Imported WebKit commit 0fbd41c4e13f5a190faf160bf993eee614e6e18e (http://svn.webkit.org/repository/webkit/trunk@123477)

New snapshot that adapts to latest Qt API changes
author: Simon Hausmann <simon.hausmann@nokia.com> 2012-07-24 17:03:20 +0200
committer: Simon Hausmann <simon.hausmann@nokia.com> 2012-07-24 17:03:20 +0200
commit: 08d4a74d56ca431877819fc4566e27eafe150342 (patch)
tree: ebd8530838ab390c015c6b7e659a22852c1663ae /Source
parent: 1de6cd4794bbd5a52189384189a2b8df1848b39b (diff)
download: qtwebkit-08d4a74d56ca431877819fc4566e27eafe150342.tar.gz
529 files changed, 9641 insertions, 3594 deletions
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 69c052433..c3501e8f8 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,20 +1,185 @@
-2012-06-13  Patrick Gansterer  <paroga@webkit.org>
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
 
-        [WIN] Remove dependency on pthread from MachineStackMarker
-        https://bugs.webkit.org/show_bug.cgi?id=68429
+        Move GregorianDateTime from JSC to WTF namespace
+        https://bugs.webkit.org/show_bug.cgi?id=91948
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Geoffrey Garen.
 
-        Implement pthread TLS functionality with native windows functions.
+        Moving GregorianDateTime into the WTF namespace allows us to us to
+        use it in WebCore too. The new class has the same behaviour as the
+        old struct. Only the unused timeZone member has been removed.
 
-        * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly.
-        * heap/MachineStackMarker.h:
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecificKeyCreate): Added wrapper around pthread_key_create.
-        (WTF::ThreadSpecificKeyDelete): Added wrapper around pthread_key_delete.
-        (WTF::ThreadSpecificSet): Added wrapper around pthread_setspecific.
-        (WTF::ThreadSpecificGet): Added wrapper around pthread_getspecific.
-        * wtf/ThreadSpecificWin.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConversion.cpp:
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSDateMath.h:
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Property storage should grow in reverse address direction, to support butterflies
+        https://bugs.webkit.org/show_bug.cgi?id=91788
+
+        Reviewed by Geoffrey Garen.
+
+        Changes property storage to grow to the left, and changes the property storage pointer to point
+        one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
+        
+        Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
+        and a slow mode of object access in LLInt.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchCompact):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
+        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
+        (JSC::MacroAssemblerX86Common::repatchCompact):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchCompact):
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpStructure):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::pinIfNecessary):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDescribe):
+        * llint/LLIntCommon.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::growOutOfLineStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/PropertyOffset.h:
+        (JSC::offsetInOutOfLineStorage):
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is too aggressive in performing the specific value optimization on loads
+        https://bugs.webkit.org/show_bug.cgi?id=92034
+
+        Reviewed by Mark Hahnenberg.
+
+        This ensures that we don't do optimizations based on a structure having a specific
+        value, if there is no way to detect that the value is despecified. This is the
+        case for dictionaries, since despecifying a value in a dictionary does not lead to
+        a transition and so cannot be caught by either structure checks or structure
+        transition watchpoints.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=92002
+
+        Reviewed by Mark Hahnenberg.
+        
+        In the process of changing the nature of local variable typing, I forgot to modify one of the places where
+        we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move JSC::parseDate() from DateConversion to JSDateMath
+        https://bugs.webkit.org/show_bug.cgi?id=91982
+
+        Reviewed by Geoffrey Garen.
+
+        Moveing this function into the other files removes the dependency
+        on JSC spcific classes in DateConversion.{cpp|h}.
+
+        * runtime/DateConversion.cpp:
+        * runtime/DateConversion.h:
+        (JSC):
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDate):
+        (JSC):
+        * runtime/JSDateMath.h:
+        (JSC):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement GCActivityCallback with platform timer
+        https://bugs.webkit.org/show_bug.cgi?id=90175
+
+        Reviewed by Rob Buis.
+
+        Use JSLock when performing GC to avoid assertions.
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
 
 2012-07-23  Kent Tamura  <tkent@chromium.org>
 
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 31853f34c..0a26e46ff 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -37,14 +37,15 @@ ENABLE_ANIMATION_API = ;
 ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
-ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
-ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
+ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
+ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
@@ -134,4 +135,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index 39ad1b2be..daf808e05 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index f6580c51f..380bbaf1b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -34,6 +34,12 @@ INCLUDEPATH += \
 
 win32-* {
     LIBS += -lwinmm
+
+    win32-g++* {
+        LIBS += -lpthreadGC2
+    } else:win32-msvc* {
+        LIBS += -lpthreadVC2
+    }
 }
 
 wince* {
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index 96c4f096c..e9b9fcc50 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -2095,11 +2095,24 @@ public:
         setInt32(where, value);
     }
     
-    static void repatchCompact(void* where, int32_t value)
+    static void repatchCompact(void* where, int32_t offset)
     {
-        ASSERT(value >= 0);
-        ASSERT(ARMThumbImmediate::makeUInt12(value).isUInt7());
-        setUInt7ForLoad(where, ARMThumbImmediate::makeUInt12(value));
+        ASSERT(offset >= -255 && offset <= 255);
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        
+        offset |= (add << 9);
+        offset |= (1 << 10);
+        offset |= (1 << 11);
+
+        uint16_t* location = reinterpret_cast<uint16_t*>(where);
+        location[1] &= ~((1 << 12) - 1);
+        location[1] |= offset;
+        cacheFlush(location, sizeof(uint16_t) * 2);
     }
 
     static void repatchPointer(void* where, void* value)
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index cf6f02ca9..183e8f980 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -53,10 +53,12 @@ public:
     typedef ARMv7Assembler::LinkRecord LinkRecord;
     typedef ARMv7Assembler::JumpType JumpType;
     typedef ARMv7Assembler::JumpLinkType JumpLinkType;
-    // Magic number is the biggest useful offset we can get on ARMv7 with
-    // a LDR_imm_T2 encoding
-    static const int MaximumCompactPtrAlignedAddressOffset = 124;
-    
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -255 && value <= 255;
+    }
+
     Vector<LinkRecord>& jumpsToLink() { return m_assembler.jumpsToLink(); }
     void* unlinkedCode() { return m_assembler.unlinkedCode(); }
     bool canCompact(JumpType jumpType) { return m_assembler.canCompact(jumpType); }
@@ -642,26 +644,14 @@ public:
         return label;
     }
     
-    // FIXME: we should be able to plant a compact load relative to/from any base/dest register.
     DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
     {
         RegisterID base = address.base;
         
-        if (base >= ARMRegisters::r8) {
-            move(base, addressTempRegister);
-            base = addressTempRegister;
-        }
-
         DataLabelCompact label(this);
-        ASSERT(address.offset >= 0);
-        ASSERT(address.offset <= MaximumCompactPtrAlignedAddressOffset);
-        ASSERT(ARMThumbImmediate::makeUInt12(address.offset).isUInt7());
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
 
-        if (dest >= ARMRegisters::r8) {
-            m_assembler.ldrCompact(addressTempRegister, base, ARMThumbImmediate::makeUInt12(address.offset));
-            move(addressTempRegister, dest);
-        } else
-            m_assembler.ldrCompact(dest, base, ARMThumbImmediate::makeUInt12(address.offset));
+        m_assembler.ldr(dest, base, address.offset, true, false);
         return label;
     }
 
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 432489dbc..115b337f7 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -47,7 +47,10 @@ public:
     typedef X86Assembler::FPRegisterID FPRegisterID;
     typedef X86Assembler::XMMRegisterID XMMRegisterID;
     
-    static const int MaximumCompactPtrAlignedAddressOffset = 127;
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -128 && value <= 127;
+    }
 
     enum RelationalCondition {
         Equal = X86Assembler::ConditionE,
@@ -494,8 +497,7 @@ public:
     
     static void repatchCompact(CodeLocationDataLabelCompact dataLabelCompact, int32_t value)
     {
-        ASSERT(value >= 0);
-        ASSERT(value < MaximumCompactPtrAlignedAddressOffset);
+        ASSERT(isCompactPtrAlignedAddressOffset(value));
         AssemblerType_T::repatchCompact(dataLabelCompact.dataLocation(), value);
     }
     
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index fc1c27245..adaee4bc0 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -1829,7 +1829,7 @@ public:
     
     static void repatchCompact(void* where, int32_t value)
     {
-        ASSERT(value >= 0);
+        ASSERT(value >= std::numeric_limits<int8_t>::min());
         ASSERT(value <= std::numeric_limits<int8_t>::max());
         setInt8(where, value);
     }
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 363efa28a..5374a537a 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -255,9 +255,9 @@ static void dumpStructure(const char* name, ExecState* exec, Structure* structur
     
     dataLog("%s = %p", name, structure);
     
-    size_t offset = structure->get(exec->globalData(), ident);
-    if (offset != notFound)
-        dataLog(" (offset = %lu)", static_cast<unsigned long>(offset));
+    PropertyOffset offset = structure->get(exec->globalData(), ident);
+    if (offset != invalidOffset)
+        dataLog(" (offset = %d)", offset);
 }
 #endif
 
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
index cb3e8e8b6..0df0f44e7 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
@@ -50,6 +50,8 @@ GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
     JSCell* specificValue;
     PropertyOffset offset = structure->get(
         *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
+    if (structure->isDictionary())
+        specificValue = 0;
     if (!isValidOffset(offset))
         return GetByIdStatus(NoInformation, false);
     
@@ -75,12 +77,13 @@ void GetByIdStatus::computeForChain(GetByIdStatus& result, CodeBlock* profiledBl
     Structure* currentStructure = structure;
     JSObject* currentObject = 0;
     for (unsigned i = 0; i < result.m_chain.size(); ++i) {
+        ASSERT(!currentStructure->isDictionary());
         currentObject = asObject(currentStructure->prototypeForLookup(profiledBlock));
         currentStructure = result.m_chain[i];
         if (currentObject->structure() != currentStructure)
             return;
     }
-        
+    
     ASSERT(currentObject);
         
     unsigned attributesIgnored;
@@ -88,6 +91,8 @@ void GetByIdStatus::computeForChain(GetByIdStatus& result, CodeBlock* profiledBl
         
     result.m_offset = currentStructure->get(
         *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
+    if (currentStructure->isDictionary())
+        specificValue = 0;
     if (!isValidOffset(result.m_offset))
         return;
         
@@ -155,6 +160,8 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
         JSCell* specificValue;
         result.m_offset = structure->get(
             *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
+        if (structure->isDictionary())
+            specificValue = 0;
         
         if (isValidOffset(result.m_offset)) {
             result.m_structureSet.add(structure);
@@ -178,6 +185,8 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
             JSCell* specificValue;
             PropertyOffset myOffset = structure->get(
                 *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
+            if (structure->isDictionary())
+                specificValue = 0;
             
             if (!isValidOffset(myOffset)) {
                 result.m_offset = invalidOffset;
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.h b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
index 297ec335f..f38a19e8c 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.h
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
@@ -53,7 +53,7 @@ public:
     
     GetByIdStatus(
         State state, bool wasSeenInJIT, const StructureSet& structureSet = StructureSet(),
-        size_t offset = invalidOffset, JSValue specificValue = JSValue(), Vector<Structure*> chain = Vector<Structure*>())
+        PropertyOffset offset = invalidOffset, JSValue specificValue = JSValue(), Vector<Structure*> chain = Vector<Structure*>())
         : m_state(state)
         , m_structureSet(structureSet)
         , m_chain(chain)
@@ -61,7 +61,7 @@ public:
         , m_offset(offset)
         , m_wasSeenInJIT(wasSeenInJIT)
     {
-        ASSERT((state == Simple) == (offset != notFound));
+        ASSERT((state == Simple) == (offset != invalidOffset));
     }
     
     static GetByIdStatus computeFor(CodeBlock*, unsigned bytecodeIndex, Identifier&);
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
index 4afee248d..ddc7700c6 100644
--- a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
@@ -39,6 +39,8 @@ static ResolveGlobalStatus computeForStructure(CodeBlock* codeBlock, Structure*
     JSCell* specificValue;
     PropertyOffset offset = structure->get(
         *codeBlock->globalData(), identifier, attributesIgnored, specificValue);
+    if (structure->isDictionary())
+        specificValue = 0;
     if (!isValidOffset(offset))
         return ResolveGlobalStatus();
     
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 9050d590e..94479d6d0 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -1248,7 +1248,7 @@ char* DFG_OPERATION operationAllocatePropertyStorageWithInitialCapacity(ExecStat
     void* result;
     if (!globalData.heap.tryAllocateStorage(initialOutOfLineCapacity * sizeof(JSValue), &result))
         CRASH();
-    return reinterpret_cast<char*>(result);
+    return reinterpret_cast<char*>(reinterpret_cast<JSValue*>(result) + initialOutOfLineCapacity + 1);
 }
 
 char* DFG_OPERATION operationAllocatePropertyStorage(ExecState* exec, size_t newSize)
@@ -1257,7 +1257,7 @@ char* DFG_OPERATION operationAllocatePropertyStorage(ExecState* exec, size_t new
     void* result;
     if (!globalData.heap.tryAllocateStorage(newSize, &result))
         CRASH();
-    return reinterpret_cast<char*>(result);
+    return reinterpret_cast<char*>(reinterpret_cast<JSValue*>(result) + 1) + newSize;
 }
 
 double DFG_OPERATION operationFModOnInts(int32_t a, int32_t b)
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index d0fbf7ed4..0ff721216 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -106,6 +106,7 @@ typedef void DFG_OPERATION (*V_DFGOperation_EPZJ)(ExecState*, void*, int32_t, En
 typedef void DFG_OPERATION (*V_DFGOperation_W)(WatchpointSet*);
 typedef char* DFG_OPERATION (*P_DFGOperation_E)(ExecState*);
 typedef char* DFG_OPERATION (*P_DFGOperation_ES)(ExecState*, size_t);
+typedef char* DFG_OPERATION (*P_DFGOperation_EPS)(ExecState*, void*, size_t);
 
