65 @@ static bool webkitWebViewShouldShowInputMethodsMenu(WebKitWebView* webView)
     return showInputMethodMenu;
 }
 
-static void webkitWebViewCreateAndAppendInputMethodsMenuItem(WebKitWebView* webView, Vector<ContextMenuItem>& contextMenuItems)
+static int getUnicodeMenuItemPosition(WebKitContextMenu* contextMenu)
+{
+    GList* items = webkit_context_menu_get_items(contextMenu);
+    GList* iter;
+    int i = 0;
+    for (iter = items, i = 0; iter; iter = g_list_next(iter), ++i) {
+        WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(iter->data);
+
+        if (webkit_context_menu_item_is_separator(item))
+            continue;
+        if (webkit_context_menu_item_get_stock_action(item) == WEBKIT_CONTEXT_MENU_ACTION_UNICODE)
+            return i;
+    }
+    return -1;
+}
+
+static void webkitWebViewCreateAndAppendInputMethodsMenuItem(WebKitWebView* webView, WebKitContextMenu* contextMenu)
 {
     if (!webkitWebViewShouldShowInputMethodsMenu(webView))
         return;
 
+    // Place the im context menu item right before the unicode menu item
+    // if it's present.
+    int unicodeMenuItemPosition = getUnicodeMenuItemPosition(contextMenu);
+    if (unicodeMenuItemPosition == -1)
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_separator());
+
     GtkIMContext* imContext = webkitWebViewBaseGetIMContext(WEBKIT_WEB_VIEW_BASE(webView));
     GtkMenu* imContextMenu = GTK_MENU(gtk_menu_new());
     gtk_im_multicontext_append_menuitems(GTK_IM_MULTICONTEXT(imContext), GTK_MENU_SHELL(imContextMenu));
-    ContextMenu subMenu(imContextMenu);
-
-    ContextMenuItem separator(SeparatorType, ContextMenuItemTagNoAction, String());
-    contextMenuItems.append(separator);
-    ContextMenuItem menuItem(SubmenuType, ContextMenuItemTagNoAction, _("Input _Methods"), &subMenu);
-    contextMenuItems.append(menuItem);
+    WebKitContextMenuItem* menuItem = webkit_context_menu_item_new_from_stock_action(WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS);
+    webkitContextMenuItemSetSubMenuFromGtkMenu(menuItem, imContextMenu);
+    webkit_context_menu_insert(contextMenu, menuItem, unicodeMenuItemPosition);
 }
 
 void webkitWebViewPopulateContextMenu(WebKitWebView* webView, WKArrayRef wkProposedMenu, WKHitTestResultRef wkHitTestResult)
 {
-    WebContextMenuProxyGtk* contextMenu = webkitWebViewBaseGetActiveContextMenuProxy(WEBKIT_WEB_VIEW_BASE(webView));
-    ASSERT(contextMenu);
+    WebKitWebViewBase* webViewBase = WEBKIT_WEB_VIEW_BASE(webView);
+    WebContextMenuProxyGtk* contextMenuProxy = webkitWebViewBaseGetActiveContextMenuProxy(webViewBase);
+    ASSERT(contextMenuProxy);
 
-    Vector<ContextMenuItem> contextMenuItems;
-    webkitWebViewCreateAndAppendDefaultMenuItems(webView, wkProposedMenu, contextMenuItems);
+    GRefPtr<WebKitContextMenu> contextMenu = adoptGRef(webkitContextMenuCreate(wkProposedMenu));
     if (WKHitTestResultIsContentEditable(wkHitTestResult))
-        webkitWebViewCreateAndAppendInputMethodsMenuItem(webView, contextMenuItems);
+        webkitWebViewCreateAndAppendInputMethodsMenuItem(webView, contextMenu.get());
+
+    GRefPtr<WebKitHitTestResult> hitTestResult = adoptGRef(webkitHitTestResultCreate(wkHitTestResult));
+    GOwnPtr<GdkEvent> contextMenuEvent(webkitWebViewBaseTakeContextMenuEvent(webViewBase));
+
+    gboolean returnValue;
+    g_signal_emit(webView, signals[CONTEXT_MENU], 0, contextMenu.get(), contextMenuEvent.get(), hitTestResult.get(), &returnValue);
+    if (returnValue)
+        return;
+
+    Vector<ContextMenuItem> contextMenuItems;
+    webkitContextMenuPopulate(contextMenu.get(), contextMenuItems);
+    contextMenuProxy->populate(contextMenuItems);
 
-    contextMenu->populate(contextMenuItems);
+    // Clear the menu to make sure it's useless after signal emission.
+    webkit_context_menu_remove_all(contextMenu.get());
 }
 
 /**
@@ -1684,7 +1828,7 @@ void webkit_web_view_set_settings(WebKitWebView* webView, WebKitSettings* settin
     if (webView->priv->settings == settings)
         return;
 
-    g_signal_handlers_disconnect_by_func(webView->priv->settings.get(), reinterpret_cast<gpointer>(zoomTextOnlyChanged), webView);
+    webkitWebViewDisconnectSettingsSignalHandlers(webView);
     webkitWebViewSetSettings(webView, settings, toAPI(webkitWebViewBaseGetPage(WEBKIT_WEB_VIEW_BASE(webView))));
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index 716fbbd08..9328fa12f 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -136,6 +136,7 @@ struct _WebKitWebViewClass {
 
     GtkWidget *(* create)                (WebKitWebView             *web_view);
     void       (* ready_to_show)         (WebKitWebView             *web_view);
+    void       (* run_as_modal)          (WebKitWebView             *web_view);
     void       (* close)                 (WebKitWebView             *web_view);
 
     gboolean   (* script_dialog)         (WebKitWebView             *web_view,
@@ -158,6 +159,10 @@ struct _WebKitWebViewClass {
     gboolean   (* leave_fullscreen)      (WebKitWebView             *web_view);
     gboolean   (* run_file_chooser)      (WebKitWebView             *web_view,
                                           WebKitFileChooserRequest  *request);
+    gboolean   (* context_menu)         (WebKitWebView              *web_view,
+                                         WebKitContextMenu          *context_menu,
+                                         GdkEvent                   *event,
+                                         WebKitHitTestResult        *hit_test_result);
 
     /* Padding for future expansion */
     void (*_webkit_reserved0) (void);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
index a2cc1d97b..b7ffc98b8 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp
@@ -46,6 +46,7 @@
 #include <WebCore/DataObjectGtk.h>
 #include <WebCore/DragData.h>
 #include <WebCore/DragIcon.h>
+#include <WebCore/GOwnPtrGtk.h>
 #include <WebCore/GtkClickCounter.h>
 #include <WebCore/GtkDragAndDropHelper.h>
 #include <WebCore/GtkUtilities.h>
@@ -94,6 +95,7 @@ struct _WebKitWebViewBasePrivate {
 #endif
     GtkWidget* inspectorView;
     unsigned inspectorViewHeight;
+    GOwnPtr<GdkEvent> contextMenuEvent;
     WebContextMenuProxyGtk* activeContextMenuProxy;
 };
 
@@ -448,6 +450,10 @@ static gboolean webkitWebViewBaseButtonPressEvent(GtkWidget* widget, GdkEventBut
 
     if (!priv->clickCounter.shouldProcessButtonEvent(buttonEvent))
         return TRUE;
+
+    // If it's a right click event save it as a possible context menu event.
+    if (buttonEvent->button == 3)
+        priv->contextMenuEvent.set(gdk_event_copy(reinterpret_cast<GdkEvent*>(buttonEvent)));
     priv->pageProxy->handleMouseEvent(NativeWebMouseEvent(reinterpret_cast<GdkEvent*>(buttonEvent),
                                                      priv->clickCounter.clickCountForGdkButtonEvent(widget, buttonEvent)));
     return TRUE;
@@ -784,3 +790,8 @@ WebContextMenuProxyGtk* webkitWebViewBaseGetActiveContextMenuProxy(WebKitWebView
 {
     return webkitWebViewBase->priv->activeContextMenuProxy;
 }
+
+GdkEvent* webkitWebViewBaseTakeContextMenuEvent(WebKitWebViewBase* webkitWebViewBase)
+{
+    return webkitWebViewBase->priv->contextMenuEvent.release();
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
index 45ffbf283..70cc72575 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
@@ -49,5 +49,6 @@ void webkitWebViewBaseInitializeFullScreenClient(WebKitWebViewBase*, const WKFul
 void webkitWebViewBaseSetInspectorViewHeight(WebKitWebViewBase*, unsigned height);
 void webkitWebViewBaseSetActiveContextMenuProxy(WebKitWebViewBase*, WebContextMenuProxyGtk*);
 WebContextMenuProxyGtk* webkitWebViewBaseGetActiveContextMenuProxy(WebKitWebViewBase*);
+GdkEvent* webkitWebViewBaseTakeContextMenuEvent(WebKitWebViewBase*);
 
 #endif // WebKitWebViewBasePrivate_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
index aedcdee6e..b602f4fe0 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewPrivate.h
@@ -38,6 +38,7 @@ void webkitWebViewSetTitle(WebKitWebView*, const CString&);
 void webkitWebViewUpdateURI(WebKitWebView*);
 WKPageRef webkitWebViewCreateNewPage(WebKitWebView*, WKDictionaryRef wkWindowFeatures);
 void webkitWebViewReadyToShowPage(WebKitWebView*);
+void webkitWebViewRunAsModal(WebKitWebView*);
 void webkitWebViewClosePage(WebKitWebView*);
 void webkitWebViewRunJavaScriptAlert(WebKitWebView*, const CString& message);
 bool webkitWebViewRunJavaScriptConfirm(WebKitWebView*, const CString& message);
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
index c2eebf36c..6b62d6f69 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml
@@ -37,6 +37,8 @@
     <xi:include href="xml/WebKitWebInspector.xml"/>
     <xi:include href="xml/WebKitURISchemeRequest.xml"/>
     <xi:include href="xml/WebKitVersion.xml"/>
+    <xi:include href="xml/WebKitContextMenu.xml"/>
+    <xi:include href="xml/WebKitContextMenuItem.xml"/>
   </chapter>
 
   <index id="index-all">
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index 1b97de88f..aca34df0b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -256,6 +256,8 @@ webkit_settings_get_enable_webaudio
 webkit_settings_set_enable_webaudio
 webkit_settings_get_enable_webgl
 webkit_settings_set_enable_webgl
+webkit_settings_set_allow_modal_dialogs
+webkit_settings_get_allow_modal_dialogs
 webkit_settings_get_zoom_text_only
 webkit_settings_set_zoom_text_only
 webkit_settings_get_javascript_can_access_clipboard
@@ -744,3 +746,63 @@ WEBKIT_MINOR_VERSION
 WEBKIT_MICRO_VERSION
 WEBKIT_CHECK_VERSION
 </SECTION>
+
+<SECTION>
+<FILE>WebKitContextMenu</FILE>
+WebKitContextMenu
+webkit_context_menu_new
+webkit_context_menu_new_with_items
+webkit_context_menu_prepend
+webkit_context_menu_append
+webkit_context_menu_insert
+webkit_context_menu_move_item
+webkit_context_menu_get_items
+webkit_context_menu_get_n_items
+webkit_context_menu_first
+webkit_context_menu_last
+webkit_context_menu_get_item_at_position
+webkit_context_menu_remove
+webkit_context_menu_remove_all
+
+<SUBSECTION Standard>
+WebKitContextMenuClass
+WEBKIT_TYPE_CONTEXT_MENU
+WEBKIT_CONTEXT_MENU
+WEBKIT_IS_CONTEXT_MENU
+WEBKIT_CONTEXT_MENU_CLASS
+WEBKIT_IS_CONTEXT_MENU_CLASS
+WEBKIT_CONTEXT_MENU_GET_CLASS
+
+<SUBSECTION Private>
+WebKitContextMenuPrivate
+webkit_context_menu_get_type
+</SECTION>
+
+<SECTION>
+<FILE>WebKitContextMenuItem</FILE>
+WebKitContextMenuItem
+WebKitContextMenuAction
+webkit_context_menu_item_new
+webkit_context_menu_item_new_from_stock_action
+webkit_context_menu_item_new_from_stock_action_with_label
+webkit_context_menu_item_new_with_submenu
+webkit_context_menu_item_new_separator
+webkit_context_menu_item_get_action
+webkit_context_menu_item_get_stock_action
+webkit_context_menu_item_is_separator
+webkit_context_menu_item_set_submenu
+webkit_context_menu_item_get_submenu
+
+<SUBSECTION Standard>
+WebKitContextMenuItemClass
+WEBKIT_TYPE_CONTEXT_MENU_ITEM
+WEBKIT_CONTEXT_MENU_ITEM
+WEBKIT_IS_CONTEXT_MENU_ITEM
+WEBKIT_CONTEXT_MENU_ITEM_CLASS
+WEBKIT_IS_CONTEXT_MENU_ITEM_CLASS
+WEBKIT_CONTEXT_MENU_ITEM_GET_CLASS
+
+<SUBSECTION Private>
+WebKitContextMenuItemPrivate
+webkit_context_menu_item_get_type
+</SECTION>
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
index d155982f2..4d8843e9c 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk.types
@@ -19,3 +19,5 @@ webkit_plugin_get_type
 webkit_mime_info_get_type
 webkit_web_inspector_get_type
 webkit_uri_scheme_request_get_type
+webkit_context_menu_get_type
+webkit_context_menu_item_get_type
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
index 7adae8adc..058a613f1 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/GNUmakefile.am
@@ -2,6 +2,7 @@ if ENABLE_WEBKIT2
 
 TEST_PROGS += \
 	Programs/WebKit2APITests/TestBackForwardList \
+	Programs/WebKit2APITests/TestContextMenu \
 	Programs/WebKit2APITests/TestCookieManager \
 	Programs/WebKit2APITests/TestDownloads \
 	Programs/WebKit2APITests/TestInspector \
@@ -167,4 +168,10 @@ Programs_WebKit2APITests_TestWebKitVersion_CPPFLAGS = $(webkit2_tests_cppflags)
 Programs_WebKit2APITests_TestWebKitVersion_LDADD = $(webkit2_tests_ldadd)
 Programs_WebKit2APITests_TestWebKitVersion_LDFLAGS = $(webkit2_tests_ldflags)
 