 // These routines are provide callbacks out to C++ implementations of operations too complex to JIT.
 JSCell* DFG_OPERATION operationNewObject(ExecState*) WTF_INTERNAL;
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index 19e064f2c..ee0c590a8 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -301,7 +301,8 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
 
     // Optimize self access.
     if (slot.slotBase() == baseValue) {
-        if ((slot.cachedPropertyType() != PropertySlot::Value) || ((slot.cachedOffset() * sizeof(JSValue)) > (unsigned)MacroAssembler::MaximumCompactPtrAlignedAddressOffset)) {
+        if ((slot.cachedPropertyType() != PropertySlot::Value)
+            || !MacroAssembler::isCompactPtrAlignedAddressOffset(offsetRelativeToPatchedStorage(slot.cachedOffset()))) {
             dfgRepatchCall(codeBlock, stubInfo.callReturnLocation, operationGetByIdBuildList);
             return true;
         }
@@ -824,7 +825,7 @@ static void emitPutTransitionStub(
             stubJit.storePtr(scratchGPR1, &copiedAllocator->m_currentRemaining);
             stubJit.negPtr(scratchGPR1);
             stubJit.addPtr(MacroAssembler::AbsoluteAddress(&copiedAllocator->m_currentPayloadEnd), scratchGPR1);
-            stubJit.subPtr(MacroAssembler::TrustedImm32(newSize), scratchGPR1);
+            stubJit.addPtr(MacroAssembler::TrustedImm32(sizeof(JSValue)), scratchGPR1);
         } else {
             size_t oldSize = oldStructure->outOfLineCapacity() * sizeof(JSValue);
             ASSERT(newSize > oldSize);
@@ -835,11 +836,11 @@ static void emitPutTransitionStub(
             stubJit.storePtr(scratchGPR1, &copiedAllocator->m_currentRemaining);
             stubJit.negPtr(scratchGPR1);
             stubJit.addPtr(MacroAssembler::AbsoluteAddress(&copiedAllocator->m_currentPayloadEnd), scratchGPR1);
-            stubJit.subPtr(MacroAssembler::TrustedImm32(newSize), scratchGPR1);
+            stubJit.addPtr(MacroAssembler::TrustedImm32(sizeof(JSValue)), scratchGPR1);
             // We have scratchGPR1 = new storage, scratchGPR3 = old storage, scratchGPR2 = available
-            for (size_t offset = 0; offset < oldSize; offset += sizeof(void*)) {
-                stubJit.loadPtr(MacroAssembler::Address(scratchGPR3, offset), scratchGPR2);
-                stubJit.storePtr(scratchGPR2, MacroAssembler::Address(scratchGPR1, offset));
+            for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(oldSize); offset += sizeof(void*)) {
+                stubJit.loadPtr(MacroAssembler::Address(scratchGPR3, -(offset + sizeof(JSValue) * 2)), scratchGPR2);
+                stubJit.storePtr(scratchGPR2, MacroAssembler::Address(scratchGPR1, -(offset + sizeof(JSValue) * 2)));
             }
         }
         
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index f368cf298..875ac39f0 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -1063,7 +1063,7 @@ void SpeculativeJIT::compile(BasicBlock& block)
                             valueSource = ValueSource(DoubleInRegisterFile);
                         else if (isInt32Speculation(argumentPosition.prediction()))
                             valueSource = ValueSource(Int32InRegisterFile);
-                        else if (isArraySpeculation(argumentPosition.prediction()))
+                        else if (isArraySpeculation(argumentPosition.prediction()) || isCellSpeculation(argumentPosition.prediction()))
                             valueSource = ValueSource(CellInRegisterFile);
                         else if (isBooleanSpeculation(argumentPosition.prediction()))
                             valueSource = ValueSource(BooleanInRegisterFile);
@@ -3157,7 +3157,7 @@ void SpeculativeJIT::compileAllocatePropertyStorage(Node& node)
     m_jit.storePtr(scratchGPR, &copiedAllocator->m_currentRemaining);
     m_jit.negPtr(scratchGPR);
     m_jit.addPtr(JITCompiler::AbsoluteAddress(&copiedAllocator->m_currentPayloadEnd), scratchGPR);
-    m_jit.subPtr(JITCompiler::TrustedImm32(newSize), scratchGPR);
+    m_jit.addPtr(JITCompiler::TrustedImm32(sizeof(JSValue)), scratchGPR);
         
     addSlowPathGenerator(
         slowPathCall(slowPath, this, operationAllocatePropertyStorageWithInitialCapacity, scratchGPR));
@@ -3191,14 +3191,14 @@ void SpeculativeJIT::compileReallocatePropertyStorage(Node& node)
     m_jit.storePtr(scratchGPR2, &copiedAllocator->m_currentRemaining);
     m_jit.negPtr(scratchGPR2);
     m_jit.addPtr(JITCompiler::AbsoluteAddress(&copiedAllocator->m_currentPayloadEnd), scratchGPR2);
-    m_jit.subPtr(JITCompiler::TrustedImm32(newSize), scratchGPR2);
+    m_jit.addPtr(JITCompiler::TrustedImm32(sizeof(JSValue)), scratchGPR2);
         
     addSlowPathGenerator(
         slowPathCall(slowPath, this, operationAllocatePropertyStorage, scratchGPR2, newSize));
     // We have scratchGPR2 = new storage, scratchGPR1 = scratch
-    for (size_t offset = 0; offset < oldSize; offset += sizeof(void*)) {
-        m_jit.loadPtr(JITCompiler::Address(oldStorageGPR, offset), scratchGPR1);
-        m_jit.storePtr(scratchGPR1, JITCompiler::Address(scratchGPR2, offset));
+    for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(oldSize); offset += sizeof(void*)) {
+        m_jit.loadPtr(JITCompiler::Address(oldStorageGPR, -(offset + sizeof(JSValue) * 2)), scratchGPR1);
+        m_jit.storePtr(scratchGPR1, JITCompiler::Address(scratchGPR2, -(offset + sizeof(JSValue) * 2)));
     }
     m_jit.storePtr(scratchGPR2, JITCompiler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()));
     
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index cb7d89106..0e412a199 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -1161,6 +1161,11 @@ public:
         m_jit.setupArgumentsWithExecState(TrustedImmPtr(size));
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
+    JITCompiler::Call callOperation(P_DFGOperation_EPS operation, GPRReg result, GPRReg old, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(old, TrustedImmPtr(size));
+        return appendCallWithExceptionCheckSetResult(operation, result);
+    }
     JITCompiler::Call callOperation(J_DFGOperation_E operation, GPRReg result)
     {
         m_jit.setupArgumentsExecState();
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index c63ba8c21..6209da485 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -3913,8 +3913,10 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.breakpoint();
         isOutOfLine.link(&m_jit);
 #endif
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) - inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultTagGPR);
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) - inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultPayloadGPR);
+        m_jit.neg32(resolveInfoGPR);
+        m_jit.signExtend32ToPtr(resolveInfoGPR, resolveInfoGPR);
+        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) + (inlineStorageCapacity - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), resultTagGPR);
+        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) + (inlineStorageCapacity - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), resultPayloadGPR);
 
         addSlowPathGenerator(
             slowPathCall(
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 6dbb8a4b1..39f4a0740 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -3902,8 +3902,10 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.breakpoint();
         isOutOfLine.link(&m_jit);
 #endif
+        m_jit.neg32(resolveInfoGPR);
+        m_jit.signExtend32ToPtr(resolveInfoGPR, resolveInfoGPR);
         m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
-        m_jit.loadPtr(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::ScalePtr, -inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultGPR);
+        m_jit.loadPtr(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::ScalePtr, (inlineStorageCapacity - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), resultGPR);
         
         addSlowPathGenerator(
             slowPathCall(
diff --git a/Source/JavaScriptCore/heap/ConservativeRoots.cpp b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
index 6b9cbef45..7fe22dfff 100644
--- a/Source/JavaScriptCore/heap/ConservativeRoots.cpp
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
@@ -66,10 +66,8 @@ template<typename MarkHook>
 inline void ConservativeRoots::genericAddPointer(void* p, TinyBloomFilter filter, MarkHook& markHook)
 {
     markHook.mark(p);
-    
-    CopiedBlock* block;
-    if (m_copiedSpace->contains(p, block))
-        m_copiedSpace->pin(block);
+
+    m_copiedSpace->pinIfNecessary(p);
     
     MarkedBlock* candidate = MarkedBlock::blockFor(p);
     if (filter.ruleOut(reinterpret_cast<Bits>(candidate))) {
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.h b/Source/JavaScriptCore/heap/CopiedSpace.h
index de682a4c1..be3a331e8 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.h
+++ b/Source/JavaScriptCore/heap/CopiedSpace.h
@@ -68,6 +68,8 @@ public:
 
     bool contains(CopiedBlock*);
     bool contains(void*, CopiedBlock*&);
+    
+    void pinIfNecessary(void* pointer);
 
     size_t size();
     size_t capacity();
diff --git a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
index f702e1dd9..e2af41ad8 100644
--- a/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
+++ b/Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h
@@ -57,6 +57,42 @@ inline void CopiedSpace::pin(CopiedBlock* block)
     block->m_isPinned = true;
 }
 
+inline void CopiedSpace::pinIfNecessary(void* opaquePointer)
+{
+    // Pointers into the copied space come in the following varieties:
+    // 1)  Pointers to the start of a span of memory. This is the most
+    //     natural though not necessarily the most common.
+    // 2)  Pointers to one value-sized (8 byte) word past the end of
+    //     a span of memory. This currently occurs with semi-butterflies
+    //     and should be fixed soon, once the other half of the
+    //     butterfly lands.
+    // 3)  Pointers to the innards arising from loop induction variable
+    //     optimizations (either manual ones or automatic, by the
+    //     compiler).
+    // 4)  Pointers to the end of a span of memory in arising from
+    //     induction variable optimizations combined with the
+    //     GC-to-compiler contract laid out in the C spec: a pointer to
+    //     the end of a span of memory must be considered to be a
+    //     pointer to that memory.
+    
+    EncodedJSValue* pointer = reinterpret_cast<EncodedJSValue*>(opaquePointer);
+    CopiedBlock* block;
+
+    // Handle (1) and (3).
+    if (contains(pointer, block))
+        pin(block);
+    
+    // Handle (4). We don't have to explicitly check and pin the block under this
+    // pointer because it cannot possibly point to something that cases (1) and
+    // (3) above or case (2) below wouldn't already catch.
+    pointer--;
+    
+    // Handle (2)
+    pointer--;
+    if (contains(pointer, block))
+        pin(block);
+}
+
 inline void CopiedSpace::startedCopying()
 {
     DoublyLinkedList<HeapBlock>* temp = m_fromSpace;
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 8e0c57b6a..7eb57479b 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -141,8 +141,10 @@ MachineThreads::MachineThreads(Heap* heap)
 
 MachineThreads::~MachineThreads()
 {
-    if (m_threadSpecific)
-        ThreadSpecificKeyDelete(m_threadSpecific);
+    if (m_threadSpecific) {
+        int error = pthread_key_delete(m_threadSpecific);
+        ASSERT_UNUSED(error, !error);
+    }
 
     MutexLocker registeredThreadsLock(m_registeredThreadsMutex);
     for (Thread* t = m_registeredThreads; t;) {
@@ -179,17 +181,19 @@ void MachineThreads::makeUsableFromMultipleThreads()
     if (m_threadSpecific)
         return;
 
-    ThreadSpecificKeyCreate(&m_threadSpecific, removeThread);
+    int error = pthread_key_create(&m_threadSpecific, removeThread);
+    if (error)
+        CRASH();
 }
 
 void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_threadSpecific || ThreadSpecificGet(m_threadSpecific))
+    if (!m_threadSpecific || pthread_getspecific(m_threadSpecific))
         return;
 
-    ThreadSpecificSet(m_threadSpecific, this);
+    pthread_setspecific(m_threadSpecific, this);
     Thread* thread = new Thread(getCurrentPlatformThread(), wtfThreadData().stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.h b/Source/JavaScriptCore/heap/MachineStackMarker.h
index 3d4aa22d4..5c7705fcf 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.h
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.h
@@ -22,8 +22,8 @@
 #ifndef MachineThreads_h
 #define MachineThreads_h
 
+#include <pthread.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/ThreadSpecific.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace JSC {
@@ -55,7 +55,7 @@ namespace JSC {
         Heap* m_heap;
         Mutex m_registeredThreadsMutex;
         Thread* m_registeredThreads;
-        WTF::ThreadSpecificKey m_threadSpecific;
+        pthread_key_t m_threadSpecific;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 466cff7db..86078fbc3 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -159,9 +159,10 @@ void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID
     if (finalObjectMode == MayBeFinal) {
         Jump isInline = branch32(LessThan, offset, TrustedImm32(inlineStorageCapacity));
         loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), scratch);
+        neg32(offset);
         Jump done = jump();
         isInline.link(this);
-        addPtr(TrustedImm32(JSObject::offsetOfInlineStorage() + inlineStorageCapacity * sizeof(EncodedJSValue)), base, scratch);
+        addPtr(TrustedImm32(JSObject::offsetOfInlineStorage() - (inlineStorageCapacity - 2) * sizeof(EncodedJSValue)), base, scratch);
         done.link(this);
     } else {
 #if !ASSERT_DISABLED
@@ -170,8 +171,10 @@ void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID
         isOutOfLine.link(this);
 #endif
         loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), scratch);
+        neg32(offset);
     }
-    loadPtr(BaseIndex(scratch, offset, ScalePtr, -inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), result);
+    signExtend32ToPtr(offset, offset);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, (inlineStorageCapacity - 2) * static_cast<ptrdiff_t>(sizeof(JSValue))), result);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 84996d9f0..365ecd20a 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -1018,9 +1018,10 @@ void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, Register
     if (finalObjectMode == MayBeFinal) {
         Jump isInline = branch32(LessThan, offset, TrustedImm32(inlineStorageCapacity));
         loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+        neg32(offset);
         Jump done = jump();
         isInline.link(this);
-        addPtr(TrustedImmPtr(JSObject::offsetOfInlineStorage() + inlineStorageCapacity * sizeof(EncodedJSValue)), base);
+        addPtr(TrustedImmPtr(JSObject::offsetOfInlineStorage() - (inlineStorageCapacity - 2) * sizeof(EncodedJSValue)), base);
         done.link(this);
     } else {
 #if !ASSERT_DISABLED
@@ -1029,9 +1030,10 @@ void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, Register
         isOutOfLine.link(this);
 #endif
         loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+        neg32(offset);
     }
-    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) - inlineStorageCapacity * sizeof(EncodedJSValue)), resultPayload);
-    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) - inlineStorageCapacity * sizeof(EncodedJSValue)), resultTag);
+    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) + (inlineStorageCapacity - 2) * sizeof(EncodedJSValue)), resultPayload);
+    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) + (inlineStorageCapacity - 2) * sizeof(EncodedJSValue)), resultTag);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index bfc4709bc..0f03a0a4a 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -932,7 +932,8 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     if (slot.slotBase() == baseValue) {
         // set this up, so derefStructures can do it's job.
         stubInfo->initGetByIdSelf(callFrame->globalData(), codeBlock->ownerExecutable(), structure);
-        if ((slot.cachedPropertyType() != PropertySlot::Value) || ((slot.cachedOffset() * sizeof(JSValue)) > (unsigned)MacroAssembler::MaximumCompactPtrAlignedAddressOffset))
+        if ((slot.cachedPropertyType() != PropertySlot::Value)
+            || !MacroAssembler::isCompactPtrAlignedAddressOffset(offsetRelativeToPatchedStorage(slot.cachedOffset())))
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
         else
             JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 00ad5d3b2..17ab51588 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -84,6 +84,7 @@ static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>&
 
 static EncodedJSValue JSC_HOST_CALL functionPrint(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionDebug(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDescribe(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionGC(ExecState*);
 #ifndef NDEBUG
@@ -191,6 +192,7 @@ protected:
         Base::finishCreation(globalData);
         
         addFunction(globalData, "debug", functionDebug, 1);
+        addFunction(globalData, "describe", functionDescribe, 1);
         addFunction(globalData, "print", functionPrint, 1);
         addFunction(globalData, "quit", functionQuit, 0);
         addFunction(globalData, "gc", functionGC, 0);
@@ -298,6 +300,12 @@ EncodedJSValue JSC_HOST_CALL functionDebug(ExecState* exec)
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL functionDescribe(ExecState* exec)
+{
+    fprintf(stderr, "--> %s\n", exec->argument(0).description());
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
 {
     String trace = "--> Stack trace:\n";
diff --git a/Source/JavaScriptCore/llint/LLIntCommon.h b/Source/JavaScriptCore/llint/LLIntCommon.h
index 6b908eae2..1797ff02e 100644
--- a/Source/JavaScriptCore/llint/LLIntCommon.h
+++ b/Source/JavaScriptCore/llint/LLIntCommon.h
@@ -36,6 +36,9 @@
 // how the GC allocates.
 #define LLINT_ALWAYS_ALLOCATE_SLOW 0
 
+// Disable inline caching of get_by_id and put_by_id.
+#define LLINT_ALWAYS_ACCESS_SLOW 0
+
 // Enable OSR into the JIT. Disabling this while the LLInt is enabled effectively
 // turns off all JIT'ing, since in LLInt's parlance, OSR subsumes any form of JIT
 // invocation.
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index fbc0146b8..d2d743e0a 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -883,7 +883,8 @@ LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
     LLINT_CHECK_EXCEPTION();
     LLINT_OP(1) = result;
 
-    if (baseValue.isCell()
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
         && slot.isCacheable()
         && slot.slotBase() == baseValue
         && slot.cachedPropertyType() == PropertySlot::Value) {
@@ -935,7 +936,8 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
         baseValue.put(exec, ident, LLINT_OP_C(3).jsValue(), slot);
     LLINT_CHECK_EXCEPTION();
     
-    if (baseValue.isCell()
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
         && slot.isCacheable()) {
         
         JSCell* baseCell = baseValue.asCell();
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index 513b742ee..b8115dd6b 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -921,20 +921,22 @@ _llint_op_is_string:
 
 macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, tag, payload)
     assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+    negi propertyOffset
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
-    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
-    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+    loadi TagOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], payload
 end
 
 macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, tag, payload)
     bilt propertyOffset, InlineStorageCapacity, .isInline
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    negi propertyOffset
     jmp .ready
 .isInline:
-    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+    addp JSFinalObject::m_inlineStorage - (InlineStorageCapacity - 2) * 8, objectAndStorage
 .ready:
-    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
-    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+    loadi TagOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffset, 8], payload
 end
 
 macro resolveGlobal(size, slow)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index b976421f0..6e752a6d0 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -778,20 +778,23 @@ _llint_op_is_string:
     dispatch(3)
 
 
-macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, value)
-    assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffsetAsPointer, objectAndStorage, value)
+    assert(macro (ok) bigteq propertyOffsetAsPointer, InlineStorageCapacity, ok end)
+    negp propertyOffsetAsPointer
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
-    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+    loadp (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffsetAsPointer, 8], value
 end
 
-macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, value)
-    bilt propertyOffset, InlineStorageCapacity, .isInline
+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
+    bilt propertyOffsetAsInt, InlineStorageCapacity, .isInline
     loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    sxi2p propertyOffsetAsInt, propertyOffsetAsInt
     jmp .ready
 .isInline:
-    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+    addp JSFinalObject::m_inlineStorage - (InlineStorageCapacity - 2) * 8, objectAndStorage
 .ready:
-    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+    loadp (InlineStorageCapacity - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
 end
 
 macro resolveGlobal(size, slow)
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.cpp b/Source/JavaScriptCore/runtime/DateConstructor.cpp
index 08b815035..0325080f6 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/DateConstructor.cpp
@@ -136,13 +136,13 @@ JSObject* constructDate(ExecState* exec, JSGlobalObject* globalObject, const Arg
         else {
             GregorianDateTime t;
             int year = JSC::toInt32(doubleArguments[0]);
-            t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-            t.month = JSC::toInt32(doubleArguments[1]);
-            t.monthDay = (numArgs >= 3) ? JSC::toInt32(doubleArguments[2]) : 1;
-            t.hour = JSC::toInt32(doubleArguments[3]);
-            t.minute = JSC::toInt32(doubleArguments[4]);
-            t.second = JSC::toInt32(doubleArguments[5]);
-            t.isDST = -1;
+            t.setYear((year >= 0 && year <= 99) ? year : year - 1900);
+            t.setMonth(JSC::toInt32(doubleArguments[1]));
+            t.setMonthDay((numArgs >= 3) ? JSC::toInt32(doubleArguments[2]) : 1);
+            t.setHour(JSC::toInt32(doubleArguments[3]));
+            t.setMinute(JSC::toInt32(doubleArguments[4]));
+            t.setSecond(JSC::toInt32(doubleArguments[5]));
+            t.setIsDST(-1);
             double ms = (numArgs >= 7) ? doubleArguments[6] : 0;
             value = gregorianDateTimeToMS(exec, t, ms, false);
         }
@@ -214,12 +214,12 @@ static EncodedJSValue JSC_HOST_CALL dateUTC(ExecState* exec)
 
     GregorianDateTime t;
     int year = JSC::toInt32(doubleArguments[0]);
-    t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-    t.month = JSC::toInt32(doubleArguments[1]);
-    t.monthDay = (n >= 3) ? JSC::toInt32(doubleArguments[2]) : 1;
-    t.hour = JSC::toInt32(doubleArguments[3]);
-    t.minute = JSC::toInt32(doubleArguments[4]);
-    t.second = JSC::toInt32(doubleArguments[5]);
+    t.setYear((year >= 0 && year <= 99) ? year : year - 1900);
+    t.setMonth(JSC::toInt32(doubleArguments[1]));
+    t.setMonthDay((n >= 3) ? JSC::toInt32(doubleArguments[2]) : 1);
+    t.setHour(JSC::toInt32(doubleArguments[3]));
+    t.setMinute(JSC::toInt32(doubleArguments[4]));
+    t.setSecond(JSC::toInt32(doubleArguments[5]));
     double ms = (n >= 7) ? doubleArguments[6] : 0;
     return JSValue::encode(jsNumber(timeClip(gregorianDateTimeToMS(exec, t, ms, true))));
 }
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index 7bc0cbc0f..e8714c14c 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -55,53 +55,41 @@ using namespace WTF;
 
 namespace JSC {
 
-double parseDate(ExecState* exec, const UString &date)
-{
-    if (date == exec->globalData().cachedDateString)
-        return exec->globalData().cachedDateStringValue;
-    double value = parseES5DateFromNullTerminatedCharacters(date.utf8().data());
-    if (isnan(value))
-        value = parseDateFromNullTerminatedCharacters(exec, date.utf8().data());
-    exec->globalData().cachedDateString = date;
-    exec->globalData().cachedDateStringValue = value;
-    return value;
-}
-
 void formatDate(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
     snprintf(buffer, DateConversionBufferSize, "%s %s %02d %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        monthName[t.month], t.monthDay, t.year + 1900);
+        weekdayName[(t.weekDay() + 6) % 7],
+        monthName[t.month()], t.monthDay(), t.year() + 1900);
 }
 
 void formatDateUTCVariant(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
     snprintf(buffer, DateConversionBufferSize, "%s, %02d %s %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        t.monthDay, monthName[t.month], t.year + 1900);
+        weekdayName[(t.weekDay() + 6) % 7],
+        t.monthDay(), monthName[t.month()], t.year() + 1900);
 }
 
 void formatTime(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    int offset = abs(gmtoffset(t));
+    int offset = abs(t.utcOffset());
     char timeZoneName[70];
     struct tm gtm = t;
     strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 
     if (timeZoneName[0]) {
         snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-            t.hour, t.minute, t.second,
-            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+            t.hour(), t.minute(), t.second(),
+            t.utcOffset() < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
     } else {
         snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT%c%02d%02d",
-            t.hour, t.minute, t.second,
-            gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
+            t.hour(), t.minute(), t.second(),
+            t.utcOffset() < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
     }
 }
 
 void formatTimeUTC(const GregorianDateTime &t, DateConversionBuffer& buffer)
 {
-    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
+    snprintf(buffer, DateConversionBufferSize, "%02d:%02d:%02d GMT", t.hour(), t.minute(), t.second());
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/DateConversion.h b/Source/JavaScriptCore/runtime/DateConversion.h
index ff32b503d..0b078cd34 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.h
+++ b/Source/JavaScriptCore/runtime/DateConversion.h
@@ -42,17 +42,15 @@
 #ifndef DateConversion_h
 #define DateConversion_h
 
-#include "UString.h"
+#include <wtf/GregorianDateTime.h>
 
 namespace JSC {
 
 class ExecState;
-struct GregorianDateTime;
 
 static const unsigned DateConversionBufferSize = 100;
 typedef char DateConversionBuffer[DateConversionBufferSize];
 
-double parseDate(ExecState* exec, const UString&);
 void formatDate(const GregorianDateTime&, DateConversionBuffer&);
 void formatDateUTCVariant(const GregorianDateTime&, DateConversionBuffer&);
 void formatTime(const GregorianDateTime&, DateConversionBuffer&);
diff --git a/Source/JavaScriptCore/runtime/DateInstance.h b/Source/JavaScriptCore/runtime/DateInstance.h
index 7c976a514..9742e6889 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.h
+++ b/Source/JavaScriptCore/runtime/DateInstance.h
@@ -23,10 +23,6 @@
 
 #include "JSWrapperObject.h"
 
-namespace WTF {
-    struct GregorianDateTime;
-}
-
 namespace JSC {
 
     class DateInstance : public JSWrapperObject {
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index d3d0fe574..aa65acd05 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -222,13 +222,13 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 #if OS(WINDOWS)
     SYSTEMTIME systemTime;
     memset(&systemTime, 0, sizeof(systemTime));
-    systemTime.wYear = gdt.year + 1900;
-    systemTime.wMonth = gdt.month + 1;
-    systemTime.wDay = gdt.monthDay;
-    systemTime.wDayOfWeek = gdt.weekDay;
-    systemTime.wHour = gdt.hour;
-    systemTime.wMinute = gdt.minute;
-    systemTime.wSecond = gdt.second;
+    systemTime.wYear = gdt.year() + 1900;
+    systemTime.wMonth = gdt.month() + 1;
+    systemTime.wDay = gdt.monthDay();
+    systemTime.wDayOfWeek = gdt.weekDay();
+    systemTime.wHour = gdt.hour();
+    systemTime.wMinute = gdt.minute();
+    systemTime.wSecond = gdt.second();
 
     Vector<UChar, 128> buffer;
     size_t length = 0;
@@ -265,7 +265,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
 
     // Offset year if needed
     struct tm localTM = gdt;
-    int year = gdt.year + 1900;
+    int year = gdt.year() + 1900;
     bool yearNeedsOffset = year < 1900 || year > 2038;
     if (yearNeedsOffset)
         localTM.tm_year = equivalentYearForDST(year) - 1900;
@@ -357,7 +357,7 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, int maxArgs, double* ms
 
     // hours
     if (maxArgs >= 4 && idx < numArgs) {
-        t->hour = 0;
+        t->setHour(0);
         double hours = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(hours);
         milliseconds += hours * msPerHour;
@@ -365,7 +365,7 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, int maxArgs, double* ms
 
     // minutes
     if (maxArgs >= 3 && idx < numArgs && ok) {
-        t->minute = 0;
+        t->setMinute(0);
         double minutes = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(minutes);
         milliseconds += minutes * msPerMinute;
@@ -373,7 +373,7 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, int maxArgs, double* ms
     