+Programs_WebKit2APITests_TestContextMenu_SOURCES = \
+        Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
+Programs_WebKit2APITests_TestContextMenu_CPPFLAGS = $(webkit2_tests_cppflags)
+Programs_WebKit2APITests_TestContextMenu_LDADD = $(webkit2_tests_ldadd)
+Programs_WebKit2APITests_TestContextMenu_LDFLAGS = $(webkit2_tests_ldflags)
+
 endif # ENABLE_WEBKIT2
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
new file mode 100644
index 000000000..f74016006
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
@@ -0,0 +1,671 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2,1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "WebViewTest.h"
+#include <wtf/gobject/GRefPtr.h>
+
+class ContextMenuTest: public WebViewTest {
+public:
+    enum ContextMenuItemStateFlags {
+        Visible = 1 << 0,
+        Enabled = 1 << 1,
+        Checked = 1 << 2
+    };
+
+    void checkContextMenuEvent(GdkEvent* event)
+    {
+        g_assert(event);
+        g_assert_cmpint(event->type, ==, GDK_BUTTON_PRESS);
+        g_assert_cmpint(event->button.button, ==, 3);
+        g_assert_cmpint(event->button.x, ==, m_menuPositionX);
+        g_assert_cmpint(event->button.y, ==, m_menuPositionY);
+    }
+
+    static gboolean contextMenuCallback(WebKitWebView* webView, WebKitContextMenu* contextMenu, GdkEvent* event, WebKitHitTestResult* hitTestResult, ContextMenuTest* test)
+    {
+        g_assert(WEBKIT_IS_CONTEXT_MENU(contextMenu));
+        test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(contextMenu));
+        test->checkContextMenuEvent(event);
+        g_assert(WEBKIT_IS_HIT_TEST_RESULT(hitTestResult));
+        test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(hitTestResult));
+
+        return test->contextMenu(contextMenu, event, hitTestResult);
+    }
+
+    ContextMenuTest()
+        : m_menuPositionX(0)
+        , m_menuPositionY(0)
+    {
+        g_signal_connect(m_webView, "context-menu", G_CALLBACK(contextMenuCallback), this);
+    }
+
+    ~ContextMenuTest()
+    {
+        g_signal_handlers_disconnect_matched(m_webView, G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+    }
+
+    virtual bool contextMenu(WebKitContextMenu*, GdkEvent*, WebKitHitTestResult*) = 0;
+
+    bool shouldShowInputMethodsMenu()
+    {
+        GtkSettings* settings = gtk_widget_get_settings(GTK_WIDGET(m_webView));
+        if (!settings)
+            return true;
+
+        gboolean showInputMethodMenu;
+        g_object_get(settings, "gtk-show-input-method-menu", &showInputMethodMenu, NULL);
+        return showInputMethodMenu;
+    }
+
+    void checkActionState(GtkAction* action, unsigned state)
+    {
+        if (state & Visible)
+            g_assert(gtk_action_get_visible(action));
+        else
+            g_assert(!gtk_action_get_visible(action));
+
+        if (state & Enabled)
+            g_assert(gtk_action_get_sensitive(action));
+        else
+            g_assert(!gtk_action_get_sensitive(action));
+
+        if (GTK_IS_TOGGLE_ACTION(action)) {
+            if (state & Checked)
+                g_assert(gtk_toggle_action_get_active(GTK_TOGGLE_ACTION(action)));
+            else
+                g_assert(!gtk_toggle_action_get_active(GTK_TOGGLE_ACTION(action)));
+        }
+    }
+
+    GList* checkCurrentItemIsStockActionAndGetNext(GList* items, WebKitContextMenuAction stockAction, unsigned state)
+    {
+        g_assert(items);
+        g_assert(WEBKIT_IS_CONTEXT_MENU_ITEM(items->data));
+
+        WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(items->data);
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(item));
+
+        GtkAction* action = webkit_context_menu_item_get_action(item);
+        g_assert(GTK_IS_ACTION(action));
+
+        g_assert_cmpint(webkit_context_menu_item_get_stock_action(item), ==, stockAction);
+
+        checkActionState(action, state);
+
+        return g_list_next(items);
+    }
+
+    GList* checkCurrentItemIsCustomActionAndGetNext(GList* items, const char* label, unsigned state)
+    {
+        g_assert(items);
+        g_assert(WEBKIT_IS_CONTEXT_MENU_ITEM(items->data));
+
+        WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(items->data);
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(item));
+
+        GtkAction* action = webkit_context_menu_item_get_action(item);
+        g_assert(GTK_IS_ACTION(action));
+
+        g_assert_cmpint(webkit_context_menu_item_get_stock_action(item), ==, WEBKIT_CONTEXT_MENU_ACTION_CUSTOM);
+        g_assert_cmpstr(gtk_action_get_label(action), ==, label);
+
+        checkActionState(action, state);
+
+        return g_list_next(items);
+    }
+
+    GList* checkCurrentItemIsSubMenuAndGetNext(GList* items, const char* label, unsigned state, GList** subMenuIter)
+    {
+        g_assert(items);
+        g_assert(WEBKIT_IS_CONTEXT_MENU_ITEM(items->data));
+
+        WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(items->data);
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(item));
+
+        GtkAction* action = webkit_context_menu_item_get_action(item);
+        g_assert(GTK_IS_ACTION(action));
+
+        g_assert_cmpstr(gtk_action_get_label(action), ==, label);
+        checkActionState(action, state);
+
+        WebKitContextMenu* subMenu = webkit_context_menu_item_get_submenu(item);
+        g_assert(WEBKIT_IS_CONTEXT_MENU(subMenu));
+        if (subMenuIter)
+            *subMenuIter = webkit_context_menu_get_items(subMenu);
+
+        return g_list_next(items);
+    }
+
+    GList* checkCurrentItemIsSeparatorAndGetNext(GList* items)
+    {
+        g_assert(items);
+        g_assert(WEBKIT_IS_CONTEXT_MENU_ITEM(items->data));
+
+        WebKitContextMenuItem* item = WEBKIT_CONTEXT_MENU_ITEM(items->data);
+        g_assert(webkit_context_menu_item_is_separator(item));
+
+        return g_list_next(items);
+    }
+
+    static gboolean doRightClickIdleCallback(ContextMenuTest* test)
+    {
+        test->clickMouseButton(test->m_menuPositionX, test->m_menuPositionY, 3);
+        return FALSE;
+    }
+
+    void showContextMenuAtPositionAndWaitUntilFinished(int x, int y)
+    {
+        m_menuPositionX = x;
+        m_menuPositionY = y;
+        g_idle_add(reinterpret_cast<GSourceFunc>(doRightClickIdleCallback), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    void showContextMenuAndWaitUntilFinished()
+    {
+        showContextMenuAtPositionAndWaitUntilFinished(0, 0);
+    }
+
+    double m_menuPositionX;
+    double m_menuPositionY;
+};
+
+class ContextMenuDefaultTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuDefaultTest);
+
+    enum DefaultMenuType {
+        Navigation,
+        Link,
+        Image,
+        LinkImage,
+        Video,
+        Editable
+    };
+
+    ContextMenuDefaultTest()
+        : m_expectedMenuType(Navigation)
+    {
+    }
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent* event, WebKitHitTestResult* hitTestResult)
+    {
+        GList* iter = webkit_context_menu_get_items(contextMenu);
+
+        switch (m_expectedMenuType) {
+        case Navigation:
+            g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_GO_BACK, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_STOP, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_RELOAD, Visible | Enabled);
+            break;
+        case Link:
+            g_assert(webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD, Visible | Enabled);
+            break;
+        case Image:
+            g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD, Visible | Enabled);
+            break;
+        case LinkImage:
+            g_assert(webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK_IN_NEW_WINDOW, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_LINK_TO_DISK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_LINK_TO_CLIPBOARD, Visible | Enabled);
+            iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_IMAGE_IN_NEW_WINDOW, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_DOWNLOAD_IMAGE_TO_DISK, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_TO_CLIPBOARD, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_IMAGE_URL_TO_CLIPBOARD, Visible | Enabled);
+            break;
+        case Video:
+            g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_MEDIA_PLAY, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_MEDIA_MUTE, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_CONTROLS, Visible | Enabled | Checked);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_TOGGLE_MEDIA_LOOP, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_ENTER_VIDEO_FULLSCREEN, Visible);
+            iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY_VIDEO_LINK_TO_CLIPBOARD, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_OPEN_VIDEO_IN_NEW_WINDOW, Visible | Enabled);
+            break;
+        case Editable:
+            g_assert(!webkit_hit_test_result_context_is_link(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_image(hitTestResult));
+            g_assert(!webkit_hit_test_result_context_is_media(hitTestResult));
+            g_assert(webkit_hit_test_result_context_is_editable(hitTestResult));
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_CUT, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_COPY, Visible);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_PASTE, Visible | Enabled);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_DELETE, Visible);
+            iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_SELECT_ALL, Visible | Enabled);
+            if (shouldShowInputMethodsMenu()) {
+                iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+                iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_INPUT_METHODS, Visible | Enabled);
+                iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_UNICODE, Visible | Enabled);
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        if (webkit_settings_get_enable_developer_extras(webkit_web_view_get_settings(m_webView))) {
+            iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+            iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_INSPECT_ELEMENT, Visible | Enabled);
+        }
+        g_assert(!iter);
+
+        quitMainLoop();
+
+        return true;
+    }
+
+    DefaultMenuType m_expectedMenuType;
+};
+
+static void testContextMenuDefaultMenu(ContextMenuDefaultTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    const char* linksHTML =
+        "<html><body>"
+        " <a style='position:absolute; left:1; top:1' href='http://www.webkitgtk.org' title='WebKitGTK+ Title'>WebKitGTK+ Website</a>"
+        " <img style='position:absolute; left:1; top:10' src='0xdeadbeef' width=5 height=5></img>"
+        " <a style='position:absolute; left:1; top:20' href='http://www.webkitgtk.org/logo' title='WebKitGTK+ Logo'><img src='0xdeadbeef' width=5 height=5></img></a>"
+        " <video style='position:absolute; left:1; top:30' width=10 height=10 controls='controls'><source src='movie.ogg' type='video/ogg' /></video>"
+        " <input style='position:absolute; left:1; top:50' size='10'></input>"
+        "</body></html>";
+    test->loadHtml(linksHTML, "file:///");
+    test->waitUntilLoadFinished();
+
+    // Context menu for document.
+    test->m_expectedMenuType = ContextMenuDefaultTest::Navigation;
+    test->showContextMenuAtPositionAndWaitUntilFinished(0, 0);
+
+    // Context menu for link.
+    test->m_expectedMenuType = ContextMenuDefaultTest::Link;
+    test->showContextMenuAtPositionAndWaitUntilFinished(1, 1);
+
+    // Context menu for image.
+    test->m_expectedMenuType = ContextMenuDefaultTest::Image;
+    test->showContextMenuAtPositionAndWaitUntilFinished(1, 10);
+
+    // Enable developer extras now, so that inspector element
+    // will be shown in the default context menu.
+    webkit_settings_set_enable_developer_extras(webkit_web_view_get_settings(test->m_webView), TRUE);
+
+    // Context menu for image link.
+    test->m_expectedMenuType = ContextMenuDefaultTest::LinkImage;
+    test->showContextMenuAtPositionAndWaitUntilFinished(1, 20);
+
+    // Context menu for image video.
+    test->m_expectedMenuType = ContextMenuDefaultTest::Video;
+    test->showContextMenuAtPositionAndWaitUntilFinished(1, 30);
+
+    // Context menu for editable.
+    test->m_expectedMenuType = ContextMenuDefaultTest::Editable;
+    test->showContextMenuAtPositionAndWaitUntilFinished(5, 55);
+}
+
+class ContextMenuCustomTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuCustomTest);
+
+    ContextMenuCustomTest()
+        : m_itemToActivateLabel(0)
+        , m_activated(false)
+        , m_toggled(false)
+    {
+    }
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent*, WebKitHitTestResult* hitTestResult)
+    {
+        // Append our custom item to the default menu.
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new(m_action.get()));
+        quitMainLoop();
+
+        return false;
+    }
+
+    GtkMenu* getPopupMenu()
+    {
+        GOwnPtr<GList> toplevels(gtk_window_list_toplevels());
+        for (GList* iter = toplevels.get(); iter; iter = g_list_next(iter)) {
+            if (!GTK_IS_WINDOW(iter->data))
+                continue;
+
+            GtkWidget* child = gtk_bin_get_child(GTK_BIN(iter->data));
+            if (!GTK_IS_MENU(child))
+                continue;
+
+            if (gtk_menu_get_attach_widget(GTK_MENU(child)) == GTK_WIDGET(m_webView))
+                return GTK_MENU(child);
+        }
+        g_assert_not_reached();
+        return 0;
+    }
+
+    GtkMenuItem* getMenuItem(GtkMenu* menu, const gchar* itemLabel)
+    {
+        GOwnPtr<GList> items(gtk_container_get_children(GTK_CONTAINER(menu)));
+        for (GList* iter = items.get(); iter; iter = g_list_next(iter)) {
+            GtkMenuItem* child = GTK_MENU_ITEM(iter->data);
+            if (g_str_equal(itemLabel, gtk_menu_item_get_label(child)))
+                return child;
+        }
+        g_assert_not_reached();
+        return 0;
+    }
+
+    void activateMenuItem()
+    {
+        g_assert(m_itemToActivateLabel);
+        GtkMenu* menu = getPopupMenu();
+        GtkMenuItem* item = getMenuItem(menu, m_itemToActivateLabel);
+        gtk_menu_shell_activate_item(GTK_MENU_SHELL(menu), GTK_WIDGET(item), TRUE);
+        m_itemToActivateLabel = 0;
+        quitMainLoop();
+    }
+
+    static gboolean activateMenuItemIdleCallback(gpointer userData)
+    {
+        ContextMenuCustomTest* test = static_cast<ContextMenuCustomTest*>(userData);
+        test->activateMenuItem();
+        return FALSE;
+    }
+
+    void activateCustomMenuItemAndWaitUntilActivated(const char* actionLabel)
+    {
+        m_activated = m_toggled = false;
+        m_itemToActivateLabel = actionLabel;
+        g_idle_add(activateMenuItemIdleCallback, this);
+        g_main_loop_run(m_mainLoop);
+    }
+
+    void toggleCustomMenuItemAndWaitUntilToggled(const char* actionLabel)
+    {
+        activateCustomMenuItemAndWaitUntilActivated(actionLabel);
+    }
+
+    static void actionActivatedCallback(GtkAction*, ContextMenuCustomTest* test)
+    {
+        test->m_activated = true;
+    }
+
+    static void actionToggledCallback(GtkAction*, ContextMenuCustomTest* test)
+    {
+        test->m_toggled = true;
+    }
+
+    void setAction(GtkAction* action)
+    {
+        m_action = action;
+        if (GTK_IS_TOGGLE_ACTION(action))
+            g_signal_connect(action, "toggled", G_CALLBACK(actionToggledCallback), this);
+        else
+            g_signal_connect(action, "activate", G_CALLBACK(actionActivatedCallback), this);
+    }
+
+    GRefPtr<GtkAction> m_action;
+    const char* m_itemToActivateLabel;
+    bool m_activated;
+    bool m_toggled;
+};
+
+static void testContextMenuPopulateMenu(ContextMenuCustomTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    test->loadHtml("<html><body>WebKitGTK+ Context menu tests</body></html>", "file:///");
+    test->waitUntilLoadFinished();
+
+    // Create a custom menu item.
+    GRefPtr<GtkAction> action = adoptGRef(gtk_action_new("WebKitGTK+CustomAction", "Custom _Action", 0, 0));
+    test->setAction(action.get());
+    test->showContextMenuAndWaitUntilFinished();
+    test->activateCustomMenuItemAndWaitUntilActivated(gtk_action_get_label(action.get()));
+    g_assert(test->m_activated);
+    g_assert(!test->m_toggled);
+
+    // Create a custom toggle menu item.
+    GRefPtr<GtkAction> toggleAction = adoptGRef(GTK_ACTION(gtk_toggle_action_new("WebKitGTK+CustomToggleAction", "Custom _Toggle Action", 0, 0)));
+    test->setAction(toggleAction.get());
+    test->showContextMenuAndWaitUntilFinished();
+    test->toggleCustomMenuItemAndWaitUntilToggled(gtk_action_get_label(toggleAction.get()));
+    g_assert(!test->m_activated);
+    g_assert(test->m_toggled);
+}
+
+class ContextMenuCustomFullTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuCustomFullTest);
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent*, WebKitHitTestResult*)
+    {
+        // Clear proposed menu and build our own.
+        webkit_context_menu_remove_all(contextMenu);
+        g_assert_cmpint(webkit_context_menu_get_n_items(contextMenu), ==, 0);
+
+        // Add actions from stock.
+        webkit_context_menu_prepend(contextMenu, webkit_context_menu_item_new_from_stock_action(WEBKIT_CONTEXT_MENU_ACTION_GO_BACK));
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_from_stock_action(WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD));
+        webkit_context_menu_insert(contextMenu, webkit_context_menu_item_new_separator(), 2);
+
+        // Add custom actions.
+        GRefPtr<GtkAction> action = adoptGRef(gtk_action_new("WebKitGTK+CustomAction", "Custom _Action", 0, 0));
+        gtk_action_set_sensitive(action.get(), FALSE);
+        webkit_context_menu_insert(contextMenu, webkit_context_menu_item_new(action.get()), -1);
+        GRefPtr<GtkAction> toggleAction = adoptGRef(GTK_ACTION(gtk_toggle_action_new("WebKitGTK+CustomToggleAction", "Custom _Toggle Action", 0, 0)));
+        gtk_toggle_action_set_active(GTK_TOGGLE_ACTION(toggleAction.get()), TRUE);
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new(toggleAction.get()));
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_separator());
+
+        // Add a submenu.
+        GRefPtr<WebKitContextMenu> subMenu = adoptGRef(webkit_context_menu_new());
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(subMenu.get()));
+        webkit_context_menu_insert(subMenu.get(), webkit_context_menu_item_new_from_stock_action_with_label(WEBKIT_CONTEXT_MENU_ACTION_STOP, "Stop Load"), 0);
+        webkit_context_menu_insert(subMenu.get(), webkit_context_menu_item_new_from_stock_action(WEBKIT_CONTEXT_MENU_ACTION_RELOAD), -1);
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_with_submenu("Load options", subMenu.get()));
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_separator());
+
+        // Move Load submenu before custom actions.
+        webkit_context_menu_move_item(contextMenu, webkit_context_menu_last(contextMenu), 3);
+        webkit_context_menu_move_item(contextMenu, webkit_context_menu_last(contextMenu), 3);
+
+        // If last item is a separator, remove it.
+        if (webkit_context_menu_item_is_separator(webkit_context_menu_last(contextMenu)))
+            webkit_context_menu_remove(contextMenu, webkit_context_menu_last(contextMenu));
+
+        // Check the menu.
+        GList* iter = webkit_context_menu_get_items(contextMenu);
+
+        iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_GO_BACK, Visible | Enabled);
+        iter = checkCurrentItemIsStockActionAndGetNext(iter, WEBKIT_CONTEXT_MENU_ACTION_GO_FORWARD, Visible | Enabled);
+        iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+
+        GList* subMenuIter = 0;
+        iter = checkCurrentItemIsSubMenuAndGetNext(iter, "Load options", Visible | Enabled, &subMenuIter);
+        subMenuIter = checkCurrentItemIsStockActionAndGetNext(subMenuIter, WEBKIT_CONTEXT_MENU_ACTION_STOP, Visible | Enabled);
+        subMenuIter = checkCurrentItemIsStockActionAndGetNext(subMenuIter, WEBKIT_CONTEXT_MENU_ACTION_RELOAD, Visible | Enabled);
+        iter = checkCurrentItemIsSeparatorAndGetNext(iter);
+
+        iter = checkCurrentItemIsCustomActionAndGetNext(iter, "Custom _Action", Visible);
+        iter = checkCurrentItemIsCustomActionAndGetNext(iter, "Custom _Toggle Action", Visible | Enabled | Checked);
+        g_assert(!iter);
+
+        quitMainLoop();
+
+        return true;
+    }
+};
+
+static void testContextMenuCustomMenu(ContextMenuCustomFullTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    test->loadHtml("<html><body>WebKitGTK+ Context menu tests</body></html>", "file:///");
+    test->waitUntilLoadFinished();
+
+    test->showContextMenuAndWaitUntilFinished();
+}
+
+class ContextMenuDisabledTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuDisabledTest);
+
+    enum DisableMode {
+        IgnoreClicks,
+        IgnoreDefaultMenu
+    };
+
+    static gboolean buttonPressEventCallback(GtkWidget*, GdkEvent* event, ContextMenuDisabledTest* test)
+    {
+        if (event->button.button != 3)
+            return FALSE;
+        return test->rightButtonPressed();
+    }
+
+    ContextMenuDisabledTest()
+        : m_disableMode(IgnoreClicks)
+    {
+        g_signal_connect(m_webView, "button-press-event", G_CALLBACK(buttonPressEventCallback), this);
+    }
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent*, WebKitHitTestResult*)
+    {
+        if (m_disableMode == IgnoreClicks)
+            g_assert_not_reached();
+        else
+            quitMainLoop();
+
+        return true;
+    }
+
+    bool rightButtonPressed()
+    {
+        if (m_disableMode == IgnoreClicks) {
+            quitMainLoopAfterProcessingPendingEvents();
+            return true;
+        }
+        return false;
+    }
+
+    DisableMode m_disableMode;
+};
+
+static void testContextMenuDisableMenu(ContextMenuDisabledTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    test->loadHtml("<html><body>WebKitGTK+ Context menu tests</body></html>", "file:///");
+    test->waitUntilLoadFinished();
+
+    test->m_disableMode = ContextMenuDisabledTest::IgnoreDefaultMenu;
+    test->showContextMenuAndWaitUntilFinished();
+
+    test->m_disableMode = ContextMenuDisabledTest::IgnoreClicks;
+    test->showContextMenuAndWaitUntilFinished();
+}
+
+class ContextMenuSubmenuTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuSubmenuTest);
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent*, WebKitHitTestResult*)
+    {
+        size_t menuSize = webkit_context_menu_get_n_items(contextMenu);
+        GRefPtr<WebKitContextMenu> subMenu = adoptGRef(webkit_context_menu_new());
+        webkit_context_menu_append(contextMenu, webkit_context_menu_item_new_with_submenu("SubMenuItem", subMenu.get()));
+        g_assert_cmpuint(webkit_context_menu_get_n_items(contextMenu), ==, menuSize + 1);
+
+        GRefPtr<WebKitContextMenu> subMenu2 = adoptGRef(webkit_context_menu_new());
+        GRefPtr<WebKitContextMenuItem> item = webkit_context_menu_item_new_from_stock_action(WEBKIT_CONTEXT_MENU_ACTION_OPEN_LINK);
+
+        // Add submenu to newly created item.
+        g_assert(!webkit_context_menu_item_get_submenu(item.get()));
+        webkit_context_menu_item_set_submenu(item.get(), subMenu2.get());
+        g_assert(webkit_context_menu_item_get_submenu(item.get()) == subMenu2.get());
+
+        // Replace the submenu.
+        webkit_context_menu_item_set_submenu(item.get(), 0);
+        g_assert(!webkit_context_menu_item_get_submenu(item.get()));
+
+        // Try to add a submenu already added to another item.
+        removeLogFatalFlag(G_LOG_LEVEL_WARNING);
+        webkit_context_menu_item_set_submenu(item.get(), subMenu.get());
+        addLogFatalFlag(G_LOG_LEVEL_WARNING);
+        g_assert(!webkit_context_menu_item_get_submenu(item.get()));
+
+        // A removed submenu shouldn't have a parent.
+        webkit_context_menu_item_set_submenu(item.get(), subMenu2.get());
+        g_assert(webkit_context_menu_item_get_submenu(item.get()) == subMenu2.get());
+
+        quitMainLoop();
+
+        return true;
+    }
+};
+
+static void testContextMenuSubMenu(ContextMenuSubmenuTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    test->loadHtml("<html><body>WebKitGTK+ Context menu tests</body></html>", "file:///");
+    test->waitUntilLoadFinished();
+
+    test->showContextMenuAndWaitUntilFinished();
+}
+
+void beforeAll()
+{
+    ContextMenuDefaultTest::add("WebKitWebView", "default-menu", testContextMenuDefaultMenu);
+    ContextMenuCustomTest::add("WebKitWebView", "populate-menu", testContextMenuPopulateMenu);
+    ContextMenuCustomFullTest::add("WebKitWebView", "custom-menu", testContextMenuCustomMenu);
+    ContextMenuDisabledTest::add("WebKitWebView", "disable-menu", testContextMenuDisableMenu);
+    ContextMenuSubmenuTest::add("WebKitWebView", "submenu", testContextMenuSubMenu);
+}
+
+void afterAll()
+{
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.h b/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.h
index 219cb44ed..6929c3595 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.h
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestMain.h
@@ -75,6 +75,20 @@ public:
         return resourcesDir.get();
     }
 