     // seconds
     if (maxArgs >= 2 && idx < numArgs && ok) {
-        t->second = 0;
+        t->setSecond(0);
         double seconds = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(seconds);
         milliseconds += seconds * msPerSecond;
@@ -412,19 +412,19 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, int maxArgs, double *ms
     if (maxArgs >= 3 && idx < numArgs) {
         double years = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(years);
-        t->year = toInt32(years - 1900);
+        t->setYear(toInt32(years - 1900));
     }
     // months
     if (maxArgs >= 2 && idx < numArgs && ok) {
         double months = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(months);
-        t->month = toInt32(months);
+        t->setMonth(toInt32(months));
     }
     // days
     if (idx < numArgs && ok) {
         double days = exec->argument(idx++).toIntegerPreserveNaN(exec);
         ok = isfinite(days);
-        t->monthDay = 0;
+        t->setMonthDay(0);
         *ms += days * msPerDay;
     }
     
@@ -567,10 +567,10 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
     int ms = static_cast<int>(fmod(thisDateObj->internalNumber(), msPerSecond));
     if (ms < 0)
         ms += msPerSecond;
-    if (gregorianDateTime->year > 8099 || gregorianDateTime->year < -1900)
-        snprintf(buffer, sizeof(buffer) - 1, "%+07d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, ms);
+    if (gregorianDateTime->year() > 8099 || gregorianDateTime->year() < -1900)
+        snprintf(buffer, sizeof(buffer) - 1, "%+07d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
     else
-        snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year, gregorianDateTime->month + 1, gregorianDateTime->monthDay, gregorianDateTime->hour, gregorianDateTime->minute, gregorianDateTime->second, ms);
+        snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
     buffer[sizeof(buffer) - 1] = 0;
     return JSValue::encode(jsNontrivialString(exec, buffer));
 }
@@ -657,7 +657,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year));
+    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
@@ -671,7 +671,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year));
+    return JSValue::encode(jsNumber(1900 + gregorianDateTime->year()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec)
@@ -703,7 +703,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->month));
+    return JSValue::encode(jsNumber(gregorianDateTime->month()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
@@ -717,7 +717,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->month));
+    return JSValue::encode(jsNumber(gregorianDateTime->month()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
@@ -731,7 +731,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->monthDay));
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
@@ -745,7 +745,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->monthDay));
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
@@ -759,7 +759,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->weekDay));
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
@@ -773,7 +773,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->weekDay));
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
@@ -787,7 +787,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->hour));
+    return JSValue::encode(jsNumber(gregorianDateTime->hour()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
@@ -801,7 +801,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->hour));
+    return JSValue::encode(jsNumber(gregorianDateTime->hour()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
@@ -815,7 +815,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->minute));
+    return JSValue::encode(jsNumber(gregorianDateTime->minute()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
@@ -829,7 +829,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->minute));
+    return JSValue::encode(jsNumber(gregorianDateTime->minute()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
@@ -843,7 +843,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->second));
+    return JSValue::encode(jsNumber(gregorianDateTime->second()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
@@ -857,7 +857,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(gregorianDateTime->second));
+    return JSValue::encode(jsNumber(gregorianDateTime->second()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
@@ -903,7 +903,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
         return JSValue::encode(jsNaN());
-    return JSValue::encode(jsNumber(-gregorianDateTime->utcOffset / minutesPerHour));
+    return JSValue::encode(jsNumber(-gregorianDateTime->utcOffset() / minutesPerHour));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
@@ -1087,36 +1087,36 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
     if (!thisValue.inherits(&DateInstance::s_info))
         return throwVMTypeError(exec);
 
-    DateInstance* thisDateObj = asDateInstance(thisValue);     
+    DateInstance* thisDateObj = asDateInstance(thisValue);
     if (!exec->argumentCount()) { 
         JSValue result = jsNaN();
         thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }
-    
+
     double milli = thisDateObj->internalNumber();
     double ms = 0;
 
     GregorianDateTime gregorianDateTime;
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
-        // the time must be reset to +0 if it is NaN. 
+        // the time must be reset to +0 if it is NaN.
         msToGregorianDateTime(exec, 0, true, gregorianDateTime);
-    else {   
+    else {
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
         if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
             gregorianDateTime.copyFrom(*other);
     }
-    
+
     double year = exec->argument(0).toIntegerPreserveNaN(exec);
     if (!isfinite(year)) {
         JSValue result = jsNaN();
         thisDateObj->setInternalValue(exec->globalData(), result);
         return JSValue::encode(result);
     }
-            
-    gregorianDateTime.year = toInt32((year > 99 || year < 0) ? year - 1900 : year);
+
+    gregorianDateTime.setYear(toInt32((year > 99 || year < 0) ? year - 1900 : year));
     JSValue result = jsNumber(gregorianDateTimeToMS(exec, gregorianDateTime, ms, false));
     thisDateObj->setInternalValue(exec->globalData(), result);
     return JSValue::encode(result);
@@ -1135,7 +1135,7 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
         return JSValue::encode(jsNaN());
 
     // NOTE: IE returns the full year even in getYear.
-    return JSValue::encode(jsNumber(gregorianDateTime->year));
+    return JSValue::encode(jsNumber(gregorianDateTime->year()));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp b/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
index d9f96fa1e..c052c61ba 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
@@ -34,6 +34,7 @@ DefaultGCActivityCallback::DefaultGCActivityCallback(Heap* heap)
 
 void DefaultGCActivityCallback::doWork()
 {
+    JSLock lock(SilenceAssertionsOnly);
     m_globalData->heap.collect(Heap::DoNotSweep);
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.cpp b/Source/JavaScriptCore/runtime/JSDateMath.cpp
index dbe748835..a7840938c 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.cpp
+++ b/Source/JavaScriptCore/runtime/JSDateMath.cpp
@@ -203,8 +203,8 @@ double getUTCOffset(ExecState* exec)
 
 double gregorianDateTimeToMS(ExecState* exec, const GregorianDateTime& t, double milliSeconds, bool inputIsUTC)
 {
-    double day = dateToDaysFrom1970(t.year + 1900, t.month, t.monthDay);
-    double ms = timeToMS(t.hour, t.minute, t.second, milliSeconds);
+    double day = dateToDaysFrom1970(t.year() + 1900, t.month(), t.monthDay());
+    double ms = timeToMS(t.hour(), t.minute(), t.second(), milliSeconds);
     double result = (day * WTF::msPerDay) + ms;
 
     if (!inputIsUTC) { // convert to UTC
@@ -228,17 +228,16 @@ void msToGregorianDateTime(ExecState* exec, double ms, bool outputIsUTC, Gregori
     }
 
     const int year = msToYear(ms);
-    tm.second   =  msToSeconds(ms);
-    tm.minute   =  msToMinutes(ms);
-    tm.hour     =  msToHours(ms);
-    tm.weekDay  =  msToWeekDay(ms);
-    tm.yearDay  =  dayInYear(ms, year);
-    tm.monthDay =  dayInMonthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
-    tm.year     =  year - 1900;
-    tm.isDST    =  dstOff != 0.0;
-    tm.utcOffset = static_cast<long>((dstOff + utcOff) / WTF::msPerSecond);
-    tm.timeZone = nullptr;
+    tm.setSecond(msToSeconds(ms));
+    tm.setMinute(msToMinutes(ms));
+    tm.setHour(msToHours(ms));
+    tm.setWeekDay(msToWeekDay(ms));
+    tm.setYearDay(dayInYear(ms, year));
+    tm.setMonthDay(dayInMonthFromDayInYear(tm.yearDay(), isLeapYear(year)));
+    tm.setMonth(monthFromDayInYear(tm.yearDay(), isLeapYear(year)));
+    tm.setYear(year - 1900);
+    tm.setIsDST(dstOff != 0.0);
+    tm.setUtcOffset(static_cast<long>((dstOff + utcOff) / WTF::msPerSecond));
 }
 
 double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateString)
@@ -259,4 +258,16 @@ double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateSt
     return ms - (offset * WTF::msPerMinute);
 }
 
+double parseDate(ExecState* exec, const UString& date)
+{
+    if (date == exec->globalData().cachedDateString)
+        return exec->globalData().cachedDateStringValue;
+    double value = parseES5DateFromNullTerminatedCharacters(date.utf8().data());
+    if (isnan(value))
+        value = parseDateFromNullTerminatedCharacters(exec, date.utf8().data());
+    exec->globalData().cachedDateString = date;
+    exec->globalData().cachedDateStringValue = value;
+    return value;
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.h b/Source/JavaScriptCore/runtime/JSDateMath.h
index f77cf1e75..c7fb5a975 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.h
+++ b/Source/JavaScriptCore/runtime/JSDateMath.h
@@ -44,98 +44,18 @@
 #define JSDateMath_h
 
 #include <wtf/DateMath.h>
+#include <wtf/GregorianDateTime.h>
 
 namespace JSC {
 
 class ExecState;
-struct GregorianDateTime;
+class UString;
 
 void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
 double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
 double getUTCOffset(ExecState*);
 double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
-
-// Intentionally overridding the default tm of the system.
-// The members of tm differ on various operating systems.
-struct GregorianDateTime {
-    WTF_MAKE_NONCOPYABLE(GregorianDateTime);
-public:
-    GregorianDateTime()
-        : second(0)
-        , minute(0)
-        , hour(0)
-        , weekDay(0)
-        , monthDay(0)
-        , yearDay(0)
-        , month(0)
-        , year(0)
-        , isDST(0)
-        , utcOffset(0)
-    {
-    }
-
-    operator tm() const
-    {
-        tm ret;
-        memset(&ret, 0, sizeof(ret));
-
-        ret.tm_sec   =  second;
-        ret.tm_min   =  minute;
-        ret.tm_hour  =  hour;
-        ret.tm_wday  =  weekDay;
-        ret.tm_mday  =  monthDay;
-        ret.tm_yday  =  yearDay;
-        ret.tm_mon   =  month;
-        ret.tm_year  =  year;
-        ret.tm_isdst =  isDST;
-
-#if HAVE(TM_GMTOFF)
-        ret.tm_gmtoff = static_cast<long>(utcOffset);
-#endif
-#if HAVE(TM_ZONE)
-        ret.tm_zone = timeZone.get();
-#endif
-
-        return ret;
-    }
-
-    void copyFrom(const GregorianDateTime& rhs)
-    {
-        second = rhs.second;
-        minute = rhs.minute;
-        hour = rhs.hour;
-        weekDay = rhs.weekDay;
-        monthDay = rhs.monthDay;
-        yearDay = rhs.yearDay;
-        month = rhs.month;
-        year = rhs.year;
-        isDST = rhs.isDST;
-        utcOffset = rhs.utcOffset;
-        if (rhs.timeZone) {
-            int inZoneSize = strlen(rhs.timeZone.get()) + 1;
-            timeZone = adoptArrayPtr(new char[inZoneSize]);
-            strncpy(timeZone.get(), rhs.timeZone.get(), inZoneSize);
-        } else
-            timeZone = nullptr;
-    }
-
-    int second;
-    int minute;
-    int hour;
-    int weekDay;
-    int monthDay;
-    int yearDay;
-    int month;
-    int year;
-    int isDST;
-    int utcOffset;
-    OwnArrayPtr<char> timeZone;
-};
-
-static inline int gmtoffset(const GregorianDateTime& t)
-{
-    return t.utcOffset;
-}
+double parseDate(ExecState*, const UString&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 587929f66..a84597f8b 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -99,10 +99,11 @@ void JSObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     PropertyStorage storage = thisObject->outOfLineStorage();
     if (storage) {
         size_t storageSize = thisObject->structure()->outOfLineSizeForKnownNonFinalObject();
+        size_t capacity = thisObject->structure()->outOfLineCapacity();
         // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
-        void* temp = storage;
-        visitor.copyAndAppend(&temp, thisObject->structure()->outOfLineCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
-        storage = static_cast<PropertyStorage>(temp);
+        void* temp = storage - capacity - 1;
+        visitor.copyAndAppend(&temp, capacity * sizeof(WriteBarrierBase<Unknown>), (storage - storageSize - 1)->slot(), storageSize);
+        storage = static_cast<PropertyStorage>(temp) + capacity + 1;
         thisObject->m_outOfLineStorage.set(storage, StorageBarrier::Unchecked);
     }
 
@@ -128,10 +129,11 @@ void JSFinalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     PropertyStorage storage = thisObject->outOfLineStorage();
     if (storage) {
         size_t storageSize = thisObject->structure()->outOfLineSizeForKnownFinalObject();
+        size_t capacity = thisObject->structure()->outOfLineCapacity();
         // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
-        void* temp = storage;
-        visitor.copyAndAppend(&temp, thisObject->structure()->outOfLineCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
-        storage = static_cast<PropertyStorage>(temp);
+        void* temp = storage - capacity - 1;
+        visitor.copyAndAppend(&temp, thisObject->structure()->outOfLineCapacity() * sizeof(WriteBarrierBase<Unknown>), (storage - storageSize - 1)->slot(), storageSize);
+        storage = static_cast<PropertyStorage>(temp) + capacity + 1;
         thisObject->m_outOfLineStorage.set(storage, StorageBarrier::Unchecked);
     }
 
@@ -595,7 +597,7 @@ PropertyStorage JSObject::growOutOfLineStorage(JSGlobalData& globalData, size_t
 
     // It's important that this function not rely on structure(), since
     // we might be in the middle of a transition.
-
+    
     PropertyStorage oldPropertyStorage = m_outOfLineStorage.get();
     PropertyStorage newPropertyStorage = 0;
 
@@ -603,9 +605,9 @@ PropertyStorage JSObject::growOutOfLineStorage(JSGlobalData& globalData, size_t
     void* temp = newPropertyStorage;
     if (!globalData.heap.tryAllocateStorage(sizeof(WriteBarrierBase<Unknown>) * newSize, &temp))
         CRASH();
-    newPropertyStorage = static_cast<PropertyStorage>(temp);
+    newPropertyStorage = static_cast<PropertyStorage>(temp) + newSize + 1;
     