+    void addLogFatalFlag(unsigned flag)
+    {
+        unsigned fatalMask = g_log_set_always_fatal(static_cast<GLogLevelFlags>(G_LOG_FATAL_MASK));
+        fatalMask |= flag;
+        g_log_set_always_fatal(static_cast<GLogLevelFlags>(fatalMask));
+    }
+
+    void removeLogFatalFlag(unsigned flag)
+    {
+        unsigned fatalMask = g_log_set_always_fatal(static_cast<GLogLevelFlags>(G_LOG_FATAL_MASK));
+        fatalMask &= ~flag;
+        g_log_set_always_fatal(static_cast<GLogLevelFlags>(fatalMask));
+    }
+
     HashSet<GObject*> m_watchedObjects;
 };
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
index ae9ff2f7a..a185db8a7 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitFindController.cpp
@@ -324,8 +324,6 @@ static void testFindControllerHide(FindControllerTest* test, gconstpointer)
     g_assert(highlightPixbuf);
     g_assert(!gdkPixbufEqual(originalPixbuf.get(), highlightPixbuf.get()));
 
-#if (0)
-    // Requires http://webkit.org/b/77747 to be fixed
     WebKitFindController* findController = webkit_web_view_get_find_controller(test->m_webView);
     webkit_find_controller_search_finish(findController);
     webkit_web_view_execute_editing_command(test->m_webView, "Unselect");
@@ -334,7 +332,6 @@ static void testFindControllerHide(FindControllerTest* test, gconstpointer)
     GRefPtr<GdkPixbuf> unhighlightPixbuf = gdk_pixbuf_get_from_window(webViewGdkWindow, 0, 0, allocatedHeight, allocatedWidth);
     g_assert(unhighlightPixbuf);
     g_assert(gdkPixbufEqual(originalPixbuf.get(), unhighlightPixbuf.get()));
-#endif
 }
 
 static void testFindControllerInstance(FindControllerTest* test, gconstpointer)
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
index 4616d105f..2cebdd995 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
@@ -199,6 +199,11 @@ static void testWebKitSettings(Test*, gconstpointer)
     webkit_settings_set_enable_webgl(settings, TRUE);
     g_assert(webkit_settings_get_enable_webgl(settings));
 
+    // Allow Modal Dialogs is disabled by default.
+    g_assert(!webkit_settings_get_allow_modal_dialogs(settings));
+    webkit_settings_set_allow_modal_dialogs(settings, TRUE);
+    g_assert(webkit_settings_get_allow_modal_dialogs(settings));
+
     // Zoom text only is disabled by default.
     g_assert(!webkit_settings_get_zoom_text_only(settings));
     webkit_settings_set_zoom_text_only(settings, TRUE);
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
index 646752974..3e194a179 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebView.cpp
@@ -103,6 +103,7 @@ public:
     enum WebViewEvents {
         Create,
         ReadyToShow,
+        RunAsModal,
         Close
     };
 
@@ -178,46 +179,19 @@ public:
         test->m_windowPropertiesChanged.add(g_param_spec_get_name(paramSpec));
     }
 
-    static void viewClose(WebKitWebView* webView, UIClientTest* test)
+    static GtkWidget* viewCreateCallback(WebKitWebView* webView, UIClientTest* test)
     {
-        g_assert(webView != test->m_webView);
-
-        test->m_webViewEvents.append(Close);
-        g_object_unref(webView);
-
-        g_main_loop_quit(test->m_mainLoop);
+        return test->viewCreate(webView);
     }
 
-    static void viewReadyToShow(WebKitWebView* webView, UIClientTest* test)
+    static void viewReadyToShowCallback(WebKitWebView* webView, UIClientTest* test)
     {
-        g_assert(webView != test->m_webView);
-
-        WebKitWindowProperties* windowProperties = webkit_web_view_get_window_properties(webView);
-        g_assert(windowProperties);
-        WindowProperties(windowProperties).assertEqual(test->m_windowProperties);
-
-        test->m_webViewEvents.append(ReadyToShow);
+        test->viewReadyToShow(webView);
     }
 
-    static GtkWidget* viewCreate(WebKitWebView* webView, UIClientTest* test)
+    static void viewCloseCallback(WebKitWebView* webView, UIClientTest* test)
     {
-        g_assert(webView == test->m_webView);
-
-        GtkWidget* newWebView = webkit_web_view_new_with_context(webkit_web_view_get_context(webView));
-        g_object_ref_sink(newWebView);
-
-        test->m_webViewEvents.append(Create);
-
-        WebKitWindowProperties* windowProperties = webkit_web_view_get_window_properties(WEBKIT_WEB_VIEW(newWebView));
-        g_assert(windowProperties);
-        test->assertObjectIsDeletedWhenTestFinishes(G_OBJECT(windowProperties));
-        test->m_windowPropertiesChanged.clear();
-        g_signal_connect(windowProperties, "notify", G_CALLBACK(windowPropertiesNotifyCallback), test);
-
-        g_signal_connect(newWebView, "ready-to-show", G_CALLBACK(viewReadyToShow), test);
-        g_signal_connect(newWebView, "close", G_CALLBACK(viewClose), test);
-
-        return newWebView;
+        test->viewClose(webView);
     }
 
     void scriptAlert(WebKitScriptDialog* dialog)
@@ -300,7 +274,7 @@ public:
         , m_mouseTargetModifiers(0)
     {
         webkit_settings_set_javascript_can_open_windows_automatically(webkit_web_view_get_settings(m_webView), TRUE);
-        g_signal_connect(m_webView, "create", G_CALLBACK(viewCreate), this);
+        g_signal_connect(m_webView, "create", G_CALLBACK(viewCreateCallback), this);
         g_signal_connect(m_webView, "script-dialog", G_CALLBACK(scriptDialog), this);
         g_signal_connect(m_webView, "mouse-target-changed", G_CALLBACK(mouseTargetChanged), this);
         g_signal_connect(m_webView, "permission-request", G_CALLBACK(permissionRequested), this);
@@ -328,6 +302,48 @@ public:
         return m_mouseTargetHitTestResult.get();
     }
 
+    virtual GtkWidget* viewCreate(WebKitWebView* webView)
+    {
+        g_assert(webView == m_webView);
+
+        GtkWidget* newWebView = webkit_web_view_new_with_context(webkit_web_view_get_context(webView));
+        g_object_ref_sink(newWebView);
+
+        m_webViewEvents.append(Create);
+
+        WebKitWindowProperties* windowProperties = webkit_web_view_get_window_properties(WEBKIT_WEB_VIEW(newWebView));
+        g_assert(windowProperties);
+        assertObjectIsDeletedWhenTestFinishes(G_OBJECT(windowProperties));
+        m_windowPropertiesChanged.clear();
+
+        g_signal_connect(windowProperties, "notify", G_CALLBACK(windowPropertiesNotifyCallback), this);
+        g_signal_connect(newWebView, "ready-to-show", G_CALLBACK(viewReadyToShowCallback), this);
+        g_signal_connect(newWebView, "close", G_CALLBACK(viewCloseCallback), this);
+
+        return newWebView;
+    }
+
+    virtual void viewReadyToShow(WebKitWebView* webView)
+    {
+        g_assert(webView != m_webView);
+
+        WebKitWindowProperties* windowProperties = webkit_web_view_get_window_properties(webView);
+        g_assert(windowProperties);
+        WindowProperties(windowProperties).assertEqual(m_windowProperties);
+
+        m_webViewEvents.append(ReadyToShow);
+    }
+
+    virtual void viewClose(WebKitWebView* webView)
+    {
+        g_assert(webView != m_webView);
+
+        m_webViewEvents.append(Close);
+        g_object_unref(webView);
+
+        g_main_loop_quit(m_mainLoop);
+    }
+
     Vector<WebViewEvents> m_webViewEvents;
     WebKitScriptDialogType m_scriptDialogType;
     bool m_scriptDialogConfirmed;
@@ -358,6 +374,62 @@ static gboolean checkMimeTypeForFilter(GtkFileFilter* filter, const gchar* mimeT
     return gtk_file_filter_filter(filter, &filterInfo);
 }
 
+class ModalDialogsTest: public UIClientTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ModalDialogsTest);
+
+    static void dialogRunAsModalCallback(WebKitWebView* webView, ModalDialogsTest* test)
+    {
+        g_assert(webView != test->m_webView);
+        test->m_webViewEvents.append(RunAsModal);
+    }
+
+    GtkWidget* viewCreate(WebKitWebView* webView)
+    {
+        g_assert(webView == m_webView);
+
+        GtkWidget* newWebView = UIClientTest::viewCreate(webView);
+        g_signal_connect(newWebView, "run-as-modal", G_CALLBACK(dialogRunAsModalCallback), this);
+        return newWebView;
+    }
+
+    void viewReadyToShow(WebKitWebView* webView)
+    {
+        g_assert(webView != m_webView);
+        m_webViewEvents.append(ReadyToShow);
+    }
+};
+
+static void testWebViewAllowModalDialogs(ModalDialogsTest* test, gconstpointer)
+{
+    WebKitSettings* settings = webkit_web_view_get_settings(test->m_webView);
+    webkit_settings_set_allow_modal_dialogs(settings, TRUE);
+
+    test->loadHtml("<html><body onload=\"window.showModalDialog('data:text/html,<html><body/><script>window.close();</script></html>')\"></body></html>", 0);
+    test->waitUntilMainLoopFinishes();
+
+    Vector<UIClientTest::WebViewEvents>& events = test->m_webViewEvents;
+    g_assert_cmpint(events.size(), ==, 4);
+    g_assert_cmpint(events[0], ==, UIClientTest::Create);
+    g_assert_cmpint(events[1], ==, UIClientTest::ReadyToShow);
+    g_assert_cmpint(events[2], ==, UIClientTest::RunAsModal);
+    g_assert_cmpint(events[3], ==, UIClientTest::Close);
+}
+
+static void testWebViewDisallowModalDialogs(ModalDialogsTest* test, gconstpointer)
+{
+    WebKitSettings* settings = webkit_web_view_get_settings(test->m_webView);
+    webkit_settings_set_allow_modal_dialogs(settings, FALSE);
+
+    test->loadHtml("<html><body onload=\"window.showModalDialog('data:text/html,<html><body/><script>window.close();</script></html>')\"></body></html>", 0);
+    // We need to use a timeout here because the viewClose() function
+    // won't ever be called as the dialog won't be created.
+    test->wait(1);
+
+    Vector<UIClientTest::WebViewEvents>& events = test->m_webViewEvents;
+    g_assert_cmpint(events.size(), ==, 0);
+}
+
 static void testWebViewJavaScriptDialogs(UIClientTest* test, gconstpointer)
 {
     static const char* htmlOnLoadFormat = "<html><body onLoad=\"%s\"></body></html>";
@@ -483,6 +555,10 @@ static void testWebViewMouseTarget(UIClientTest* test, gconstpointer)
 
 static void testWebViewPermissionRequests(UIClientTest* test, gconstpointer)
 {
+    // Some versions of geoclue give a runtime warning because it tries
+    // to register the error quark twice. See https://bugs.webkit.org/show_bug.cgi?id=89858.
+    // Make warnings non-fatal for this test to make it pass.
+    test->removeLogFatalFlag(G_LOG_LEVEL_WARNING);
     test->showInWindowAndWaitUntilMapped();
     static const char* geolocationRequestHTML =
         "<html>"
@@ -515,6 +591,7 @@ static void testWebViewPermissionRequests(UIClientTest* test, gconstpointer)
     // Check that we did not get the PERMISSION_DENIED error now.
     result = webkit_web_view_get_title(test->m_webView);
     g_assert_cmpstr(result, !=, "1");
+    test->addLogFatalFlag(G_LOG_LEVEL_WARNING);
 }
 
 static void testWebViewZoomLevel(WebViewTest* test, gconstpointer)
@@ -795,6 +872,8 @@ void beforeAll()
     WebViewTest::add("WebKitWebView", "settings", testWebViewSettings);
     WebViewTest::add("WebKitWebView", "replace-content", testWebViewReplaceContent);
     UIClientTest::add("WebKitWebView", "create-ready-close", testWebViewCreateReadyClose);
+    ModalDialogsTest::add("WebKitWebView", "allow-modal-dialogs", testWebViewAllowModalDialogs);
+    ModalDialogsTest::add("WebKitWebView", "disallow-modal-dialogs", testWebViewDisallowModalDialogs);
     UIClientTest::add("WebKitWebView", "javascript-dialogs", testWebViewJavaScriptDialogs);
     UIClientTest::add("WebKitWebView", "window-properties", testWebViewWindowProperties);
     UIClientTest::add("WebKitWebView", "mouse-target", testWebViewMouseTarget);
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
index e355f786d..321b6a37a 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.cpp
@@ -43,12 +43,6 @@ WebViewTest::~WebViewTest()
     g_main_loop_unref(m_mainLoop);
 }
 
-static gboolean testLoadTimeoutFinishLoop(GMainLoop* loop)
-{
-    g_main_loop_quit(loop);
-    return FALSE;
-}
-
 void WebViewTest::loadURI(const char* uri)
 {
     m_activeURI = uri;
@@ -112,9 +106,27 @@ void WebViewTest::goToBackForwardListItem(WebKitBackForwardListItem* item)
     webkit_web_view_go_to_back_forward_list_item(m_webView, item);
 }
 
+void WebViewTest::quitMainLoop()
+{
+    g_main_loop_quit(m_mainLoop);
+}
+
+void WebViewTest::quitMainLoopAfterProcessingPendingEvents()
+{
+    while (gtk_events_pending())
+        gtk_main_iteration();
+    quitMainLoop();
+}
+
+static gboolean quitMainLoopIdleCallback(WebViewTest* test)
+{
+    test->quitMainLoop();
+    return FALSE;
+}
+
 void WebViewTest::wait(double seconds)
 {
-    g_timeout_add_seconds(seconds, reinterpret_cast<GSourceFunc>(testLoadTimeoutFinishLoop), m_mainLoop);
+    g_timeout_add_seconds(seconds, reinterpret_cast<GSourceFunc>(quitMainLoopIdleCallback), this);
     g_main_loop_run(m_mainLoop);
 }
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
index ff6a8c737..8e469f142 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/WebViewTest.h
@@ -40,6 +40,8 @@ public:
     void goForward();
     void goToBackForwardListItem(WebKitBackForwardListItem*);
 
+    void quitMainLoop();
+    void quitMainLoopAfterProcessingPendingEvents();
     void wait(double seconds);
     void waitUntilLoadFinished();
     void waitUntilTitleChangedTo(const char* expectedTitle);
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2.h b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
index bf37fcb73..58ac2b7e9 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2.h
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2.h
@@ -25,6 +25,9 @@
 
 #include <webkit2/WebKitBackForwardList.h>
 #include <webkit2/WebKitBackForwardListItem.h>
+#include <webkit2/WebKitContextMenu.h>
+#include <webkit2/WebKitContextMenuActions.h>
+#include <webkit2/WebKitContextMenuItem.h>
 #include <webkit2/WebKitCookieManager.h>
 #include <webkit2/WebKitDefines.h>
 #include <webkit2/WebKitDownload.h>
diff --git a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
index de3032819..e6c8a1016 100644
--- a/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
+++ b/Source/WebKit2/UIProcess/API/gtk/webkit2marshal.list
@@ -1,6 +1,7 @@
 BOOLEAN:BOXED
 BOOLEAN:ENUM,STRING,POINTER
 BOOLEAN:OBJECT
+BOOLEAN:OBJECT,BOXED,OBJECT
 BOOLEAN:OBJECT,ENUM
 BOOLEAN:STRING
 BOOLEAN:VOID
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
index ac074e8cc..8af6ff40c 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
@@ -94,6 +94,10 @@ private:
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*);
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& initialColor);
+#endif
+
     void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate);
 
     virtual void enterAcceleratedCompositingMode(const LayerTreeContext&);
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index 8d0913e52..3bd702078 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -360,6 +360,14 @@ PassRefPtr<WebContextMenuProxy> PageClientImpl::createContextMenuProxy(WebPagePr
     return WebContextMenuProxyMac::create(m_wkView, page);
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> PageClientImpl::createColorChooserProxy(WebPageProxy*, const WebCore::Color&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 void PageClientImpl::setFindIndicator(PassRefPtr<FindIndicator> findIndicator, bool fadeOut, bool animate)
 {
     [m_wkView _setFindIndicator:findIndicator fadeOut:fadeOut animate:animate];
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index c52da4df6..046d80339 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -266,6 +266,7 @@ QQuickWebViewPrivate::QQuickWebViewPrivate(QQuickWebView* viewport)
     , proxyAuthenticationDialog(0)
     , filePicker(0)
     , databaseQuotaDialog(0)
+    , colorChooser(0)
     , m_useDefaultContentItemSize(true)
     , m_navigatorQtObjectEnabled(false)
     , m_renderToOffscreenBuffer(false)
@@ -1146,6 +1147,22 @@ void QQuickWebViewExperimental::setDatabaseQuotaDialog(QQmlComponent* databaseQu
     emit databaseQuotaDialogChanged();
 }
 
+QQmlComponent* QQuickWebViewExperimental::colorChooser() const
+{
+    Q_D(const QQuickWebView);
+    return d->colorChooser;
+}
+
+void QQuickWebViewExperimental::setColorChooser(QQmlComponent* colorChooser)
+{
+    Q_D(QQuickWebView);
+    if (d->colorChooser == colorChooser)
+        return;
+
+    d->colorChooser = colorChooser;
+    emit colorChooserChanged();
+}
+
 QString QQuickWebViewExperimental::userAgent() const
 {
     Q_D(const QQuickWebView);
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
index b00e12e4b..e2c8c0dad 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
@@ -265,6 +265,7 @@ class QWEBKIT_EXPORT QQuickWebViewExperimental : public QObject {
     Q_PROPERTY(QQmlComponent* itemSelector READ itemSelector WRITE setItemSelector NOTIFY itemSelectorChanged)
     Q_PROPERTY(QQmlComponent* filePicker READ filePicker WRITE setFilePicker NOTIFY filePickerChanged)
     Q_PROPERTY(QQmlComponent* databaseQuotaDialog READ databaseQuotaDialog WRITE setDatabaseQuotaDialog NOTIFY databaseQuotaDialogChanged)
+    Q_PROPERTY(QQmlComponent* colorChooser READ colorChooser WRITE setColorChooser NOTIFY colorChooserChanged)
 
     Q_PROPERTY(QWebPreferences* preferences READ preferences CONSTANT FINAL)
     Q_PROPERTY(QWebKitTest* test READ test CONSTANT FINAL)
@@ -300,6 +301,8 @@ public:
     void setFilePicker(QQmlComponent*);
     QQmlComponent* databaseQuotaDialog() const;
     void setDatabaseQuotaDialog(QQmlComponent*);
+    QQmlComponent* colorChooser() const;
+    void setColorChooser(QQmlComponent*);
     QString userAgent() const;
     void setUserAgent(const QString& userAgent);
     int deviceWidth() const;
@@ -356,6 +359,7 @@ Q_SIGNALS:
     void itemSelectorChanged();
     void filePickerChanged();
     void databaseQuotaDialogChanged();
+    void colorChooserChanged();
     void downloadRequested(QWebDownloadItem* downloadItem);
     void permissionRequested(QWebPermissionRequest* permission);
     void messageReceived(const QVariantMap& message);
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
index c5535a3c8..f102f6030 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p_p.h
@@ -185,6 +185,7 @@ protected:
     QQmlComponent* proxyAuthenticationDialog;
     QQmlComponent* filePicker;
     QQmlComponent* databaseQuotaDialog;
+    QQmlComponent* colorChooser;
 
     QList<QUrl> userScripts;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml
new file mode 100644
index 000000000..366e7c00c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml
@@ -0,0 +1,94 @@
+import QtQuick 2.0
+import QtTest 1.0
+import QtWebKit 3.0
+import QtWebKit.experimental 1.0
+import "../common"
+
+TestWebView {
+    id: webView
+
+    width: 400
+    height: 400
+
+    property bool featureEnabled
+
+    property string selectedColor
+    property bool shouldReject
+    property bool shouldAcceptCurrent
+
+    experimental.colorChooser: Item {
+        Component.onCompleted: {
+            if (WebView.view.shouldReject)
+                model.reject()
+            else if (WebView.view.shouldAcceptCurrent)
+                model.accept(model.currentColor)
+            else
+                model.accept(WebView.view.selectedColor)
+        }
+    }
+
+    function openColorChooser() {
+        webView.experimental.test.touchTap(webView, 25, 25)
+    }
+
+    SignalSpy {
+        id: titleSpy
+        target: webView
+        signalName: "titleChanged"
+    }
+
+    TestCase {
+        id: test
+        name: "WebViewColorChooser"
+        when: windowShown
+
+        function init() {
+            webView.url = Qt.resolvedUrl("../common/colorChooser.html")
+            verify(webView.waitForLoadSucceeded())
+
+            webView.featureEnabled = (webView.title == "Feature enabled")
+
+            titleSpy.clear()
+
+            webView.shouldReject = false;
+            webView.shouldAcceptCurrent = false;
+        }
+
+        function test_accept() {
+            if (!webView.featureEnabled)
+                return
+
+            // The title changes here twice: first
+            // when we click, it changes from "Feature enabled"
+            // to the sanitized color and next, when we
+            // pick a new color with the chooser.
+            webView.selectedColor = "#020020"
+            openColorChooser()
+            titleSpy.wait()
+            compare(titleSpy.count, 2)
+            compare(webView.title, "#020020")
+        }
+
+        function test_currentValue() {
+            if (!webView.featureEnabled)
+                return
+
+            webView.shouldAcceptCurrent = true
+            openColorChooser()
+            titleSpy.wait()
+            compare(titleSpy.count, 1)
+            compare(webView.title, "#000000")
+        }
+
+        function test_reject() {
+            if (!webView.featureEnabled)
+                return
+
+            webView.shouldReject = true;
+            openColorChooser()
+            titleSpy.wait()
+            compare(titleSpy.count, 1)
+            compare(webView.title, "#000000")
+        }
+    }
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html
new file mode 100644
index 000000000..b04710ab9
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Feature disabled</title>
+<script>
+function detectInputTypeColorEnabled() {
+    var element = document.getElementById('test')
+    element.value = 'should sanitize';
+    if (element.value != 'should sanitize')
+        document.title = 'Feature enabled';
+}
+function updateTitle(element) {
+    document.title = element.value;
+}
+</script>
+</head>
+<body onload='detectInputTypeColorEnabled()'>
+<input id='test' type='color' onclick='updateTitle(this)' onchange='updateTitle(this)' style='width:50px; height:50px; position:"absolute"; top:0px; left:0px'>
+</html>
diff --git a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.cpp b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.cpp
index 7a0beb5de..cf4ee1305 100644
--- a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.cpp
+++ b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.cpp
@@ -82,9 +82,9 @@ void WebSocketServer::close()
     m_bindAddress = String();
 }
 
-void WebSocketServer::didAcceptConnection(PassRefPtr<SocketStreamHandle> socketHandle)
+void WebSocketServer::didAcceptConnection(PassOwnPtr<WebSocketServerConnection> connection)
 {
-    m_connections.append(adoptPtr(new WebSocketServerConnection(socketHandle, m_client, this)));
+    m_connections.append(connection);
 }
 
 void WebSocketServer::didCloseWebSocketServerConnection(WebSocketServerConnection* connection)
diff --git a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.h b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.h
index e5bd2fd40..56aa7fb26 100644
--- a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.h
+++ b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServer.h
@@ -61,7 +61,8 @@ public:
     ServerState serverState() const { return m_state; };
     void close();
 
-    void didAcceptConnection(PassRefPtr<WebCore::SocketStreamHandle>);
+    WebSocketServerClient* client() const { return m_client; }
+    void didAcceptConnection(PassOwnPtr<WebSocketServerConnection>);
 
 private:
     void didCloseWebSocketServerConnection(WebSocketServerConnection*);
diff --git a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.cpp b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.cpp
index 9ffbbbe36..57206eb7b 100644
--- a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.cpp
+++ b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.cpp
@@ -45,14 +45,12 @@ using namespace WebCore;
 
 namespace WebKit {
 
-WebSocketServerConnection::WebSocketServerConnection(PassRefPtr<SocketStreamHandle> socket, WebSocketServerClient* client, WebSocketServer* server)
+WebSocketServerConnection::WebSocketServerConnection(WebSocketServerClient* client, WebSocketServer* server)
     : m_identifier(0)
     , m_mode(HTTP)
-    , m_socket(socket)
     , m_server(server)
     , m_client(client)
 {
-    m_socket->setClient(this);
 }
 