-    memcpy(newPropertyStorage, oldPropertyStorage, sizeof(WriteBarrierBase<Unknown>) * oldSize);
+    memcpy(newPropertyStorage - oldSize - 1, oldPropertyStorage - oldSize - 1, sizeof(WriteBarrierBase<Unknown>) * oldSize);
 
     ASSERT(newPropertyStorage);
     return newPropertyStorage;
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 9972d6077..cc43440ab 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -173,14 +173,14 @@ namespace JSC {
         {
             PropertyOffset offset = structure()->get(globalData, propertyName);
             checkOffset(offset, structure()->typeInfo().type());
-            return offset != invalidOffset ? locationForOffset(offset) : 0;
+            return isValidOffset(offset) ? locationForOffset(offset) : 0;
         }
 
         WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes)
         {
             JSCell* specificFunction;
             PropertyOffset offset = structure()->get(globalData, propertyName, attributes, specificFunction);
-            return offset != invalidOffset ? locationForOffset(offset) : 0;
+            return isValidOffset(offset) ? locationForOffset(offset) : 0;
         }
 
         bool hasInlineStorage() const { return structure()->hasInlineStorage(); }
@@ -227,7 +227,7 @@ namespace JSC {
             if (offsetInInlineStorage < static_cast<size_t>(inlineStorageCapacity))
                 result = offsetInInlineStorage;
             else
-                result = location - outOfLineStorage() + firstOutOfLineOffset;
+                result = outOfLineStorage() - location + (inlineStorageCapacity - 2);
             validateOffset(result, structure()->typeInfo().type());
             return result;
         }
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index 6f98bd6f7..19a8c4759 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -254,7 +254,7 @@ namespace JSC {
         
         JSValue structureOrUndefined() const;
 
-        char* description() const;
+        JS_EXPORT_PRIVATE char* description() const;
 
         JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
 
diff --git a/Source/JavaScriptCore/runtime/PropertyOffset.h b/Source/JavaScriptCore/runtime/PropertyOffset.h
index c0d1316c4..3883d910f 100644
--- a/Source/JavaScriptCore/runtime/PropertyOffset.h
+++ b/Source/JavaScriptCore/runtime/PropertyOffset.h
@@ -118,7 +118,7 @@ inline size_t offsetInOutOfLineStorage(PropertyOffset offset)
 {
     validateOffset(offset);
     ASSERT(isOutOfLineOffset(offset));
-    return offset - firstOutOfLineOffset;
+    return -static_cast<ptrdiff_t>(offset - firstOutOfLineOffset) - 2;
 }
 
 inline size_t offsetInRespectiveStorage(PropertyOffset offset)
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 76c17133f..9eefd2bb3 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,39 @@
+2012-07-23  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Add droppedFrameCount to renderingStats.
+        https://bugs.webkit.org/show_bug.cgi?id=91694
+
+        Reviewed by Adrienne Walker.
+
+        * chromium/public/WebRenderingStats.h:
+        (WebRenderingStats):
+        (WebKit::WebRenderingStats::WebRenderingStats):
+
+2012-07-23  Brian Anderson  <brianderson@chromium.org>
+
+        [chromium] Use shallow flushes that don't glFlush
+        https://bugs.webkit.org/show_bug.cgi?id=90325
+
+        Reviewed by Kenneth Russell.
+
+        Adds shallowFlushCHROMIUM to WebGraphicsContext3D.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::shallowFlushCHROMIUM):
+
+2012-07-23  Tommy Widenflycht  <tommyw@google.com>
+
+        [chromium] MediaStream API: Clean up the MockWebKitPlatformSupport object at shutdown
+        https://bugs.webkit.org/show_bug.cgi?id=91857
+
+        Reviewed by Adam Barth.
+
+        Made Platforms destructor virtual.
+
+        * chromium/public/Platform.h:
+        (WebKit::Platform::~Platform):
+
 2012-07-18  Antoine Labour  <piman@chromium.org>
 
         [chromium] Introduce CCResourceProvider, replacing TextureAllocator and hiding textures from clients to allow transport
diff --git a/Source/Platform/chromium/public/Platform.h b/Source/Platform/chromium/public/Platform.h
index b0b0e6ed2..64df3ba89 100644
--- a/Source/Platform/chromium/public/Platform.h
+++ b/Source/Platform/chromium/public/Platform.h
@@ -424,7 +424,7 @@ public:
     virtual void didStopWorkerRunLoop(const WebWorkerRunLoop&) { }
 
 protected:
-    ~Platform() { }
+    virtual ~Platform() { }
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
index 44c206719..e7d7a64b4 100644
--- a/Source/Platform/chromium/public/WebGraphicsContext3D.h
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -421,6 +421,9 @@ public:
     virtual void copyTextureCHROMIUM(WGC3Denum target, WGC3Duint sourceId,
                                      WGC3Duint destId, WGC3Dint level, WGC3Denum internalFormat) { }
 
+    // GL_CHROMIUM_shallow_flush
+    virtual void shallowFlushCHROMIUM() { }
+
     GrGLInterface* createGrGLInterface();
 
 protected:
diff --git a/Source/Platform/chromium/public/WebRenderingStats.h b/Source/Platform/chromium/public/WebRenderingStats.h
index f1769855b..e24af2b69 100644
--- a/Source/Platform/chromium/public/WebRenderingStats.h
+++ b/Source/Platform/chromium/public/WebRenderingStats.h
@@ -31,10 +31,12 @@ namespace WebKit {
 struct WebRenderingStats {
     int numAnimationFrames;
     int numFramesSentToScreen;
+    int droppedFrameCount;
 
     WebRenderingStats()
         : numAnimationFrames(0)
         , numFramesSentToScreen(0)
+        , droppedFrameCount(0)
     {
     }
 };
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index b61d78c35..72543899f 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,67 @@
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move GregorianDateTime from JSC to WTF namespace
+        https://bugs.webkit.org/show_bug.cgi?id=91948
+
+        Reviewed by Geoffrey Garen.
+
+        Moving GregorianDateTime into the WTF namespace allows us to us to
+        use it in WebCore too. The new class has the same behaviour as the
+        old struct. Only the unused timeZone member has been removed.
+
+        * GNUmakefile.list.am:
+        * WTF.gypi:
+        * WTF.pro:
+        * WTF.vcproj/WTF.vcproj:
+        * WTF.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/GregorianDateTime.h: Added.
+        (GregorianDateTime):
+
+2012-07-23  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Merge createThreadInternal implementations
+        https://bugs.webkit.org/show_bug.cgi?id=91899
+
+        Reviewed by Yong Li.
+
+        PR 111675
+
+        Remove our implementation since the default thread stack size on QNX is fine.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::createThreadInternal):
+        (WTF::initializeCurrentThreadInternal): make sure we set the thread name.
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [WINCE] Define NOMINMAX in the build system instead of Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=91938
+
+        Reviewed by Ryosuke Niwa.
+
+        * wtf/Platform.h:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for Windows after r123317.
+
+        * wtf/DateMath.cpp: Added missing header include.
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use GetTimeZoneInformation() for calculateUTCOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=91935
+
+        Reviewed by Ryosuke Niwa.
+
+        GetTimeZoneInformation() returns the offset directly. Using it
+        avoids unnecessary calculations and remove dependencies on
+        other time related function, which do not exist on WinCE.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
 2012-07-20  Han Shen  <shenhan@google.com>
 
         [Chromium] Compilation fails under gcc 4.7
diff --git a/Source/WTF/GNUmakefile.list.am b/Source/WTF/GNUmakefile.list.am
index 5f0ddd695..bb68bc268 100644
--- a/Source/WTF/GNUmakefile.list.am
+++ b/Source/WTF/GNUmakefile.list.am
@@ -52,6 +52,7 @@ wtf_sources += \
     Source/WTF/wtf/Forward.h \
     Source/WTF/wtf/Functional.h \
     Source/WTF/wtf/GetPtr.h \
+    Source/WTF/wtf/GregorianDateTime.h \
     Source/WTF/wtf/HashCountedSet.h \
     Source/WTF/wtf/HashFunctions.h \
     Source/WTF/wtf/HashIterators.h \
diff --git a/Source/WTF/WTF.gypi b/Source/WTF/WTF.gypi
index eb280703a..ebb41a454 100644
--- a/Source/WTF/WTF.gypi
+++ b/Source/WTF/WTF.gypi
@@ -34,6 +34,7 @@
             'wtf/Forward.h',
             'wtf/Functional.h',
             'wtf/GetPtr.h',
+            'wtf/GregorianDateTime.h',
             'wtf/HashCountedSet.h',
             'wtf/HashFunctions.h',
             'wtf/HashIterators.h',
diff --git a/Source/WTF/WTF.pro b/Source/WTF/WTF.pro
index 4bcb0ff0a..68d847112 100644
--- a/Source/WTF/WTF.pro
+++ b/Source/WTF/WTF.pro
@@ -61,6 +61,7 @@ HEADERS += \
     Forward.h \
     Functional.h \
     GetPtr.h \
+    GregorianDateTime.h \
     HashCountedSet.h \
     HashFunctions.h \
     HashIterators.h \
diff --git a/Source/WTF/WTF.vcproj/WTF.vcproj b/Source/WTF/WTF.vcproj/WTF.vcproj
index d1a295c87..1ac32b4d6 100644
--- a/Source/WTF/WTF.vcproj/WTF.vcproj
+++ b/Source/WTF/WTF.vcproj/WTF.vcproj
@@ -797,6 +797,10 @@
 			>
 		</File>
 		<File
+			RelativePath="..\wtf\GregorianDateTime.h"
+			>
+		</File>
+		<File
 			RelativePath="..\wtf\HashCountedSet.h"
 			>
 		</File>
diff --git a/Source/WTF/WTF.xcodeproj/project.pbxproj b/Source/WTF/WTF.xcodeproj/project.pbxproj
index c47ec1946..372c15ec0 100644
--- a/Source/WTF/WTF.xcodeproj/project.pbxproj
+++ b/Source/WTF/WTF.xcodeproj/project.pbxproj
@@ -7,9 +7,10 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		0FD81AC5154FB22E00983E72 /* FastBitVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD81AC4154FB22E00983E72 /* FastBitVector.h */; settings = {ATTRIBUTES = (); }; };
 		143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 143F611D1565F0F900DB514A /* RAMSize.cpp */; };
 		143F61201565F0F900DB514A /* RAMSize.h in Headers */ = {isa = PBXBuildFile; fileRef = 143F611E1565F0F900DB514A /* RAMSize.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0FD81AC5154FB22E00983E72 /* FastBitVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD81AC4154FB22E00983E72 /* FastBitVector.h */; settings = {ATTRIBUTES = (); }; };
+		2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 2C05385315BC819000F21B96 /* GregorianDateTime.h */; };
 		4330F38F15745B0500AAFA8F /* URLString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4330F38E15745B0500AAFA8F /* URLString.cpp */; };
 		4F0321BC156AA8D1006EBAF6 /* BitArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F0321BB156AA8D1006EBAF6 /* BitArray.h */; };
 		8134013815B092FD001FF0B8 /* Base64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8134013615B092FD001FF0B8 /* Base64.cpp */; };
@@ -247,9 +248,10 @@
 /* End PBXBuildFile section */
 
 /* Begin PBXFileReference section */
+		0FD81AC4154FB22E00983E72 /* FastBitVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FastBitVector.h; sourceTree = "<group>"; };
 		143F611D1565F0F900DB514A /* RAMSize.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RAMSize.cpp; sourceTree = "<group>"; };
 		143F611E1565F0F900DB514A /* RAMSize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RAMSize.h; sourceTree = "<group>"; };
-		0FD81AC4154FB22E00983E72 /* FastBitVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FastBitVector.h; sourceTree = "<group>"; };
+		2C05385315BC819000F21B96 /* GregorianDateTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GregorianDateTime.h; sourceTree = "<group>"; };
 		4330F38E15745B0500AAFA8F /* URLString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = URLString.cpp; sourceTree = "<group>"; };
 		4F0321BB156AA8D1006EBAF6 /* BitArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitArray.h; sourceTree = "<group>"; };
 		5D247B6214689B8600E78B76 /* libWTF.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -538,9 +540,9 @@
 		5D247B7614689D7600E78B76 /* Source */ = {
 			isa = PBXGroup;
 			children = (
+				A876DBD6151816E500DADB95 /* wtf */,
 				A8A4748B151A8264004123FF /* config.h */,
 				5D247EB11468B01500E78B76 /* HeaderDetection.h */,
-				A876DBD6151816E500DADB95 /* wtf */,
 			);
 			name = Source;
 			sourceTree = "<group>";
@@ -548,8 +550,12 @@
 		A876DBD6151816E500DADB95 /* wtf */ = {
 			isa = PBXGroup;
 			children = (
-				143F611D1565F0F900DB514A /* RAMSize.cpp */,
-				143F611E1565F0F900DB514A /* RAMSize.h */,
+				A8A47281151A825A004123FF /* dtoa */,
+				A8A472C4151A825A004123FF /* mac */,
+				A8A4731B151A825B004123FF /* text */,
+				A8A47339151A825B004123FF /* threads */,
+				A8A47348151A825B004123FF /* unicode */,
+				A8A4735E151A825B004123FF /* url */,
 				A8A47254151A825A004123FF /* Alignment.h */,
 				A8A47255151A825A004123FF /* AlwaysInline.h */,
 				A8A47256151A825A004123FF /* ArrayBuffer.cpp */,
@@ -561,8 +567,8 @@
 				A8A4725C151A825A004123FF /* Assertions.h */,
 				A8A4725D151A825A004123FF /* Atomics.h */,
 				A8A4725E151A825A004123FF /* AVLTree.h */,
-				A8A4725F151A825A004123FF /* Bitmap.h */,
 				4F0321BB156AA8D1006EBAF6 /* BitArray.h */,
+				A8A4725F151A825A004123FF /* Bitmap.h */,
 				A8A47260151A825A004123FF /* BitVector.cpp */,
 				A8A47261151A825A004123FF /* BitVector.h */,
 				A8A47264151A825A004123FF /* BlockStack.h */,
@@ -588,7 +594,6 @@
 				A8A4727E151A825A004123FF /* Deque.h */,
 				A8A4727F151A825A004123FF /* DisallowCType.h */,
 				A8A47280151A825A004123FF /* DoublyLinkedList.h */,
-				A8A47281151A825A004123FF /* dtoa */,
 				A8A47297151A825A004123FF /* dtoa.cpp */,
 				A8A47298151A825A004123FF /* dtoa.h */,
 				A8A47299151A825A004123FF /* DynamicAnnotations.cpp */,
@@ -605,6 +610,7 @@
 				A8A472A6151A825A004123FF /* Forward.h */,
 				A8A472A7151A825A004123FF /* Functional.h */,
 				A8A472A8151A825A004123FF /* GetPtr.h */,
+				2C05385315BC819000F21B96 /* GregorianDateTime.h */,
 				A8A472B3151A825A004123FF /* HashCountedSet.h */,
 				A8A472B4151A825A004123FF /* HashFunctions.h */,
 				A8A472B5151A825A004123FF /* HashIterators.h */,
@@ -615,14 +621,13 @@
 				A8A472BA151A825A004123FF /* HashTraits.h */,
 				A8A472BB151A825A004123FF /* HexNumber.h */,
 				A8A472BC151A825A004123FF /* InlineASM.h */,
-				A8A472BD151A825A004123FF /* Int8Array.h */,
 				A8A472BE151A825A004123FF /* Int16Array.h */,
 				A8A472BF151A825A004123FF /* Int32Array.h */,
+				A8A472BD151A825A004123FF /* Int8Array.h */,
 				A8A472C0151A825A004123FF /* IntegralTypedArrayBase.h */,
 				A8A472C1151A825A004123FF /* ListHashSet.h */,
 				A8A472C2151A825A004123FF /* ListRefPtr.h */,
 				A8A472C3151A825A004123FF /* Locker.h */,
-				A8A472C4151A825A004123FF /* mac */,
 				A8A472C6151A825A004123FF /* MainThread.cpp */,
 				A8A472C7151A825B004123FF /* MainThread.h */,
 				A8A472C8151A825B004123FF /* MallocZoneSupport.h */,
@@ -661,7 +666,10 @@
 				A8A472ED151A825B004123FF /* PassRefPtr.h */,
 				A8A472EE151A825B004123FF /* PassTraits.h */,
 				A8A472EF151A825B004123FF /* Platform.h */,
+				A876DBD7151816E500DADB95 /* Platform.h */,
 				A8A472F3151A825B004123FF /* PossiblyNull.h */,
+				143F611D1565F0F900DB514A /* RAMSize.cpp */,
+				143F611E1565F0F900DB514A /* RAMSize.h */,
 				A8A472FB151A825B004123FF /* RandomNumber.cpp */,
 				A8A472FC151A825B004123FF /* RandomNumber.h */,
 				A8A472FD151A825B004123FF /* RandomNumberSeed.h */,
@@ -694,7 +702,6 @@
 				A8A47318151A825B004123FF /* TCSystemAlloc.cpp */,
 				A8A47319151A825B004123FF /* TCSystemAlloc.h */,
 				A8A4731A151A825B004123FF /* TemporaryChange.h */,
-				A8A4731B151A825B004123FF /* text */,
 				A8A4732F151A825B004123FF /* ThreadFunctionInvocation.h */,
 				A8A47330151A825B004123FF /* ThreadIdentifierDataPthreads.cpp */,
 				A8A47331151A825B004123FF /* ThreadIdentifierDataPthreads.h */,
@@ -703,27 +710,23 @@
 				A8A47335151A825B004123FF /* ThreadingPrimitives.h */,
 				A8A47336151A825B004123FF /* ThreadingPthreads.cpp */,
 				A8A47338151A825B004123FF /* ThreadRestrictionVerifier.h */,
-				A8A47339151A825B004123FF /* threads */,
 				A8A4733E151A825B004123FF /* ThreadSafeRefCounted.h */,
 				A8A4733F151A825B004123FF /* ThreadSpecific.h */,
 				A8A47341151A825B004123FF /* TypedArrayBase.h */,
 				A8A47342151A825B004123FF /* TypeTraits.cpp */,
 				A8A47343151A825B004123FF /* TypeTraits.h */,
-				A8A47344151A825B004123FF /* Uint8Array.h */,
-				A8A47345151A825B004123FF /* Uint8ClampedArray.h */,
 				A8A47346151A825B004123FF /* Uint16Array.h */,
 				A8A47347151A825B004123FF /* Uint32Array.h */,
-				A8A47348151A825B004123FF /* unicode */,
+				A8A47344151A825B004123FF /* Uint8Array.h */,
+				A8A47345151A825B004123FF /* Uint8ClampedArray.h */,
 				A8A4735C151A825B004123FF /* UnionFind.h */,
 				A8A4735D151A825B004123FF /* UnusedParam.h */,
-				A8A4735E151A825B004123FF /* url */,
 				A8A4736F151A825B004123FF /* ValueCheck.h */,
 				A8A47370151A825B004123FF /* Vector.h */,
 				A8A47371151A825B004123FF /* VectorTraits.h */,
 				A8A47372151A825B004123FF /* VMTags.h */,
 				A8A4737A151A825B004123FF /* WTFThreadData.cpp */,
 				A8A4737B151A825B004123FF /* WTFThreadData.h */,
-				A876DBD7151816E500DADB95 /* Platform.h */,
 			);
 			path = wtf;
 			sourceTree = "<group>";
@@ -731,13 +734,15 @@
 		A8A47281151A825A004123FF /* dtoa */ = {
 			isa = PBXGroup;
 			children = (
+				A8A47288151A825A004123FF /* COPYING */,
+				A8A47292151A825A004123FF /* LICENSE */,
+				A8A47293151A825A004123FF /* README */,
 				A8A47282151A825A004123FF /* bignum-dtoa.cc */,
 				A8A47283151A825A004123FF /* bignum-dtoa.h */,
 				A8A47284151A825A004123FF /* bignum.cc */,
 				A8A47285151A825A004123FF /* bignum.h */,
 				A8A47286151A825A004123FF /* cached-powers.cc */,
 				A8A47287151A825A004123FF /* cached-powers.h */,
-				A8A47288151A825A004123FF /* COPYING */,
 				A8A47289151A825A004123FF /* diy-fp.cc */,
 				A8A4728A151A825A004123FF /* diy-fp.h */,
 				A8A4728B151A825A004123FF /* double-conversion.cc */,
@@ -747,8 +752,6 @@
 				A8A4728F151A825A004123FF /* fast-dtoa.h */,
 				A8A47290151A825A004123FF /* fixed-dtoa.cc */,
 				A8A47291151A825A004123FF /* fixed-dtoa.h */,
-				A8A47292151A825A004123FF /* LICENSE */,
-				A8A47293151A825A004123FF /* README */,
 				A8A47294151A825A004123FF /* strtod.cc */,
 				A8A47295151A825A004123FF /* strtod.h */,
 				A8A47296151A825A004123FF /* utils.h */,
@@ -767,13 +770,13 @@
 		A8A4731B151A825B004123FF /* text */ = {
 			isa = PBXGroup;
 			children = (
-				8134013615B092FD001FF0B8 /* Base64.cpp */,
-				8134013715B092FD001FF0B8 /* Base64.h */,
 				A8A4731C151A825B004123FF /* ASCIIFastPath.h */,
 				A8A4731D151A825B004123FF /* AtomicString.cpp */,
 				A8A4731E151A825B004123FF /* AtomicString.h */,
 				A8A4731F151A825B004123FF /* AtomicStringHash.h */,
 				A8A47320151A825B004123FF /* AtomicStringImpl.h */,
+				8134013615B092FD001FF0B8 /* Base64.cpp */,
+				8134013715B092FD001FF0B8 /* Base64.h */,
 				A8A47321151A825B004123FF /* CString.cpp */,
 				A8A47322151A825B004123FF /* CString.h */,
 				A8A47323151A825B004123FF /* StringBuffer.h */,
@@ -804,10 +807,10 @@
 		A8A47348151A825B004123FF /* unicode */ = {
 			isa = PBXGroup;
 			children = (
+				A8A4734F151A825B004123FF /* icu */,
 				A8A47349151A825B004123FF /* CharacterNames.h */,
 				A8A4734A151A825B004123FF /* Collator.h */,
 				A8A4734B151A825B004123FF /* CollatorDefault.cpp */,
-				A8A4734F151A825B004123FF /* icu */,
 				A8A47354151A825B004123FF /* ScriptCodesFromICU.h */,
 				A8A47355151A825B004123FF /* Unicode.h */,
 				A8A47356151A825B004123FF /* UnicodeMacrosFromICU.h */,
@@ -871,27 +874,39 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				A876DBD8151816E500DADB95 /* Platform.h in Headers */,
 				A8A4737F151A825B004123FF /* Alignment.h in Headers */,
 				A8A47380151A825B004123FF /* AlwaysInline.h in Headers */,
 				A8A47382151A825B004123FF /* ArrayBuffer.h in Headers */,
 				A8A47384151A825B004123FF /* ArrayBufferView.h in Headers */,
 				A8A47385151A825B004123FF /* ASCIICType.h in Headers */,
+				A8A47434151A825B004123FF /* ASCIIFastPath.h in Headers */,
 				A8A47387151A825B004123FF /* Assertions.h in Headers */,
 				A8A47388151A825B004123FF /* Atomics.h in Headers */,
+				A8A47436151A825B004123FF /* AtomicString.h in Headers */,
+				A8A47437151A825B004123FF /* AtomicStringHash.h in Headers */,
+				A8A47438151A825B004123FF /* AtomicStringImpl.h in Headers */,
 				A8A47389151A825B004123FF /* AVLTree.h in Headers */,
-				A8A4738A151A825B004123FF /* Bitmap.h in Headers */,
+				8134013915B092FD001FF0B8 /* Base64.h in Headers */,
+				A8A473A9151A825B004123FF /* bignum-dtoa.h in Headers */,
+				A8A473AB151A825B004123FF /* bignum.h in Headers */,
+				A8A47452151A825B004123FF /* BinarySemaphore.h in Headers */,
 				4F0321BC156AA8D1006EBAF6 /* BitArray.h in Headers */,
+				A8A4738A151A825B004123FF /* Bitmap.h in Headers */,
 				A8A4738C151A825B004123FF /* BitVector.h in Headers */,
 				A8A4738E151A825B004123FF /* BlockStack.h in Headers */,
 				A8A4738F151A825B004123FF /* BloomFilter.h in Headers */,
 				A8A47390151A825B004123FF /* BoundsCheckedPointer.h in Headers */,
 				A8A47391151A825B004123FF /* BumpPointerAllocator.h in Headers */,
+				A8A473AD151A825B004123FF /* cached-powers.h in Headers */,
+				A8A4745E151A825B004123FF /* CharacterNames.h in Headers */,
 				A8A47394151A825B004123FF /* CheckedArithmetic.h in Headers */,
 				A8A47395151A825B004123FF /* CheckedBoolean.h in Headers */,
+				A8A4745F151A825B004123FF /* Collator.h in Headers */,
 				A8A47398151A825B004123FF /* Compiler.h in Headers */,
 				A8A47399151A825B004123FF /* Complex.h in Headers */,
+				A8A4748C151A8264004123FF /* config.h in Headers */,
 				A8A4739B151A825B004123FF /* CryptographicallyRandomNumber.h in Headers */,
+				A8A4743A151A825B004123FF /* CString.h in Headers */,
 				A8A4739D151A825B004123FF /* CurrentTime.h in Headers */,
 				A8A4739F151A825B004123FF /* DataLog.h in Headers */,
 				A8A473A1151A825B004123FF /* DateMath.h in Headers */,
@@ -899,29 +914,26 @@
 				A8A473A4151A825B004123FF /* Decoder.h in Headers */,
 				A8A473A5151A825B004123FF /* Deque.h in Headers */,
 				A8A473A6151A825B004123FF /* DisallowCType.h in Headers */,
-				A8A473A7151A825B004123FF /* DoublyLinkedList.h in Headers */,
-				A8A473A9151A825B004123FF /* bignum-dtoa.h in Headers */,
-				A8A473AB151A825B004123FF /* bignum.h in Headers */,
-				A8A473AD151A825B004123FF /* cached-powers.h in Headers */,
 				A8A473AF151A825B004123FF /* diy-fp.h in Headers */,
 				A8A473B1151A825B004123FF /* double-conversion.h in Headers */,
 				A8A473B2151A825B004123FF /* double.h in Headers */,
-				A8A473B4151A825B004123FF /* fast-dtoa.h in Headers */,
-				A8A473B6151A825B004123FF /* fixed-dtoa.h in Headers */,
-				A8A473B8151A825B004123FF /* strtod.h in Headers */,
-				A8A473B9151A825B004123FF /* utils.h in Headers */,
+				A8A473A7151A825B004123FF /* DoublyLinkedList.h in Headers */,
 				A8A473BB151A825B004123FF /* dtoa.h in Headers */,
 				A8A473BD151A825B004123FF /* DynamicAnnotations.h in Headers */,
 				A8A473C0151A825B004123FF /* Encoder.h in Headers */,
 				A8A473C1151A825B004123FF /* ExportMacros.h in Headers */,
+				A8A473B4151A825B004123FF /* fast-dtoa.h in Headers */,
 				A8A473C2151A825B004123FF /* FastAllocBase.h in Headers */,
+				0FD81AC5154FB22E00983E72 /* FastBitVector.h in Headers */,
 				A8A473C4151A825B004123FF /* FastMalloc.h in Headers */,
+				A8A473B6151A825B004123FF /* fixed-dtoa.h in Headers */,
 				A8A473C5151A825B004123FF /* FixedArray.h in Headers */,
 				A8A473C6151A825B004123FF /* Float32Array.h in Headers */,
 				A8A473C7151A825B004123FF /* Float64Array.h in Headers */,
 				A8A473C8151A825B004123FF /* Forward.h in Headers */,
 				A8A473C9151A825B004123FF /* Functional.h in Headers */,
 				A8A473CA151A825B004123FF /* GetPtr.h in Headers */,
+				2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */,