 WebSocketServerConnection::~WebSocketServerConnection()
@@ -60,6 +58,12 @@ WebSocketServerConnection::~WebSocketServerConnection()
     shutdownNow();
 }
 
+void WebSocketServerConnection::setSocketHandle(PassRefPtr<WebCore::SocketStreamHandle> socket)
+{
+    ASSERT(!m_socket);
+    m_socket = socket;
+}
+
 void WebSocketServerConnection::shutdownNow()
 {
     if (!m_socket)
diff --git a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.h b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.h
index 6cc770137..64da82c8e 100644
--- a/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.h
+++ b/Source/WebKit2/UIProcess/InspectorServer/WebSocketServerConnection.h
@@ -49,11 +49,12 @@ class WebSocketServerClient;
 class WebSocketServerConnection : public WebCore::SocketStreamHandleClient {
 public:
     enum WebSocketServerMode { HTTP, WebSocket };
-    WebSocketServerConnection(PassRefPtr<WebCore::SocketStreamHandle>, WebSocketServerClient*, WebSocketServer*);
+    WebSocketServerConnection(WebSocketServerClient*, WebSocketServer*);
     virtual ~WebSocketServerConnection();
 
     unsigned identifier() const { return m_identifier; }
     void setIdentifier(unsigned id) { m_identifier = id; }
+    void setSocketHandle(PassRefPtr<WebCore::SocketStreamHandle>);
 
     // Sending data over the connection.
     void sendWebSocketMessage(const String& message);
diff --git a/Source/WebKit2/UIProcess/InspectorServer/qt/WebSocketServerQt.cpp b/Source/WebKit2/UIProcess/InspectorServer/qt/WebSocketServerQt.cpp
index 6a9c5b393..4503104a3 100644
--- a/Source/WebKit2/UIProcess/InspectorServer/qt/WebSocketServerQt.cpp
+++ b/Source/WebKit2/UIProcess/InspectorServer/qt/WebSocketServerQt.cpp
@@ -23,6 +23,7 @@
 #include "WebSocketServerQt.h"
 
 #include "WebSocketServer.h"
+#include "WebSocketServerConnection.h"
 #include <WebCore/SocketStreamHandle.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -55,7 +56,9 @@ void QtTcpServerHandler::handleNewConnection()
 {
     QTcpSocket* socket = m_serverSocket.nextPendingConnection();
     ASSERT(socket);
-    m_webSocketServer->didAcceptConnection(SocketStreamHandle::create(socket, 0));
+    OwnPtr<WebSocketServerConnection> conection = adoptPtr(new WebSocketServerConnection(m_webSocketServer->client(), m_webSocketServer));
+    conection->setSocketHandle(SocketStreamHandle::create(socket, conection.get()));
+    m_webSocketServer->didAcceptConnection(conection.release());
 }
 
 bool QtTcpServerHandler::listen(const String& bindAddress, unsigned short port)
diff --git a/Source/WebKit2/UIProcess/PageClient.h b/Source/WebKit2/UIProcess/PageClient.h
index 7401fd799..fc5d747c5 100644
--- a/Source/WebKit2/UIProcess/PageClient.h
+++ b/Source/WebKit2/UIProcess/PageClient.h
@@ -27,6 +27,7 @@
 #define PageClient_h
 
 #include "ShareableBitmap.h"
+#include "WebColorChooserProxy.h"
 #include "WebPageProxy.h"
 #include "WebPopupMenuProxy.h"
 #include <WebCore/AlternativeTextClient.h>
@@ -61,6 +62,9 @@ class WebGestureEvent;
 class WebContextMenuProxy;
 class WebEditCommandProxy;
 class WebPopupMenuProxy;
+#if ENABLE(INPUT_TYPE_COLOR)
+class WebColorChooserProxy;
+#endif
 
 #if PLATFORM(WIN)
 struct WindowGeometry;
@@ -169,6 +173,10 @@ public:
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*) = 0;
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*) = 0;
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& initialColor) = 0;
+#endif
+
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate) = 0;
 #if PLATFORM(WIN)
     virtual void didInstallOrUninstallPageOverlay(bool) = 0;
diff --git a/Source/WebKit2/UIProcess/WebColorChooserProxy.h b/Source/WebKit2/UIProcess/WebColorChooserProxy.h
new file mode 100644
index 000000000..7906c10fa
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebColorChooserProxy.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebColorChooserProxy_h
+#define WebColorChooserProxy_h
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class Color;
+}
+
+namespace WebKit {
+
+class WebPageProxy;
+
+class WebColorChooserProxy : public RefCounted<WebColorChooserProxy> {
+public:
+    class Client {
+    protected:
+        virtual ~Client() { }
+
+    public:
+        virtual void didChooseColor(const WebCore::Color&) = 0;
+        virtual void didEndColorChooser() = 0;
+    };
+    virtual ~WebColorChooserProxy() { }
+
+    void invalidate() { m_client = 0; }
+
+    virtual void endChooser() = 0;
+    virtual void setSelectedColor(const WebCore::Color&) = 0;
+
+protected:
+    WebColorChooserProxy(Client* client)
+        : m_client(client)
+    {
+    }
+
+    Client* m_client;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
+
+#endif // WebColorChooserProxy_h
diff --git a/Source/WebKit2/UIProcess/WebFrameProxy.cpp b/Source/WebKit2/UIProcess/WebFrameProxy.cpp
index f60fab040..f97d85bb6 100644
--- a/Source/WebKit2/UIProcess/WebFrameProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebFrameProxy.cpp
@@ -37,6 +37,10 @@
 #include <stdio.h>
 #include <wtf/text/WTFString.h>
 
+#if ENABLE(WEB_INTENTS)
+#include "WebIntentData.h"
+#endif
+
 using namespace WebCore;
 using namespace std;
 
@@ -94,6 +98,19 @@ void WebFrameProxy::stopLoading() const
 
     m_page->process()->send(Messages::WebPage::StopLoadingFrame(m_frameID), m_page->pageID());
 }
+
+#if ENABLE(WEB_INTENTS)
+void WebFrameProxy::deliverIntent(WebIntentData* webIntentData)
+{
+    if (!m_page)
+        return;
+
+    if (!m_page->isValid())
+        return;
+
+    m_page->process()->send(Messages::WebPage::DeliverIntentToFrame(m_frameID, webIntentData->store()), m_page->pageID());
+}
+#endif
     
 bool WebFrameProxy::canProvideSource() const
 {
diff --git a/Source/WebKit2/UIProcess/WebFrameProxy.h b/Source/WebKit2/UIProcess/WebFrameProxy.h
index de5a58cb7..1f7329b39 100644
--- a/Source/WebKit2/UIProcess/WebFrameProxy.h
+++ b/Source/WebKit2/UIProcess/WebFrameProxy.h
@@ -50,6 +50,10 @@ class WebFormSubmissionListenerProxy;
 class WebFramePolicyListenerProxy;
 class WebPageProxy;
 
+#if ENABLE(WEB_INTENTS)
+class WebIntentData;
+#endif
+
 typedef GenericCallback<WKDataRef> DataCallback;
 
 class WebFrameProxy : public APIObject {
@@ -86,6 +90,10 @@ public:
     bool isFrameSet() const { return m_isFrameSet; }
 
     LoadState loadState() const { return m_loadState; }
+
+#if ENABLE(WEB_INTENTS)
+    void deliverIntent(WebIntentData*);
+#endif
     
     void stopLoading() const;
 
diff --git a/Source/WebKit2/UIProcess/WebIntentData.cpp b/Source/WebKit2/UIProcess/WebIntentData.cpp
index 37695a4fe..96128dbe2 100644
--- a/Source/WebKit2/UIProcess/WebIntentData.cpp
+++ b/Source/WebKit2/UIProcess/WebIntentData.cpp
@@ -28,6 +28,11 @@
 
 #if ENABLE(WEB_INTENTS)
 
+#include "ImmutableArray.h"
+#include "ImmutableDictionary.h"
+#include "WebString.h"
+#include "WebURL.h"
+
 namespace WebKit {
 
 WebIntentData::WebIntentData(const IntentData& store)
@@ -41,6 +46,29 @@ PassRefPtr<WebSerializedScriptValue> WebIntentData::data() const
     return WebSerializedScriptValue::adopt(dataCopy);
 }
 
+PassRefPtr<ImmutableArray> WebIntentData::suggestions() const
+{
+    const size_t numSuggestions = m_store.suggestions.size();
+    Vector<RefPtr<APIObject> > wkSuggestions(numSuggestions);
+    for (unsigned i = 0; i < numSuggestions; ++i)
+        wkSuggestions[i] = WebURL::create(m_store.suggestions[i]);
+    return ImmutableArray::adopt(wkSuggestions);
+}
+
+String WebIntentData::extra(const String& key) const
+{
+    return m_store.extras.get(key);
+}
+
+PassRefPtr<ImmutableDictionary> WebIntentData::extras() const
+{
+    ImmutableDictionary::MapType wkExtras;
+    HashMap<String, String>::const_iterator end = m_store.extras.end();
+    for (HashMap<String, String>::const_iterator it = m_store.extras.begin(); it != end; ++it)
+        wkExtras.set(it->first, WebString::create(it->second));
+    return ImmutableDictionary::adopt(wkExtras);
+}
+
 } // namespace WebKit
 
 #endif // ENABLE(WEB_INTENTS)
diff --git a/Source/WebKit2/UIProcess/WebIntentData.h b/Source/WebKit2/UIProcess/WebIntentData.h
index 3caef5094..decf4ae4f 100644
--- a/Source/WebKit2/UIProcess/WebIntentData.h
+++ b/Source/WebKit2/UIProcess/WebIntentData.h
@@ -50,8 +50,11 @@ public:
     const String& payloadType() const { return m_store.type; }
     const WebCore::KURL& service() const { return m_store.service; }
     PassRefPtr<WebSerializedScriptValue> data() const;
-    const HashMap<String, String>& extras() const { return m_store.extras; }
-    const Vector<WebCore::KURL>& suggestions() const { return m_store.suggestions; }
+    String extra(const String& key) const;
+    PassRefPtr<ImmutableDictionary> extras() const;
+    PassRefPtr<ImmutableArray> suggestions() const;
+
+    const IntentData& store() const { return m_store; }
 
 private:
     WebIntentData(const IntentData&);
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
index c3e573923..3850e53ca 100644
--- a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
+++ b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
@@ -142,7 +142,7 @@ void WebLayerTreeRenderer::paintToCurrentGLContext(const TransformationMatrix& m
     m_textureMapper->endPainting();
 }
 
-void WebLayerTreeRenderer::paintToGraphicsContext(QPainter* painter)
+void WebLayerTreeRenderer::paintToGraphicsContext(BackingStore::PlatformGraphicsContext painter)
 {
     if (!m_textureMapper)
         m_textureMapper = TextureMapper::create();
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 16d4a981d..627ee5207 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -186,6 +187,7 @@ WebPageProxy::WebPageProxy(PageClient* pageClient, PassRefPtr<WebProcessProxy> p
     , m_gapBetweenPages(0)
     , m_isValid(true)
     , m_isClosed(false)
+    , m_canRunModal(false)
     , m_isInPrintingMode(false)
     , m_isPerformingDOMPrintOperation(false)
     , m_inDecidePolicyForResponse(false)
@@ -304,7 +306,7 @@ void WebPageProxy::initializeUIClient(const WKPageUIClient* client)
     m_uiClient.initialize(client);
 
     process()->send(Messages::WebPage::SetCanRunBeforeUnloadConfirmPanel(m_uiClient.canRunBeforeUnloadConfirmPanel()), m_pageID);
-    process()->send(Messages::WebPage::SetCanRunModal(m_uiClient.canRunModal()), m_pageID);
+    setCanRunModal(m_uiClient.canRunModal());
 }
 
 void WebPageProxy::initializeFindClient(const WKPageFindClient* client)
@@ -403,6 +405,13 @@ void WebPageProxy::close()
         m_openPanelResultListener = 0;
     }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    if (m_colorChooser) {
+        m_colorChooser->invalidate();
+        m_colorChooser = nullptr;
+    }
+#endif
+
 #if ENABLE(GEOLOCATION)
     m_geolocationPermissionRequestManager.invalidateRequests();
 #endif
@@ -1126,7 +1135,7 @@ void WebPageProxy::handleKeyboardEvent(const NativeWebKeyboardEvent& event)
     if (m_shouldSendEventsSynchronously) {
         bool handled = false;
         process()->sendSync(Messages::WebPage::KeyEventSyncForTesting(event), Messages::WebPage::KeyEventSyncForTesting::Reply(handled), m_pageID);
-        didReceiveEvent(event.type(), handled);
+        didReceiveKeyEvent(event.type(), handled);
     } else
         process()->send(Messages::WebPage::KeyEvent(event), m_pageID);
 }
@@ -2641,6 +2650,50 @@ void WebPageProxy::needTouchEvents(bool needTouchEvents)
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_COLOR)
+void WebPageProxy::showColorChooser(const WebCore::Color& initialColor)
+{
+    ASSERT(!m_colorChooser);
+
+    m_colorChooser = m_pageClient->createColorChooserProxy(this, initialColor);
+}
+
+void WebPageProxy::setColorChooserColor(const WebCore::Color& color)
+{
+    ASSERT(m_colorChooser);
+
+    m_colorChooser->setSelectedColor(color);
+}
+
+void WebPageProxy::endColorChooser()
+{
+    ASSERT(m_colorChooser);
+
+    m_colorChooser->endChooser();
+}
+
+void WebPageProxy::didChooseColor(const WebCore::Color& color)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::DidChooseColor(color), m_pageID);
+}
+
+void WebPageProxy::didEndColorChooser()
+{
+    if (!isValid())
+        return;
+
+    ASSERT(m_colorChooser);
+
+    m_colorChooser->invalidate();
+    m_colorChooser = nullptr;
+
+    process()->send(Messages::WebPage::DidEndColorChooser(), m_pageID);
+}
+#endif
+
 void WebPageProxy::didDraw()
 {
     m_uiClient.didDraw(this);
@@ -3096,6 +3149,42 @@ void WebPageProxy::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
     m_pageClient->setCursorHiddenUntilMouseMoves(hiddenUntilMouseMoves);
 }
 
+void WebPageProxy::didReceiveKeyEvent(uint32_t opaqueType, bool handled)
+{
+    process()->responsivenessTimer()->stop();
+
+    WebEvent::Type type = static_cast<WebEvent::Type>(opaqueType);
+
+    switch (type) {
+    case WebEvent::KeyDown:
+    case WebEvent::KeyUp:
+    case WebEvent::RawKeyDown:
+    case WebEvent::Char: {
+        LOG(KeyHandling, "WebPageProxy::didReceiveKeyEvent: %s", webKeyboardEventTypeString(type));
+
+        NativeWebKeyboardEvent event = m_keyEventQueue.first();
+        MESSAGE_CHECK(type == event.type());
+
+        m_keyEventQueue.removeFirst();
+
+        m_pageClient->doneWithKeyEvent(event, handled);
+
+        if (handled)
+            break;
+
+        if (m_uiClient.implementsDidNotHandleKeyEvent())
+            m_uiClient.didNotHandleKeyEvent(this, event);
+#if PLATFORM(WIN)
+        else
+            ::TranslateMessage(event.nativeEvent());
+#endif
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
 void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
 {
     WebEvent::Type type = static_cast<WebEvent::Type>(opaqueType);
@@ -3108,10 +3197,6 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
     case WebEvent::MouseDown:
     case WebEvent::MouseUp:
     case WebEvent::Wheel:
-    case WebEvent::KeyDown:
-    case WebEvent::KeyUp:
-    case WebEvent::RawKeyDown:
-    case WebEvent::Char:
 #if ENABLE(GESTURE_EVENTS)
     case WebEvent::GestureScrollBegin:
     case WebEvent::GestureScrollEnd:
@@ -3125,6 +3210,8 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
 #endif
         process()->responsivenessTimer()->stop();
         break;
+    default:
+        ASSERT_NOT_REACHED();
     }
 
     switch (type) {
@@ -3169,30 +3256,6 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         break;
     }
 