 				A8A473D3151A825B004123FF /* HashCountedSet.h in Headers */,
 				A8A473D4151A825B004123FF /* HashFunctions.h in Headers */,
 				A8A473D5151A825B004123FF /* HashIterators.h in Headers */,
@@ -931,9 +943,9 @@
 				A8A473DA151A825B004123FF /* HashTraits.h in Headers */,
 				A8A473DB151A825B004123FF /* HexNumber.h in Headers */,
 				A8A473DC151A825B004123FF /* InlineASM.h in Headers */,
-				A8A473DD151A825B004123FF /* Int8Array.h in Headers */,
 				A8A473DE151A825B004123FF /* Int16Array.h in Headers */,
 				A8A473DF151A825B004123FF /* Int32Array.h in Headers */,
+				A8A473DD151A825B004123FF /* Int8Array.h in Headers */,
 				A8A473E0151A825B004123FF /* IntegralTypedArrayBase.h in Headers */,
 				A8A473E1151A825B004123FF /* ListHashSet.h in Headers */,
 				A8A473E2151A825B004123FF /* ListRefPtr.h in Headers */,
@@ -962,14 +974,18 @@
 				A8A47404151A825B004123FF /* PageReservation.h in Headers */,
 				A8A47405151A825B004123FF /* ParallelJobs.h in Headers */,
 				A8A47408151A825B004123FF /* ParallelJobsLibdispatch.h in Headers */,
+				A8A47470151A825B004123FF /* ParsedURL.h in Headers */,
 				A8A4740A151A825B004123FF /* PassOwnArrayPtr.h in Headers */,
 				A8A4740B151A825B004123FF /* PassOwnPtr.h in Headers */,
 				A8A4740C151A825B004123FF /* PassRefPtr.h in Headers */,
 				A8A4740D151A825B004123FF /* PassTraits.h in Headers */,
+				A876DBD8151816E500DADB95 /* Platform.h in Headers */,
 				A8A4740E151A825B004123FF /* Platform.h in Headers */,
 				A8A4740F151A825B004123FF /* PossiblyNull.h in Headers */,
+				143F61201565F0F900DB514A /* RAMSize.h in Headers */,
 				A8A47415151A825B004123FF /* RandomNumber.h in Headers */,
 				A8A47416151A825B004123FF /* RandomNumberSeed.h in Headers */,
+				A8A47472151A825B004123FF /* RawURLBuffer.h in Headers */,
 				A8A47417151A825B004123FF /* RedBlackTree.h in Headers */,
 				A8A47418151A825B004123FF /* RefCounted.h in Headers */,
 				A8A47419151A825B004123FF /* RefCountedArray.h in Headers */,
@@ -977,6 +993,7 @@
 				A8A4741C151A825B004123FF /* RefPtr.h in Headers */,
 				A8A4741D151A825B004123FF /* RefPtrHashMap.h in Headers */,
 				A8A4741E151A825B004123FF /* RetainPtr.h in Headers */,
+				A8A47466151A825B004123FF /* ScriptCodesFromICU.h in Headers */,
 				A8A4741F151A825B004123FF /* SegmentedVector.h in Headers */,
 				A8A47420151A825B004123FF /* SentinelLinkedList.h in Headers */,
 				A8A47422151A825B004123FF /* SHA1.h in Headers */,
@@ -986,52 +1003,39 @@
 				A8A47428151A825B004123FF /* StackBounds.h in Headers */,
 				A8A47429151A825B004123FF /* StaticConstructors.h in Headers */,
 				A8A4742A151A825B004123FF /* StdLibExtras.h in Headers */,
+				A8A4743B151A825B004123FF /* StringBuffer.h in Headers */,
+				A8A4743D151A825B004123FF /* StringBuilder.h in Headers */,
+				A8A4743E151A825B004123FF /* StringConcatenate.h in Headers */,
 				A8A4742C151A825B004123FF /* StringExtras.h in Headers */,
+				A8A4743F151A825B004123FF /* StringHash.h in Headers */,
 				A8A4742D151A825B004123FF /* StringHasher.h in Headers */,
+				A8A47441151A825B004123FF /* StringImpl.h in Headers */,
+				A8A47442151A825B004123FF /* StringOperators.h in Headers */,
+				A8A473B8151A825B004123FF /* strtod.h in Headers */,
 				A8A4742E151A825B004123FF /* TCPackedCache.h in Headers */,
 				A8A4742F151A825B004123FF /* TCPageMap.h in Headers */,
 				A8A47430151A825B004123FF /* TCSpinLock.h in Headers */,
 				A8A47432151A825B004123FF /* TCSystemAlloc.h in Headers */,
 				A8A47433151A825B004123FF /* TemporaryChange.h in Headers */,
-				A8A47434151A825B004123FF /* ASCIIFastPath.h in Headers */,
-				A8A47436151A825B004123FF /* AtomicString.h in Headers */,
-				A8A47437151A825B004123FF /* AtomicStringHash.h in Headers */,
-				A8A47438151A825B004123FF /* AtomicStringImpl.h in Headers */,
-				A8A4743A151A825B004123FF /* CString.h in Headers */,
-				A8A4743B151A825B004123FF /* StringBuffer.h in Headers */,
-				A8A4743D151A825B004123FF /* StringBuilder.h in Headers */,
-				A8A4743E151A825B004123FF /* StringConcatenate.h in Headers */,
-				A8A4743F151A825B004123FF /* StringHash.h in Headers */,
-				A8A47441151A825B004123FF /* StringImpl.h in Headers */,
-				A8A47442151A825B004123FF /* StringOperators.h in Headers */,
 				A8A47444151A825B004123FF /* TextPosition.h in Headers */,
-				A8A47446151A825B004123FF /* WTFString.h in Headers */,
 				A8A47447151A825B004123FF /* ThreadFunctionInvocation.h in Headers */,
 				A8A47449151A825B004123FF /* ThreadIdentifierDataPthreads.h in Headers */,
 				A8A4744B151A825B004123FF /* Threading.h in Headers */,
 				A8A4744D151A825B004123FF /* ThreadingPrimitives.h in Headers */,
 				A8A47450151A825B004123FF /* ThreadRestrictionVerifier.h in Headers */,
-				A8A47452151A825B004123FF /* BinarySemaphore.h in Headers */,
 				A8A47454151A825B004123FF /* ThreadSafeRefCounted.h in Headers */,
 				A8A47455151A825B004123FF /* ThreadSpecific.h in Headers */,
 				A8A47457151A825B004123FF /* TypedArrayBase.h in Headers */,
 				A8A47459151A825B004123FF /* TypeTraits.h in Headers */,
-				A8A4745A151A825B004123FF /* Uint8Array.h in Headers */,
-				A8A4745B151A825B004123FF /* Uint8ClampedArray.h in Headers */,
 				A8A4745C151A825B004123FF /* Uint16Array.h in Headers */,
 				A8A4745D151A825B004123FF /* Uint32Array.h in Headers */,
-				A8A4745E151A825B004123FF /* CharacterNames.h in Headers */,
-				A8A4745F151A825B004123FF /* Collator.h in Headers */,
-				A8A47464151A825B004123FF /* UnicodeIcu.h in Headers */,
-				A8A47466151A825B004123FF /* ScriptCodesFromICU.h in Headers */,
+				A8A4745A151A825B004123FF /* Uint8Array.h in Headers */,
+				A8A4745B151A825B004123FF /* Uint8ClampedArray.h in Headers */,
 				A8A47467151A825B004123FF /* Unicode.h in Headers */,
+				A8A47464151A825B004123FF /* UnicodeIcu.h in Headers */,
 				A8A47468151A825B004123FF /* UnicodeMacrosFromICU.h in Headers */,
-				A8A4746A151A825B004123FF /* UTF8.h in Headers */,
 				A8A4746D151A825B004123FF /* UnionFind.h in Headers */,
 				A8A4746E151A825B004123FF /* UnusedParam.h in Headers */,
-				A8A47470151A825B004123FF /* ParsedURL.h in Headers */,
-				A8A47471151A825B004123FF /* URLString.h in Headers */,
-				A8A47472151A825B004123FF /* RawURLBuffer.h in Headers */,
 				A8A47473151A825B004123FF /* URLBuffer.h in Headers */,
 				A8A47475151A825B004123FF /* URLCharacterTypes.h in Headers */,
 				A8A47476151A825B004123FF /* URLComponent.h in Headers */,
@@ -1039,15 +1043,15 @@
 				A8A47479151A825B004123FF /* URLParser.h in Headers */,
 				A8A4747A151A825B004123FF /* URLQueryCanonicalizer.h in Headers */,
 				A8A4747C151A825B004123FF /* URLSegments.h in Headers */,
+				A8A47471151A825B004123FF /* URLString.h in Headers */,
+				A8A4746A151A825B004123FF /* UTF8.h in Headers */,
+				A8A473B9151A825B004123FF /* utils.h in Headers */,
 				A8A4747D151A825B004123FF /* ValueCheck.h in Headers */,
 				A8A4747E151A825B004123FF /* Vector.h in Headers */,
 				A8A4747F151A825B004123FF /* VectorTraits.h in Headers */,
 				A8A47480151A825B004123FF /* VMTags.h in Headers */,
+				A8A47446151A825B004123FF /* WTFString.h in Headers */,
 				A8A47487151A825B004123FF /* WTFThreadData.h in Headers */,
-				A8A4748C151A8264004123FF /* config.h in Headers */,
-				143F61201565F0F900DB514A /* RAMSize.h in Headers */,
-				0FD81AC5154FB22E00983E72 /* FastBitVector.h in Headers */,
-				8134013915B092FD001FF0B8 /* Base64.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1139,26 +1143,31 @@
 				A8A47381151A825B004123FF /* ArrayBuffer.cpp in Sources */,
 				A8A47383151A825B004123FF /* ArrayBufferView.cpp in Sources */,
 				A8A47386151A825B004123FF /* Assertions.cpp in Sources */,
+				A8A47435151A825B004123FF /* AtomicString.cpp in Sources */,
+				8134013815B092FD001FF0B8 /* Base64.cpp in Sources */,
+				A8A473A8151A825B004123FF /* bignum-dtoa.cc in Sources */,
+				A8A473AA151A825B004123FF /* bignum.cc in Sources */,
+				A8A47451151A825B004123FF /* BinarySemaphore.cpp in Sources */,
 				A8A4738B151A825B004123FF /* BitVector.cpp in Sources */,
+				A8A473AC151A825B004123FF /* cached-powers.cc in Sources */,
+				A8A47460151A825B004123FF /* CollatorDefault.cpp in Sources */,
+				A8A47463151A825B004123FF /* CollatorICU.cpp in Sources */,
 				A8A4739A151A825B004123FF /* CryptographicallyRandomNumber.cpp in Sources */,
+				A8A47439151A825B004123FF /* CString.cpp in Sources */,
 				A8A4739C151A825B004123FF /* CurrentTime.cpp in Sources */,
 				A8A4739E151A825B004123FF /* DataLog.cpp in Sources */,
 				A8A473A0151A825B004123FF /* DateMath.cpp in Sources */,
 				A8A473A2151A825B004123FF /* DecimalNumber.cpp in Sources */,
-				A8A473A8151A825B004123FF /* bignum-dtoa.cc in Sources */,
-				A8A473AA151A825B004123FF /* bignum.cc in Sources */,
-				A8A473AC151A825B004123FF /* cached-powers.cc in Sources */,
 				A8A473AE151A825B004123FF /* diy-fp.cc in Sources */,
 				A8A473B0151A825B004123FF /* double-conversion.cc in Sources */,
-				A8A473B3151A825B004123FF /* fast-dtoa.cc in Sources */,
-				A8A473B5151A825B004123FF /* fixed-dtoa.cc in Sources */,
-				A8A473B7151A825B004123FF /* strtod.cc in Sources */,
 				A8A473BA151A825B004123FF /* dtoa.cpp in Sources */,
 				A8A473BC151A825B004123FF /* DynamicAnnotations.cpp in Sources */,
+				A8A473B3151A825B004123FF /* fast-dtoa.cc in Sources */,
 				A8A473C3151A825B004123FF /* FastMalloc.cpp in Sources */,
+				A8A473B5151A825B004123FF /* fixed-dtoa.cc in Sources */,
 				A8A473D8151A825B004123FF /* HashTable.cpp in Sources */,
-				A8A473E4151A825B004123FF /* MainThreadMac.mm in Sources */,
 				A8A473E5151A825B004123FF /* MainThread.cpp in Sources */,
+				A8A473E4151A825B004123FF /* MainThreadMac.mm in Sources */,
 				A8A473E9151A825B004123FF /* MD5.cpp in Sources */,
 				A8A473EC151A825B004123FF /* MetaAllocator.cpp in Sources */,
 				A8A473F2151A825B004123FF /* NullPtr.cpp in Sources */,
@@ -1167,35 +1176,30 @@
 				A8A473F9151A825B004123FF /* OSRandomSource.cpp in Sources */,
 				A8A47400151A825B004123FF /* PageAllocationAligned.cpp in Sources */,
 				A8A47402151A825B004123FF /* PageBlock.cpp in Sources */,
+				A8A4746F151A825B004123FF /* ParsedURL.cpp in Sources */,
+				143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */,
 				A8A47414151A825B004123FF /* RandomNumber.cpp in Sources */,
 				A8A4741A151A825B004123FF /* RefCountedLeakCounter.cpp in Sources */,
 				A8A47421151A825B004123FF /* SHA1.cpp in Sources */,
 				A8A47425151A825B004123FF /* SizeLimits.cpp in Sources */,
 				A8A47427151A825B004123FF /* StackBounds.cpp in Sources */,
-				A8A4742B151A825B004123FF /* StringExtras.cpp in Sources */,
-				A8A47431151A825B004123FF /* TCSystemAlloc.cpp in Sources */,
-				A8A47435151A825B004123FF /* AtomicString.cpp in Sources */,
-				A8A47439151A825B004123FF /* CString.cpp in Sources */,
 				A8A4743C151A825B004123FF /* StringBuilder.cpp in Sources */,
+				A8A4742B151A825B004123FF /* StringExtras.cpp in Sources */,
 				A8A47440151A825B004123FF /* StringImpl.cpp in Sources */,
 				A8A47443151A825B004123FF /* StringStatics.cpp in Sources */,
-				4330F38F15745B0500AAFA8F /* URLString.cpp in Sources */,
-				A8A47445151A825B004123FF /* WTFString.cpp in Sources */,
+				A8A473B7151A825B004123FF /* strtod.cc in Sources */,
+				A8A47431151A825B004123FF /* TCSystemAlloc.cpp in Sources */,
 				A8A47448151A825B004123FF /* ThreadIdentifierDataPthreads.cpp in Sources */,
 				A8A4744A151A825B004123FF /* Threading.cpp in Sources */,
 				A8A4744E151A825B004123FF /* ThreadingPthreads.cpp in Sources */,
-				A8A47451151A825B004123FF /* BinarySemaphore.cpp in Sources */,
 				A8A47458151A825B004123FF /* TypeTraits.cpp in Sources */,
-				A8A47460151A825B004123FF /* CollatorDefault.cpp in Sources */,
-				A8A47463151A825B004123FF /* CollatorICU.cpp in Sources */,
-				A8A47469151A825B004123FF /* UTF8.cpp in Sources */,
-				A8A4746F151A825B004123FF /* ParsedURL.cpp in Sources */,
 				A8A47474151A825B004123FF /* URLCharacterTypes.cpp in Sources */,
 				A8A47477151A825B004123FF /* URLEscape.cpp in Sources */,
 				A8A4747B151A825B004123FF /* URLSegments.cpp in Sources */,
+				4330F38F15745B0500AAFA8F /* URLString.cpp in Sources */,
+				A8A47469151A825B004123FF /* UTF8.cpp in Sources */,
+				A8A47445151A825B004123FF /* WTFString.cpp in Sources */,
 				A8A47486151A825B004123FF /* WTFThreadData.cpp in Sources */,
-				143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */,
-				8134013815B092FD001FF0B8 /* Base64.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WTF/wtf/CMakeLists.txt b/Source/WTF/wtf/CMakeLists.txt
index 9d34d4563..bd2914971 100644
--- a/Source/WTF/wtf/CMakeLists.txt
+++ b/Source/WTF/wtf/CMakeLists.txt
@@ -28,6 +28,7 @@ SET(WTF_HEADERS
     FixedArray.h
     Forward.h
     GetPtr.h
+    GregorianDateTime.h
     HashCountedSet.h
     HashFunctions.h
     HashIterators.h
diff --git a/Source/WTF/wtf/DateMath.cpp b/Source/WTF/wtf/DateMath.cpp
index ea2cb60ee..3b0bbd309 100644
--- a/Source/WTF/wtf/DateMath.cpp
+++ b/Source/WTF/wtf/DateMath.cpp
@@ -86,6 +86,10 @@
 #include <time.h>
 #include <wtf/text/StringBuilder.h>
 