-    case WebEvent::KeyDown:
-    case WebEvent::KeyUp:
-    case WebEvent::RawKeyDown:
-    case WebEvent::Char: {
-        LOG(KeyHandling, "WebPageProxy::didReceiveEvent: %s", webKeyboardEventTypeString(type));
-
-        NativeWebKeyboardEvent event = m_keyEventQueue.first();
-        MESSAGE_CHECK(type == event.type());
-
-        m_keyEventQueue.removeFirst();
-
-        m_pageClient->doneWithKeyEvent(event, handled);
-
-        if (handled)
-            break;
-
-        if (m_uiClient.implementsDidNotHandleKeyEvent())
-            m_uiClient.didNotHandleKeyEvent(this, event);
-#if PLATFORM(WIN)
-        else
-            ::TranslateMessage(event.nativeEvent());
-#endif
-        break;
-    }
 #if ENABLE(TOUCH_EVENTS)
     case WebEvent::TouchStart:
     case WebEvent::TouchMove:
@@ -3210,6 +3273,8 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         break;
     }
 #endif
+    default:
+        ASSERT_NOT_REACHED();
     }
 }
 
@@ -3393,6 +3458,13 @@ void WebPageProxy::processDidCrash()
         m_openPanelResultListener = nullptr;
     }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    if (m_colorChooser) {
+        m_colorChooser->invalidate();
+        m_colorChooser = nullptr;
+    }
+#endif
+
 #if ENABLE(GEOLOCATION)
     m_geolocationPermissionRequestManager.invalidateRequests();
 #endif
@@ -3491,7 +3563,7 @@ WebPageCreationParameters WebPageProxy::creationParameters() const
     parameters.sessionState = SessionState(m_backForwardList->entries(), m_backForwardList->currentIndex());
     parameters.highestUsedBackForwardItemID = WebBackForwardListItem::highedUsedItemID();
     parameters.canRunBeforeUnloadConfirmPanel = m_uiClient.canRunBeforeUnloadConfirmPanel();
-    parameters.canRunModal = m_uiClient.canRunModal();
+    parameters.canRunModal = m_canRunModal;
     parameters.deviceScaleFactor = m_intrinsicDeviceScaleFactor;
     parameters.mediaVolume = m_mediaVolume;
 
@@ -3622,6 +3694,12 @@ void WebPageProxy::runModal()
     // Since runModal() can (and probably will) spin a nested run loop we need to turn off the responsiveness timer.
     process()->responsivenessTimer()->stop();
 
+    // Our Connection's run loop might have more messages waiting to be handled after this RunModal message.
+    // To make sure they are handled inside of the the nested modal run loop we must first signal the Connection's
+    // run loop so we're guaranteed that it has a chance to wake up.
+    // See http://webkit.org/b/89590 for more discussion.
+    process()->connection()->wakeUpRunLoop();
+
     m_uiClient.runModal(this);
 }
 
@@ -3692,6 +3770,23 @@ void WebPageProxy::backForwardRemovedItem(uint64_t itemID)
     process()->send(Messages::WebPage::DidRemoveBackForwardItem(itemID), m_pageID);
 }
 
+void WebPageProxy::setCanRunModal(bool canRunModal)
+{
+    if (!isValid())
+        return;
+
+    // It's only possible to change the state for a WebPage which
+    // already qualifies for running modal child web pages, otherwise
+    // there's no other possibility than not allowing it.
+    m_canRunModal = m_uiClient.canRunModal() && canRunModal;
+    process()->send(Messages::WebPage::SetCanRunModal(m_canRunModal), m_pageID);
+}
+
+bool WebPageProxy::canRunModal()
+{
+    return isValid() ? m_canRunModal : false;
+}
+
 void WebPageProxy::beginPrinting(WebFrameProxy* frame, const PrintInfo& printInfo)
 {
     if (m_isInPrintingMode)
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index 599bcc47f..ed99d0d80 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -45,6 +45,7 @@
 #include "ShareableBitmap.h"
 #include "WKBase.h"
 #include "WKPagePrivate.h"
+#include "WebColorChooserProxy.h"
 #include "WebContextMenuItemData.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebFindClient.h"
@@ -59,6 +60,7 @@
 #include "WebResourceLoadClient.h"
 #include "WebUIClient.h"
 #include <WebCore/AlternativeTextClient.h>
+#include <WebCore/Color.h>
 #include <WebCore/DragActions.h>
 #include <WebCore/DragSession.h>
 #include <WebCore/HitTestResult.h>
@@ -231,7 +233,12 @@ private:
     CallbackFunction m_callback;
 };
 
-class WebPageProxy : public APIObject, public WebPopupMenuProxy::Client {
+class WebPageProxy
+    : public APIObject
+#if ENABLE(INPUT_TYPE_COLOR)
+    , public WebColorChooserProxy::Client
+#endif
+    , public WebPopupMenuProxy::Client {
 public:
     static const Type APIType = TypePage;
 
@@ -637,6 +644,9 @@ public:
     String accessibilityPlugID() const { return m_accessibilityPlugID; }
 #endif
 
+    void setCanRunModal(bool);
+    bool canRunModal();
+
     void beginPrinting(WebFrameProxy*, const PrintInfo&);
     void endPrinting();
     void computePagesForPrinting(WebFrameProxy*, const PrintInfo&, PassRefPtr<ComputedPagesCallback>);
@@ -810,6 +820,14 @@ private:
     void needTouchEvents(bool);
 #endif
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    void showColorChooser(const WebCore::Color& initialColor);
+    void setColorChooserColor(const WebCore::Color&);
+    void endColorChooser();
+    void didChooseColor(const WebCore::Color&);
+    void didEndColorChooser();
+#endif
+
     void editorStateChanged(const EditorState&);
 
     // Back/Forward list management
@@ -891,6 +909,7 @@ private:
     void setCursorHiddenUntilMouseMoves(bool);
 
     void didReceiveEvent(uint32_t opaqueType, bool handled);
+    void didReceiveKeyEvent(uint32_t opaqueType, bool handled);
     void stopResponsivenessTimer();
 
     void voidCallback(uint64_t);
@@ -1061,6 +1080,9 @@ private:
     // Whether WebPageProxy::close() has been called on this page.
     bool m_isClosed;
 
+    // Whether it can run modal child web pages.
+    bool m_canRunModal;
+
     bool m_isInPrintingMode;
     bool m_isPerformingDOMPrintOperation;
 
@@ -1089,6 +1111,9 @@ private:
     bool m_needTouchEvents;
     Deque<QueuedTouchEvents> m_touchEventQueue;
 #endif
+#if ENABLE(INPUT_TYPE_COLOR)
+    RefPtr<WebColorChooserProxy> m_colorChooser;
+#endif
 
     uint64_t m_pageID;
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 06b372f08..a098ea66d 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -33,6 +33,7 @@ messages -> WebPageProxy {
     UnavailablePluginButtonClicked(uint32_t pluginUnavailabilityReason, WTF::String mimeType, WTF::String url, WTF::String pluginsPageURL)
     DidChangeViewportProperties(WebCore::ViewportAttributes attributes)
     DidReceiveEvent(uint32_t type, bool handled)
+    DidReceiveKeyEvent(uint32_t type, bool handled) -> ()
     StopResponsivenessTimer()
     SetCursor(WebCore::Cursor cursor)
     SetCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
@@ -83,6 +84,12 @@ messages -> WebPageProxy {
     NeedTouchEvents(bool needTouchEvents)
 #endif
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    ShowColorChooser(WebCore::Color initialColor);
+    SetColorChooserColor(WebCore::Color color);
+    EndColorChooser();
+#endif
+
     # Policy messages
     DecidePolicyForResponse(uint64_t frameID, WebCore::ResourceResponse response, WebCore::ResourceRequest request, uint64_t listenerID, WebKit::InjectedBundleUserMessageEncoder userData) -> (bool receivedPolicyAction, uint64_t policyAction, uint64_t downloadID)
     DecidePolicyForNavigationAction(uint64_t frameID, uint32_t navigationType, uint32_t modifiers, int32_t mouseButton, WebCore::ResourceRequest request, uint64_t listenerID, WebKit::InjectedBundleUserMessageEncoder userData) -> (bool receivedPolicyAction, uint64_t policyAction, uint64_t downloadID)
diff --git a/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.cpp
index d80f24ce7..236ffca05 100644
--- a/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.cpp
@@ -92,6 +92,7 @@ void WebContextMenuProxyGtk::showContextMenu(const WebCore::IntPoint& position,
     // Display menu initiated by right click (mouse button pressed = 3).
     NativeWebMouseEvent* mouseEvent = m_page->currentlyProcessedMouseDownEvent();
     const GdkEvent* event = mouseEvent ? mouseEvent->nativeEvent() : 0;
+    gtk_menu_attach_to_widget(m_menu.platformDescription(), GTK_WIDGET(m_webView), 0);
     gtk_menu_popup(m_menu.platformDescription(), 0, 0, reinterpret_cast<GtkMenuPositionFunc>(menuPositionFunction), this,
                    event ? event->button.button : 3, event ? event->button.time : GDK_CURRENT_TIME);
 }
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
index 8e9ab2efd..82d63845d 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
@@ -26,6 +26,9 @@
 #include "QtWebPageEventHandler.h"
 #include "QtWebUndoController.h"
 #include "ShareableBitmap.h"
+#if ENABLE(INPUT_TYPE_COLOR)
+#include "WebColorChooserProxyQt.h"
+#endif
 #include "WebContextMenuProxyQt.h"
 #include "WebEditCommandProxy.h"
 #include "WebPopupMenuProxyQt.h"
@@ -205,6 +208,13 @@ PassRefPtr<WebContextMenuProxy> QtPageClient::createContextMenuProxy(WebPageProx
     return WebContextMenuProxyQt::create(webPageProxy);
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> QtPageClient::createColorChooserProxy(WebPageProxy* webPageProxy, const WebCore::Color& initialColor)
+{
+    return WebColorChooserProxyQt::create(webPageProxy, m_webView, initialColor);
+}
+#endif
+
 void QtPageClient::flashBackingStoreUpdates(const Vector<IntRect>&)
 {
     notImplemented();
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.h b/Source/WebKit2/UIProcess/qt/QtPageClient.h
index e33dadf61..5c69ac879 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.h
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.h
@@ -86,6 +86,9 @@ public:
     virtual void doneWithKeyEvent(const NativeWebKeyboardEvent&, bool wasEventHandled) { }
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*);
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& intialColor);
+#endif
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate) { }
     virtual void didCommitLoadForMainFrame(bool useCustomRepresentation) { }
     virtual void didFinishLoadingDataForCustomRepresentation(const String& suggestedFilename, const CoreIPC::DataReference&) { }
diff --git a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp
new file mode 100644
index 000000000..e46da326d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "WebColorChooserProxyQt.h"
+
+#include "qquickwebview_p.h"
+#include "qquickwebview_p_p.h"
+#include <QtQml/QQmlContext>
+#include <QtQml/QQmlEngine>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class ColorChooserContextObject : public QObject {
+    Q_OBJECT
+    Q_PROPERTY(QColor currentColor READ currentColor CONSTANT FINAL)
+
+public:
+    ColorChooserContextObject(const QColor& color)
+        : m_currentColor(color)
+    {
+    }
+
+    QColor currentColor() const { return m_currentColor; }
+
+    Q_INVOKABLE void accept(const QColor& color) { emit accepted(color); };
+    Q_INVOKABLE void reject() { emit rejected(); }
+
+Q_SIGNALS:
+    void accepted(const QColor&);
+    void rejected();
+
+private:
+    QColor m_currentColor;
+};
+
+WebColorChooserProxyQt::WebColorChooserProxyQt(WebColorChooserProxy::Client* client, QQuickWebView* webView, const Color& initialColor)
+    : WebColorChooserProxy(client)
+    , m_webView(webView)
+{
+    ColorChooserContextObject* contextObject = new ColorChooserContextObject(initialColor);
+    createItem(contextObject);
+}
+
+WebColorChooserProxyQt::~WebColorChooserProxyQt()
+{
+}
+
+void WebColorChooserProxyQt::createItem(QObject* contextObject)
+{
+    QQmlComponent* component = m_webView->experimental()->colorChooser();
+    if (!component) {
+        delete contextObject;
+        return;
+    }
+
+    createContext(component, contextObject);
+    QObject* object = component->beginCreate(m_context.get());
+    if (!object) {
+        m_context.clear();
+        return;
+    }
+
+    m_colorChooser = adoptPtr(qobject_cast<QQuickItem*>(object));
+    if (!m_colorChooser) {
+        m_context.clear();
+        return;
+    }
+
+    // Needs to be enqueue because it might trigger deletion.
+    connect(contextObject, SIGNAL(accepted(QColor)), SLOT(notifyColorSelected(QColor)), Qt::QueuedConnection);
+    connect(contextObject, SIGNAL(rejected()), SLOT(endChooser()), Qt::QueuedConnection);
+
+    QQuickWebViewPrivate::get(m_webView)->addAttachedPropertyTo(m_colorChooser.get());
+    m_colorChooser->setParentItem(m_webView);
+
+    component->completeCreate();
+    QQuickWebViewPrivate::get(m_webView)->setDialogActive(true);
+}
+
+void WebColorChooserProxyQt::createContext(QQmlComponent* component, QObject* contextObject)
+{
+    QQmlContext* baseContext = component->creationContext();
+    if (!baseContext)
+        baseContext = QQmlEngine::contextForObject(m_webView);
+    m_context = adoptPtr(new QQmlContext(baseContext));
+
+    contextObject->setParent(m_context.get());
+    m_context->setContextProperty(QLatin1String("model"), contextObject);
+    m_context->setContextObject(contextObject);
+}
+
+void WebColorChooserProxyQt::setSelectedColor(const Color&)
+{
+    // This is suppose to be used to react to DOM changes. When
+    // a user script changes the input value, the method gives the
+    // option to update the color chooser UI if we were showing the
+    // current value. Since we don't, it is irrelevant right now.
+    // And yes, the name sounds misleading but comes from WebCore.
+}
+
+void WebColorChooserProxyQt::notifyColorSelected(const QColor& color)
+{
+    if (!m_client)
+        return;
+
+    // Alpha is always ignored by the color input
+    Color coreColor = makeRGB(color.red(), color.green(), color.blue());
+    m_client->didChooseColor(coreColor);
+
+    endChooser();
+}
+
+void WebColorChooserProxyQt::endChooser()
+{
+    QQuickWebViewPrivate::get(m_webView)->setDialogActive(false);
+
+    m_colorChooser.clear();
+    m_context.clear();
+
+    if (!m_client)
+        return;
+
+    m_client->didEndColorChooser();
+}
+
+} // namespace WebKit
+
+#include "WebColorChooserProxyQt.moc"
+#include "moc_WebColorChooserProxyQt.cpp"
diff --git a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h
new file mode 100644
index 000000000..75a74a2f6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef WebColorChooserProxyQt_h
+#define WebColorChooserProxyQt_h
+
+#include "WebColorChooserProxy.h"
+#include <QtCore/QObject>
+#include <wtf/OwnPtr.h>
+
+class QQmlComponent;
+class QQmlContext;
+class QQuickItem;
+class QQuickWebView;
+
+namespace WebCore {
+class Color;
+}
+
+namespace WebKit {
+
+class WebColorChooserProxyQt : public QObject, public WebColorChooserProxy {
+    Q_OBJECT
+
+public:
+    static PassRefPtr<WebColorChooserProxy> create(WebColorChooserProxy::Client* client, QQuickWebView* webView, const WebCore::Color& initialColor)
+    {
+        return adoptRef(new WebColorChooserProxyQt(client, webView, initialColor));
+    }
+    ~WebColorChooserProxyQt();
+
+    virtual void setSelectedColor(const WebCore::Color&);
+
+public Q_SLOTS:
+    virtual void endChooser();
+
+private Q_SLOTS:
+    void notifyColorSelected(const QColor&);
+
+private:
+    WebColorChooserProxyQt(WebColorChooserProxy::Client*, QQuickWebView*, const WebCore::Color&);
+
+    void createItem(QObject*);
+    void createContext(QQmlComponent*, QObject*);
+
+    OwnPtr<QQmlContext> m_context;
+    OwnPtr<QQuickItem> m_colorChooser;
+
+    QQuickWebView* m_webView;
+};
+
+} // namespace WebKit
+
+#endif // WebColorChooserProxyQt_h
diff --git a/Source/WebKit2/UIProcess/win/WebView.cpp b/Source/WebKit2/UIProcess/win/WebView.cpp
index f6e75d68a..28d26f1f3 100644
--- a/Source/WebKit2/UIProcess/win/WebView.cpp
+++ b/Source/WebKit2/UIProcess/win/WebView.cpp
@@ -1429,6 +1429,14 @@ PassRefPtr<WebContextMenuProxy> WebView::createContextMenuProxy(WebPageProxy* pa
     return WebContextMenuProxyWin::create(m_window, page);
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebColorChooserProxy> WebView::createColorChooserProxy(WebPageProxy*, const WebCore::Color&)
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
 void WebView::setFindIndicator(PassRefPtr<FindIndicator> prpFindIndicator, bool fadeOut, bool animate)
 {
     UNUSED_PARAM(animate);
diff --git a/Source/WebKit2/UIProcess/win/WebView.h b/Source/WebKit2/UIProcess/win/WebView.h
index dba1593f1..71a9e578f 100644
--- a/Source/WebKit2/UIProcess/win/WebView.h
+++ b/Source/WebKit2/UIProcess/win/WebView.h
@@ -198,6 +198,9 @@ private:
     virtual void compositionSelectionChanged(bool);
     virtual PassRefPtr<WebPopupMenuProxy> createPopupMenuProxy(WebPageProxy*);
     virtual PassRefPtr<WebContextMenuProxy> createContextMenuProxy(WebPageProxy*);
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebColorChooserProxy> createColorChooserProxy(WebPageProxy*, const WebCore::Color& intialColor);
+#endif
     virtual void setFindIndicator(PassRefPtr<FindIndicator>, bool fadeOut, bool animate);
     virtual void didInstallOrUninstallPageOverlay(bool);
 
diff --git a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
index 3f98e9b48..6077f6d3e 100644
--- a/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
+++ b/Source/WebKit2/WebKit2.xcodeproj/project.pbxproj
@@ -324,6 +324,9 @@
 		37C4E9F6131C6E7E0029BD5A /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = B396EA5512E0ED2D00F4FEB7 /* config.h */; };
 		37F623B812A57B6200E3FDF6 /* WKFindOptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F623B712A57B6200E3FDF6 /* WKFindOptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F90DE31376560E0051CF68 /* HTTPCookieAcceptPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = F638954F133BEF38008941D5 /* HTTPCookieAcceptPolicy.h */; };
+		3F87B9BD158940120090FF62 /* WebColorChooser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3F87B9BA15893F630090FF62 /* WebColorChooser.cpp */; };
+		3F87B9BE158940190090FF62 /* WebColorChooser.h in Headers */ = {isa = PBXBuildFile; fileRef = 3F87B9BB15893F630090FF62 /* WebColorChooser.h */; };
+		3F87B9C0158940D80090FF62 /* WebColorChooserProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 3F87B9BF158940D80090FF62 /* WebColorChooserProxy.h */; };
 		4F601432155C5AA2001FBDE0 /* BlockingResponseMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F601430155C5A32001FBDE0 /* BlockingResponseMap.h */; };
 		51021E9C12B16788005C033C /* WebContextMenuClientMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51021E9B12B16788005C033C /* WebContextMenuClientMac.mm */; };
 		510FBB9A1288C95E00AFFDF4 /* WebContextMenuItemData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510FBB981288C95E00AFFDF4 /* WebContextMenuItemData.cpp */; };
@@ -1343,6 +1346,9 @@
 		37948406150C4B9600E52CE9 /* WKRenderLayer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKRenderLayer.cpp; sourceTree = "<group>"; };
 		37948407150C4B9600E52CE9 /* WKRenderLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKRenderLayer.h; sourceTree = "<group>"; };
 		37F623B712A57B6200E3FDF6 /* WKFindOptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WKFindOptions.h; sourceTree = "<group>"; };
+		3F87B9BA15893F630090FF62 /* WebColorChooser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebColorChooser.cpp; sourceTree = "<group>"; };
+		3F87B9BB15893F630090FF62 /* WebColorChooser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebColorChooser.h; sourceTree = "<group>"; };
+		3F87B9BF158940D80090FF62 /* WebColorChooserProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebColorChooserProxy.h; sourceTree = "<group>"; };
 		4F601430155C5A32001FBDE0 /* BlockingResponseMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BlockingResponseMap.h; sourceTree = "<group>"; };
 		510031F61379CACB00C8DFE4 /* WebProcessShim.dylib */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = WebProcessShim.dylib; sourceTree = BUILT_PRODUCTS_DIR; };
 		51021E9B12B16788005C033C /* WebContextMenuClientMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebContextMenuClientMac.mm; sourceTree = "<group>"; };
@@ -2772,6 +2778,8 @@
 				CEDA12DE152CCAE800D9E08D /* WebAlternativeTextClient.h */,
 				BC111A53112F4FBB00337BAB /* WebChromeClient.cpp */,
 				BC032D6010F4378D0058C15A /* WebChromeClient.h */,
+				3F87B9BA15893F630090FF62 /* WebColorChooser.cpp */,
+				3F87B9BB15893F630090FF62 /* WebColorChooser.h */,
 				BC111A54112F4FBB00337BAB /* WebContextMenuClient.cpp */,
 				BC032D6210F4378D0058C15A /* WebContextMenuClient.h */,
 				F6A25FDA12ADC6CC00DC40CC /* WebDatabaseManager.cpp */,
@@ -2884,6 +2892,7 @@
 				512E35F0130B638C00ABD19A /* WebApplicationCacheManagerProxy.messages.in */,
 				BC72BA1B11E64907001EB4EA /* WebBackForwardList.cpp */,
 				BC72BA1C11E64907001EB4EA /* WebBackForwardList.h */,
+				3F87B9BF158940D80090FF62 /* WebColorChooserProxy.h */,
 				BC4A62A514744EC6006C681A /* WebConnectionToWebProcess.cpp */,
 				BC4A62A614744EC6006C681A /* WebConnectionToWebProcess.h */,
 				BCB9E2421120DACA00A137E0 /* WebContext.cpp */,
@@ -4191,6 +4200,8 @@
 				CEDA12E3152CD1B300D9E08D /* WebAlternativeTextClient.h in Headers */,
 				E19582D3153CBFD700B60875 /* PDFKitImports.h in Headers */,
 				51EFC1CF1524E62500C9A938 /* WKBundleDOMWindowExtension.h in Headers */,
+				3F87B9BE158940190090FF62 /* WebColorChooser.h in Headers */,
+				3F87B9C0158940D80090FF62 /* WebColorChooserProxy.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -4939,6 +4950,7 @@
 				51FA2D7415212DF100C1BA0B /* InjectedBundleDOMWindowExtension.cpp in Sources */,
 				51FA2D7715212E2600C1BA0B /* WKBundleDOMWindowExtension.cpp in Sources */,
 				1A2A4B0E1586A2240090C9E9 /* ColorSpaceData.mm in Sources */,
+				3F87B9BD158940120090FF62 /* WebColorChooser.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index c06f11b36..729fc11cf 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -31,6 +31,7 @@
 #include "InjectedBundleNavigationAction.h"
 #include "InjectedBundleUserMessageCoders.h"
 #include "LayerTreeHost.h"
+#include "WebColorChooser.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebFrame.h"
 #include "WebFrameLoaderClient.h"
@@ -597,10 +598,12 @@ bool WebChromeClient::paintCustomOverhangArea(GraphicsContext* context, const In
 }
 
 #if ENABLE(INPUT_TYPE_COLOR)
-PassOwnPtr<ColorChooser> WebChromeClient::createColorChooser(ColorChooserClient*, const Color&)
+PassOwnPtr<ColorChooser> WebChromeClient::createColorChooser(ColorChooserClient* client, const Color& initialColor)
 {
-    notImplemented();
-    return nullptr;
+    if (m_page->activeColorChooser())
+        return nullptr;
+
+    return adoptPtr(new WebColorChooser(m_page, client, initialColor));
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.cpp
new file mode 100644
index 000000000..2cb0f3c56
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebColorChooser.h"
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include "WebCoreArgumentCoders.h"
+#include "WebPage.h"
+#include "WebPageProxyMessages.h"
+#include "WebProcess.h"
+#include <WebCore/ColorChooserClient.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebColorChooser::WebColorChooser(WebPage* page, ColorChooserClient* client, const Color& initialColor)
+    : m_colorChooserClient(client)
+    , m_page(page)
+{
+    m_page->setActiveColorChooser(this);
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::ShowColorChooser(initialColor), m_page->pageID());
+}
+
+WebColorChooser::~WebColorChooser()
+{
+    if (!m_page)
+        return;
+
+    m_page->setActiveColorChooser(0);
+}
+
+void WebColorChooser::didChooseColor(const Color& color)
+{
+    m_colorChooserClient->didChooseColor(color);
+}
+
+void WebColorChooser::didEndChooser()
+{
+    m_colorChooserClient->didEndChooser();
+}
+
+void WebColorChooser::disconnectFromPage()
+{
+    m_page = 0;
+}
+
+void WebColorChooser::setSelectedColor(const Color& color)
+{
+    if (!m_page)
+        return;
+
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::SetColorChooserColor(color), m_page->pageID());
+}
+
+void WebColorChooser::endChooser()
+{
+    if (!m_page)
+        return;
+
+    WebProcess::shared().connection()->send(Messages::WebPageProxy::EndColorChooser(), m_page->pageID());
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.h
new file mode 100644
index 000000000..1e6feeee9
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebColorChooser_h
+#define WebColorChooser_h
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include <WebCore/ColorChooser.h>
+
+namespace WebCore {
+class Color;
+class ColorChooserClient;
+}
+
+namespace WebKit {
+
+class WebPage;
+
+class WebColorChooser : public WebCore::ColorChooser {
+public:
+    WebColorChooser(WebPage*, WebCore::ColorChooserClient*, const WebCore::Color&);
+    virtual ~WebColorChooser();
+
+    void didChooseColor(const WebCore::Color&);
+    void didEndChooser();
+    void disconnectFromPage();
+
+    virtual void setSelectedColor(const WebCore::Color&) OVERRIDE;
+    virtual void endChooser() OVERRIDE;
+
+private:
+    WebCore::ColorChooserClient* m_colorChooserClient;
+    WebPage* m_page;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
+
+#endif // WebColorChooser_h
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
index 163ff2045..22a5cf453 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebEditorClientEfl.cpp
@@ -40,7 +40,8 @@ namespace WebKit {
 
 void WebEditorClient::handleKeyboardEvent(KeyboardEvent* event)
 {
-    notImplemented();
+    if (m_page->handleEditingKeyboardEvent(event))
+        event->setDefaultHandled();
 }
 
 void WebEditorClient::handleInputMethodKeydown(KeyboardEvent*)
diff --git a/Source/WebKit2/WebProcess/WebPage/FindController.cpp b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
index 7f00bc7dc..8955709ce 100644
--- a/Source/WebKit2/WebProcess/WebPage/FindController.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/FindController.cpp
@@ -164,6 +164,7 @@ void FindController::hideFindUI()
     if (m_findPageOverlay)
         m_webPage->uninstallPageOverlay(m_findPageOverlay, false);
 
+    m_webPage->corePage()->unmarkAllTextMatches();
     hideFindIndicator();
 }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
index 2f754822e..0acd3486c 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.cpp
@@ -99,7 +99,7 @@ void UpdateAtlas::didSwapBuffers()
         m_bufferStates[i] = Available;
 }
 
-PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(const WebCore::IntSize& size, IntPoint& offset)
+PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(ShareableSurface::Handle& handle, const WebCore::IntSize& size, IntPoint& offset)
 {
     buildLayoutIfNeeded();
     int index = findAvailableIndex(size);
@@ -108,6 +108,9 @@ PassOwnPtr<GraphicsContext> UpdateAtlas::beginPaintingOnAvailableBuffer(const We
     if (index < 0)
         return PassOwnPtr<GraphicsContext>();
 
+    if (!m_surface->createHandle(handle))
+        return PassOwnPtr<WebCore::GraphicsContext>();
+
     // FIXME: Use tri-state buffers, to allow faster updates.
     m_bufferStates[index] = Taken;
     offset = offsetForIndex(index);
diff --git a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
index 9d10962a3..74760a5b4 100644
--- a/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
+++ b/Source/WebKit2/WebProcess/WebPage/UpdateAtlas.h
@@ -34,11 +34,10 @@ class UpdateAtlas {
 public:
     UpdateAtlas(int dimension, ShareableBitmap::Flags);
 
-    PassRefPtr<ShareableSurface> surface() { return m_surface; }
     inline WebCore::IntSize size() const { return m_surface->size(); }
 
     // Returns a null pointer of there is no available buffer.
-    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(const WebCore::IntSize&, WebCore::IntPoint& offset);
+    PassOwnPtr<WebCore::GraphicsContext> beginPaintingOnAvailableBuffer(ShareableSurface::Handle&, const WebCore::IntSize&, WebCore::IntPoint& offset);
     void didSwapBuffers();
     ShareableBitmap::Flags flags() const { return m_flags; }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
index ac869fbea..db2ed4128 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
@@ -59,6 +59,12 @@
 #include <WebCore/TextResourceDecoder.h>
 #include <wtf/text/StringBuilder.h>
 
+#if ENABLE(WEB_INTENTS)
+#include "IntentData.h"
+#include <WebCore/DOMWindowIntents.h>
+#include <WebCore/DeliveredIntent.h>
+#endif
+
 #if PLATFORM(MAC) || PLATFORM(WIN)
 #include <WebCore/LegacyWebArchive.h>
 #endif
@@ -236,6 +242,19 @@ void WebFrame::convertHandleToDownload(ResourceHandle* handle, const ResourceReq
     m_policyDownloadID = 0;
 }
 
+#if ENABLE(WEB_INTENTS)
+void WebFrame::deliverIntent(const IntentData& intentData)
+{
+    OwnPtr<DeliveredIntentClient> dummyClient;
+    OwnPtr<MessagePortArray> dummyPorts;
+    Vector<uint8_t> dataCopy = intentData.data;
+    RefPtr<DeliveredIntent> deliveredIntent = DeliveredIntent::create(m_coreFrame, dummyClient.release(), intentData.action, intentData.type,
+                                                                      SerializedScriptValue::adopt(dataCopy), dummyPorts.release(),
+                                                                      intentData.extras);
+    WebCore::DOMWindowIntents::from(m_coreFrame->domWindow())->deliver(deliveredIntent.release());
+}
+#endif
+
 String WebFrame::source() const 
 {
     if (!m_coreFrame)
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.h b/Source/WebKit2/WebProcess/WebPage/WebFrame.h
index 839b57926..bd6c038ee 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.h
@@ -52,6 +52,10 @@ class InjectedBundleRangeHandle;
 class InjectedBundleScriptWorld;
 class WebPage;
 
+#if ENABLE(WEB_INTENTS)
+struct IntentData;
+#endif
+
 class WebFrame : public APIObject {
 public:
     static const Type APIType = TypeBundleFrame;
@@ -75,6 +79,10 @@ public:
     void startDownload(const WebCore::ResourceRequest&);
     void convertHandleToDownload(WebCore::ResourceHandle*, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);
 
+#if ENABLE(WEB_INTENTS)
+    void deliverIntent(const IntentData&);
+#endif
+
     String source() const;
     String contentsAsString() const;
     String selectionAsString() const;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index ff94102c6..953e9b046 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +48,7 @@
 #include "WebBackForwardListItem.h"
 #include "WebBackForwardListProxy.h"
 #include "WebChromeClient.h"
+#include "WebColorChooser.h"
 #include "WebContextMenu.h"
 #include "WebContextMenuClient.h"
 #include "WebContextMessages.h"
@@ -124,6 +126,10 @@
 #endif
 #endif
 
+#if ENABLE(WEB_INTENTS)
+#include "IntentData.h"
+#endif
+
 #if PLATFORM(MAC)
 #include "BuiltInPDFView.h"
 #endif
@@ -206,6 +212,9 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     , m_tapHighlightController(this)
 #endif
 #endif
+#if ENABLE(INPUT_TYPE_COLOR)
+    , m_activeColorChooser(0)
+#endif
 #if ENABLE(GEOLOCATION)
     , m_geolocationPermissionRequestManager(this)
 #endif
@@ -631,6 +640,13 @@ void WebPage::close()
         m_activeOpenPanelResultListener = 0;
     }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    if (m_activeColorChooser) {
+        m_activeColorChooser->disconnectFromPage();
+        m_activeColorChooser = 0;
+    }
+#endif
+
     m_sandboxExtensionTracker.invalidate();
 
     m_underlayPage = nullptr;
@@ -1423,9 +1439,7 @@ void WebPage::keyEvent(const WebKeyboardEvent& keyboardEvent)
     if (!handled)
         handled = performDefaultBehaviorForKeyEvent(keyboardEvent);
 
-    // The receiving end relies on DidReceiveEvent and InterpretQueuedKeyEvent arriving in the same order they are sent
-    // (for keyboard events.) We set the DispatchMessageEvenWhenWaitingForSyncReply flag to ensure consistent ordering.
-    connection()->send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(keyboardEvent.type()), handled), m_pageID, CoreIPC::DispatchMessageEvenWhenWaitingForSyncReply);
+    sendSync(Messages::WebPageProxy::DidReceiveKeyEvent(static_cast<uint32_t>(keyboardEvent.type()), handled), Messages::WebPageProxy::DidReceiveKeyEvent::Reply());
 }
 
 void WebPage::keyEventSyncForTesting(const WebKeyboardEvent& keyboardEvent, bool& handled)
@@ -1914,6 +1928,17 @@ void WebPage::forceRepaint(uint64_t callbackID)
     send(Messages::WebPageProxy::VoidCallback(callbackID));
 }
 
+#if ENABLE(WEB_INTENTS)
+void WebPage::deliverIntentToFrame(uint64_t frameID, const IntentData& intentData)
+{
+    WebFrame* frame = WebProcess::shared().webFrame(frameID);
+    if (!frame)
+        return;
+
+    frame->deliverIntent(intentData);
+}
+#endif
+
 void WebPage::preferencesDidChange(const WebPreferencesStore& store)
 {
     WebPreferencesStore::removeTestRunnerOverrides();
@@ -2315,6 +2340,23 @@ void WebPage::setActivePopupMenu(WebPopupMenu* menu)
     m_activePopupMenu = menu;
 }
 
+#if ENABLE(INPUT_TYPE_COLOR)
+void WebPage::setActiveColorChooser(WebColorChooser* colorChooser)
+{
+    m_activeColorChooser = colorChooser;
+}
+
+void WebPage::didEndColorChooser()
+{
+    m_activeColorChooser->didEndChooser();
+}
+
+void WebPage::didChooseColor(const WebCore::Color& color)
+{
+    m_activeColorChooser->didChooseColor(color);
+}
+#endif
+
 void WebPage::setActiveOpenPanelResultListener(PassRefPtr<WebOpenPanelResultListener> openPanelResultListener)
 {
     m_activeOpenPanelResultListener = openPanelResultListener;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 32d433212..1a13b6ce7 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -123,6 +123,7 @@ class NotificationPermissionRequestManager;
 class PageOverlay;
 class PluginView;
 class SessionState;
+class WebColorChooser;
 class WebContextMenu;
 class WebContextMenuItemData;
 class WebEvent;
@@ -143,6 +144,10 @@ struct PrintInfo;
 struct WebPageCreationParameters;
 struct WebPreferencesStore;
 
+#if ENABLE(WEB_INTENTS)
+struct IntentData;
+#endif
+
 #if ENABLE(GESTURE_EVENTS)
 class WebGestureEvent;
 #endif
@@ -214,7 +219,14 @@ public:
     bool isInRedo() const { return m_isInRedo; }
 
     void setActivePopupMenu(WebPopupMenu*);
-    
+
+#if ENABLE(INPUT_TYPE_COLOR)
+    WebColorChooser* activeColorChooser() const { return m_activeColorChooser; }
+    void setActiveColorChooser(WebColorChooser*);
+    void didChooseColor(const WebCore::Color&);
+    void didEndColorChooser();
+#endif
+
     WebOpenPanelResultListener* activeOpenPanelResultListener() const { return m_activeOpenPanelResultListener.get(); }
     void setActiveOpenPanelResultListener(PassRefPtr<WebOpenPanelResultListener>);
 
@@ -635,6 +647,10 @@ private:
     void runJavaScriptInMainFrame(const String&, uint64_t callbackID);
     void forceRepaint(uint64_t callbackID);
 
+#if ENABLE(WEB_INTENTS)
+    void deliverIntentToFrame(uint64_t frameID, const IntentData&);
+#endif
+
     void preferencesDidChange(const WebPreferencesStore&);
     void platformPreferencesDidChange(const WebPreferencesStore&);
     void updatePreferences(const WebPreferencesStore&);
@@ -808,6 +824,9 @@ private:
 #if ENABLE(CONTEXT_MENUS)
     RefPtr<WebContextMenu> m_contextMenu;
 #endif
+#if ENABLE(INPUT_TYPE_COLOR)
+    WebColorChooser* m_activeColorChooser;
+#endif
     RefPtr<WebOpenPanelResultListener> m_activeOpenPanelResultListener;
     RefPtr<NotificationPermissionRequestManager> m_notificationPermissionRequestManager;
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
index 7a7f4ebf5..38f36c2bf 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.messages.in
@@ -45,6 +45,11 @@ messages -> WebPage {
     HighlightPotentialActivation(WebCore::IntPoint point, WebCore::IntSize area)
 #endif
 
+#if ENABLE(INPUT_TYPE_COLOR)
+    DidEndColorChooser();
+    DidChooseColor(WebCore::Color color);
+#endif
+
 #if ENABLE(CONTEXT_MENUS)
     ContextMenuHidden()
 #endif
@@ -220,6 +225,11 @@ messages -> WebPage {
     SetCanRunBeforeUnloadConfirmPanel(bool canRunBeforeUnloadConfirmPanel)
     SetCanRunModal(bool canRunModal)
 
+    # Web Intents
+#if ENABLE(WEB_INTENTS)
+    DeliverIntentToFrame(uint64_t frameID, WebKit::IntentData intentData);
+#endif
+
 #if PLATFORM(QT)
     SetComposition(WTF::String text, WTF::Vector<WebCore::CompositionUnderline> underlines, uint64_t selectionStart, uint64_t selectionEnd, uint64_t replacementRangeStart, uint64_t replacementRangeEnd)
     ConfirmComposition(WTF::String text, int64_t selectionStart, int64_t selectionLength)
diff --git a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
index 669442014..df0f17f87 100644
--- a/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/efl/WebPageEfl.cpp
@@ -31,6 +31,7 @@
 #include "NotImplemented.h"
 #include "WebEvent.h"
 #include "WindowsKeyboardCodes.h"
+#include <WebCore/EflKeyboardUtilities.h>
 #include <WebCore/FocusController.h>
 #include <WebCore/Frame.h>
 #include <WebCore/KeyboardEvent.h>
@@ -93,10 +94,14 @@ PassRefPtr<SharedBuffer> WebPage::cachedResponseDataForURL(const KURL&)
     return 0;
 }
 
-const char* WebPage::interpretKeyEvent(const KeyboardEvent* evt)
+const char* WebPage::interpretKeyEvent(const KeyboardEvent* event)
 {
-    notImplemented();
-    return 0;
+    ASSERT(event->type() == eventNames().keydownEvent || event->type() == eventNames().keypressEvent);
+
+    if (event->type() == eventNames().keydownEvent)
+        return getKeyDownCommandName(event);
+
+    return getKeyPressCommandName(event);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
index 5b8eb3ed5..c42866feb 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
@@ -262,11 +262,6 @@ bool LayerTreeHostGtk::showRepaintCounter(const GraphicsLayer*) const
     return m_webPage->corePage()->settings()->showRepaintCounter();
 }
 
-float LayerTreeHostGtk::deviceScaleFactor() const
-{
-    return m_webPage->corePage()->deviceScaleFactor();
-}
-
 gboolean LayerTreeHostGtk::layerFlushTimerFiredCallback(LayerTreeHostGtk* layerTreeHost)
 {
     layerTreeHost->layerFlushTimerFired();
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
index fd9ae0d3e..b454925cb 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
@@ -77,7 +77,6 @@ private:
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect);
     virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
     virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
-    virtual float deviceScaleFactor() const;
     virtual void didCommitChangesForLayer(const WebCore::GraphicsLayer*) const { }
 
     void createPageOverlayLayer();
diff --git a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
index 0114cf416..1fa91ac3f 100644
--- a/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/qt/LayerTreeHostQt.cpp
@@ -297,7 +297,7 @@ static void updateOffsetFromViewportForSelf(RenderLayer* renderLayer)
     if (!style)
         return;
 
-    if (!renderLayer->renderer()->isPositioned() || renderLayer->renderer()->style()->position() != FixedPosition)
+    if (!renderLayer->renderer()->isOutOfFlowPositioned() || renderLayer->renderer()->style()->position() != FixedPosition)
         return;
 
     if (!renderLayer->renderer()->container()->isRenderView())
@@ -552,13 +552,6 @@ void LayerTreeHostQt::purgeBackingStores()
     m_updateAtlases.clear();
 }
 
-static PassOwnPtr<WebCore::GraphicsContext> beginContentUpdateInAtlas(UpdateAtlas& atlas, const WebCore::IntSize& size, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
-{
-    if (!atlas.surface()->createHandle(handle))
-        return PassOwnPtr<WebCore::GraphicsContext>();
-    return atlas.beginPaintingOnAvailableBuffer(size, offset);
-}
-
 PassOwnPtr<WebCore::GraphicsContext> LayerTreeHostQt::beginContentUpdate(const WebCore::IntSize& size, ShareableBitmap::Flags flags, ShareableSurface::Handle& handle, WebCore::IntPoint& offset)
 {
     OwnPtr<WebCore::GraphicsContext> graphicsContext;
@@ -566,7 +559,7 @@ PassOwnPtr<WebCore::GraphicsContext> LayerTreeHostQt::beginContentUpdate(const W
         UpdateAtlas& atlas = m_updateAtlases[i];
         if (atlas.flags() == flags) {
             // This will return null if there is no available buffer space.
-            graphicsContext = beginContentUpdateInAtlas(atlas, size, handle, offset);
+            graphicsContext = atlas.beginPaintingOnAvailableBuffer(handle, size, offset);
             if (graphicsContext)
                 return graphicsContext.release();
         }
@@ -574,7 +567,7 @@ PassOwnPtr<WebCore::GraphicsContext> LayerTreeHostQt::beginContentUpdate(const W
 
     static const int ScratchBufferDimension = 2000;
     m_updateAtlases.append(UpdateAtlas(ScratchBufferDimension, flags));
-    return beginContentUpdateInAtlas(m_updateAtlases.last(), size, handle, offset);
+    return m_updateAtlases.last().beginPaintingOnAvailableBuffer(handle, size, offset);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
index 19f760f6a..6294f00d8 100644
--- a/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/win/WebPageWin.cpp
@@ -447,7 +447,7 @@ void WebPage::gestureDidScroll(const IntSize& size)
             verticalScrollbar = view->verticalScrollbar();
     }
 
-    m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(size.width(), size.height());
+    m_gestureTargetNode->renderer()->enclosingLayer()->scrollByRecursively(size);
     bool gestureReachedScrollingLimit = verticalScrollbar && scrollbarAtTopOrBottomOfDocument(verticalScrollbar);
 
     // FIXME: We really only want to update this state if the state was updated via scrolling the main frame,
diff --git a/Source/WebKit2/efl/ewebkit2.pc.in b/Source/WebKit2/efl/ewebkit2.pc.in
new file mode 100644
index 000000000..6b0a2e165
--- /dev/null
+++ b/Source/WebKit2/efl/ewebkit2.pc.in
@@ -0,0 +1,13 @@
+prefix=@CMAKE_INSTALL_PREFIX@
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+datadir=${prefix}/share/@WebKit2_LIBRARY_NAME@-@PROJECT_VERSION_MAJOR@
+
+Name: WebKit2-EFL
+Description: Web content engine for EFL applications
+Version: @PROJECT_VERSION@
+Requires: cairo evas ecore libsoup-2.4 ecore-input
+Libs: -L${libdir} -lewebkit2
+Libs.private: @LIBS_PRIVATE@
+Cflags: -I${includedir}/@WebKit2_LIBRARY_NAME@-@PROJECT_VERSION_MAJOR@
diff --git a/Source/WebKit2/win/WebKit2.vcproj b/Source/WebKit2/win/WebKit2.vcproj
index c2fef09c6..0a38c4b82 100755
--- a/Source/WebKit2/win/WebKit2.vcproj
+++ b/Source/WebKit2/win/WebKit2.vcproj
@@ -1838,6 +1838,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\WebProcess\WebCoreSupport\WebColorChooser.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\WebProcess\WebCoreSupport\WebColorChooser.h"
+					>
+				</File>
+				<File
 					RelativePath="..\WebProcess\WebCoreSupport\WebContextMenuClient.cpp"
 					>
 				</File>
@@ -2883,6 +2891,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\UIProcess\WebColorChooserProxy.h"
+				>
+			</File>
+			<File
 				RelativePath="..\UIProcess\WebConnectionToWebProcess.cpp"
 				>
 			</File>
diff --git a/Source/cmake/OptionsBlackBerry.cmake b/Source/cmake/OptionsBlackBerry.cmake
index 11e02982e..a04ac31b2 100644
--- a/Source/cmake/OptionsBlackBerry.cmake
+++ b/Source/cmake/OptionsBlackBerry.cmake
@@ -32,6 +32,9 @@ IF (ADDITIONAL_SYSTEM_INCLUDE_PATH)
     FOREACH (directory ${ADDITIONAL_SYSTEM_INCLUDE_PATH})
         INCLUDE_DIRECTORIES(SYSTEM ${directory})
     ENDFOREACH ()
+    IF(ENABLE_WEBGL)
+        INCLUDE_DIRECTORIES(SYSTEM ${THIRDPARTY_DIR}/ANGLE/include) #As system so as to be lower-priority than actual system headers
+    ENDIF ()
 ENDIF ()
 
 IF (ENABLE_DRT)
diff --git a/Source/cmake/OptionsCommon.cmake b/Source/cmake/OptionsCommon.cmake
index bae6527f4..044651e55 100644
--- a/Source/cmake/OptionsCommon.cmake
+++ b/Source/cmake/OptionsCommon.cmake
@@ -29,3 +29,4 @@ SET_PROPERTY(GLOBAL PROPERTY USE_FOLDERS ON)
 SET(LIB_SUFFIX "" CACHE STRING "Define suffix of directory name (32/64)")
 
 SET(LIB_INSTALL_DIR "lib${LIB_SUFFIX}" CACHE PATH "Where to install libraries (lib${LIB_SUFFIX})")
+SET(EXEC_INSTALL_DIR "bin" CACHE PATH "Where to install executables")
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 355fe9aa7..3b26e52af 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -11,6 +11,7 @@ SET(PROJECT_VERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_
 SET(WEBKIT_USER_AGENT_MAJOR_VERSION 534)
 SET(WEBKIT_USER_AGENT_MINOR_VERSION 16)
 
+ADD_DEFINITIONS(-DBUILDING_EFL__=1)
 ADD_DEFINITIONS(-DWTF_PLATFORM_EFL=1)
 SET(WTF_PLATFORM_EFL 1)