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
+
 #if HAVE(ERRNO_H)
 #include <errno.h>
 #endif
@@ -356,6 +360,12 @@ int equivalentYearForDST(int year)
 
 int32_t calculateUTCOffset()
 {
+#if OS(WINDOWS)
+    TIME_ZONE_INFORMATION timeZoneInformation;
+    GetTimeZoneInformation(&timeZoneInformation);
+    int32_t bias = timeZoneInformation.Bias + timeZoneInformation.StandardBias;
+    return -bias * 60 * 1000;
+#else
     time_t localTime = time(0);
     tm localt;
     getLocalTime(&localTime, &localt);
@@ -376,7 +386,7 @@ int32_t calculateUTCOffset()
 #if HAVE(TM_ZONE)
     localt.tm_zone = 0;
 #endif
-    
+
 #if HAVE(TIMEGM)
     time_t utcOffset = timegm(&localt) - mktime(&localt);
 #else
@@ -386,6 +396,7 @@ int32_t calculateUTCOffset()
 #endif
 
     return static_cast<int32_t>(utcOffset * 1000);
+#endif
 }
 
 /*
diff --git a/Source/WTF/wtf/GregorianDateTime.h b/Source/WTF/wtf/GregorianDateTime.h
new file mode 100644
index 000000000..2b4fc352f
--- /dev/null
+++ b/Source/WTF/wtf/GregorianDateTime.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_GregorianDateTime_h
+#define WTF_GregorianDateTime_h
+
+#include <wtf/text/CString.h>
+
+namespace WTF {
+
+class GregorianDateTime {
+    WTF_MAKE_NONCOPYABLE(GregorianDateTime);
+public:
+    GregorianDateTime()
+        : m_year(0)
+        , m_month(0)
+        , m_yearDay(0)
+        , m_monthDay(0)
+        , m_weekDay(0)
+        , m_hour(0)
+        , m_minute(0)
+        , m_second(0)
+        , m_utcOffset(0)
+        , m_isDST(0)
+    {
+    }
+
+    inline int year() const { return m_year; }
+    inline int month() const { return m_month; }
+    inline int yearDay() const { return m_yearDay; }
+    inline int monthDay() const { return m_monthDay; }
+    inline int weekDay() const { return m_weekDay; }
+    inline int hour() const { return m_hour; }
+    inline int minute() const { return m_minute; }
+    inline int second() const { return m_second; }
+    inline int utcOffset() const { return m_utcOffset; }
+    inline int isDST() const { return m_isDST; }
+
+    inline void setYear(int year) { m_year = year; }
+    inline void setMonth(int month) { m_month = month; }
+    inline void setYearDay(int yearDay) { m_yearDay = yearDay; }
+    inline void setMonthDay(int monthDay) { m_monthDay = monthDay; }
+    inline void setWeekDay(int weekDay) { m_weekDay = weekDay; }
+    inline void setHour(int hour) { m_hour = hour; }
+    inline void setMinute(int minute) { m_minute = minute; }
+    inline void setSecond(int second) { m_second = second; }
+    inline void setUtcOffset(int utcOffset) { m_utcOffset = utcOffset; }
+    inline void setIsDST(int isDST) { m_isDST = isDST; }
+
+    operator tm() const
+    {
+        tm ret;
+        memset(&ret, 0, sizeof(ret));
+
+        ret.tm_year = m_year;
+        ret.tm_mon = m_month;
+        ret.tm_yday = m_yearDay;
+        ret.tm_mday = m_monthDay;
+        ret.tm_wday = m_weekDay;
+        ret.tm_hour = m_hour;
+        ret.tm_min = m_minute;
+        ret.tm_sec = m_second;
+        ret.tm_isdst = m_isDST;
+
+#if HAVE(TM_GMTOFF)
+        ret.tm_gmtoff = static_cast<long>(m_utcOffset);
+#endif
+
+        return ret;
+    }
+
+    void copyFrom(const GregorianDateTime& other)
+    {
+        m_year = other.m_year;
+        m_month = other.m_month;
+        m_yearDay = other.m_yearDay;
+        m_monthDay = other.m_monthDay;
+        m_weekDay = other.m_weekDay;
+        m_hour = other.m_hour;
+        m_minute = other.m_minute;
+        m_second = other.m_second;
+        m_utcOffset = other.m_utcOffset;
+        m_isDST = other.m_isDST;
+    }
+
+private:
+    int m_year;
+    int m_month;
+    int m_yearDay;
+    int m_monthDay;
+    int m_weekDay;
+    int m_hour;
+    int m_minute;
+    int m_second;
+    int m_utcOffset;
+    int m_isDST;
+};
+
+} // namespace WTF
+
+using WTF::GregorianDateTime;
+
+#endif // WTF_GregorianDateTime_h
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index a7e1d52e3..a25893685 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -502,7 +502,6 @@
 #endif
 
 #if OS(WINCE) && !PLATFORM(QT)
-#define NOMINMAX       /* Windows min and max conflict with standard macros */
 #define NOSHLWAPI      /* shlwapi.h not available on WinCe */
 
 /* MSDN documentation says these functions are provided with uspce.lib.  But we cannot find this file. */
diff --git a/Source/WTF/wtf/ThreadSpecific.h b/Source/WTF/wtf/ThreadSpecific.h
index 60c9907bd..f51ab4cf2 100644
--- a/Source/WTF/wtf/ThreadSpecific.h
+++ b/Source/WTF/wtf/ThreadSpecific.h
@@ -1,7 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -103,33 +102,6 @@ private:
 };
 
 #if USE(PTHREADS)
-
-typedef pthread_key_t ThreadSpecificKey;
-
-inline void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    int error = pthread_key_create(key, destructor);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    int error = pthread_key_delete(key);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificSet(ThreadSpecificKey key, void* value)
-{
-    pthread_setspecific(key, value);
-}
-
-inline void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return pthread_getspecific(key);
-}
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
 {
@@ -167,14 +139,6 @@ const int kMaxTlsKeySize = 256;
 WTF_EXPORT_PRIVATE long& tlsKeyCount();
 WTF_EXPORT_PRIVATE DWORD* tlsKeys();
 
-class ThreadSpecificKeyValue;
-typedef ThreadSpecificKeyValue* ThreadSpecificKey;
-
-void ThreadSpecificKeyCreate(ThreadSpecificKey*, void (*)(void *));
-void ThreadSpecificKeyDelete(ThreadSpecificKey);
-void ThreadSpecificSet(ThreadSpecificKey, void*);
-void* ThreadSpecificGet(ThreadSpecificKey);
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
diff --git a/Source/WTF/wtf/ThreadSpecificWin.cpp b/Source/WTF/wtf/ThreadSpecificWin.cpp
index 61a594251..d72996a7a 100644
--- a/Source/WTF/wtf/ThreadSpecificWin.cpp
+++ b/Source/WTF/wtf/ThreadSpecificWin.cpp
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,72 +19,15 @@
  */
 
 #include "config.h"
-#include "ThreadSpecific.h"
 
-#include "StdLibExtras.h"
-#include "ThreadingPrimitives.h"
+#include "ThreadSpecific.h"
 
-#if !USE(PTHREADS)
+#if USE(PTHREADS)
+#error This file should not be compiled by ports that do not use Windows native ThreadSpecific implementation.
+#endif
 
 namespace WTF {
 
-static Mutex& destructorsMutex()
-{
-    DEFINE_STATIC_LOCAL(Mutex, staticMutex, ());
-    return staticMutex;
-}
-
-class ThreadSpecificKeyValue {
-public:
-    ThreadSpecificKeyValue(void (*destructor)(void *))
-        : m_destructor(destructor)
-    {
-        m_tlsKey = TlsAlloc();
-        if (m_tlsKey == TLS_OUT_OF_INDEXES)
-            CRASH();
-
-        MutexLocker locker(destructorsMutex());
-        m_next = m_first;
-        m_first = this;
-    }
-
-    ~ThreadSpecificKeyValue()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue** next = &m_first;
-        while (*next != this) {
-            ASSERT(*next);
-            next = &(*next)->m_next;
-        }
-        *next = (*next)->m_next;
-
-        TlsFree(m_tlsKey);
-    }
-
-    void setValue(void* data) { TlsSetValue(m_tlsKey, data); }
-    void* value() { return TlsGetValue(m_tlsKey); }
-
-    static void callDestructors()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue* next = m_first;
-        while (next) {
-            if (void* data = next->value())
-                next->m_destructor(data);
-            next = next->m_next;
-        }
-    }
-
-private:
-    void (*m_destructor)(void *);
-    DWORD m_tlsKey;
-    ThreadSpecificKeyValue* m_next;
-
-    static ThreadSpecificKeyValue* m_first;
-};
-
-ThreadSpecificKeyValue* ThreadSpecificKeyValue::m_first = 0;
-
 long& tlsKeyCount()
 {
     static long count;
@@ -98,26 +40,6 @@ DWORD* tlsKeys()
     return keys;
 }
 
-void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    *key = new ThreadSpecificKeyValue(destructor);
-}
-
-void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    delete key;
-}
-
-void ThreadSpecificSet(ThreadSpecificKey key, void* data)
-{
-    key->setValue(data);
-}
-
-void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return key->value();
-}
-
 void ThreadSpecificThreadExit()
 {
     for (long i = 0; i < tlsKeyCount(); i++) {
@@ -126,10 +48,6 @@ void ThreadSpecificThreadExit()
         if (data)
             data->destructor(data);
     }
-
-    ThreadSpecificKeyValue::callDestructors();
 }
 
 } // namespace WTF
-
-#endif // !USE(PTHREADS)
diff --git a/Source/WTF/wtf/ThreadingPthreads.cpp b/Source/WTF/wtf/ThreadingPthreads.cpp
index 2cfa874e0..921dd3be7 100644
--- a/Source/WTF/wtf/ThreadingPthreads.cpp
+++ b/Source/WTF/wtf/ThreadingPthreads.cpp
@@ -59,11 +59,6 @@
 #include <objc/objc-auto.h>
 #endif
 
-#if PLATFORM(BLACKBERRY)
-#include <BlackBerryPlatformMisc.h>
-#include <BlackBerryPlatformSettings.h>
-#endif
-
 namespace WTF {
 
 typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
@@ -164,45 +159,6 @@ static void* wtfThreadEntryPoint(void* param)
     return 0;
 }
 
-#if PLATFORM(BLACKBERRY)
-ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char* threadName)
-{
-    pthread_attr_t attr;
-    if (pthread_attr_init(&attr)) {
-        LOG_ERROR("pthread_attr_init() failed: %d", errno);
-        return 0;
-    }
-
-    void* stackAddr;
-    size_t stackSize;
-    if (pthread_attr_getstack(&attr, &stackAddr, &stackSize))
-        LOG_ERROR("pthread_attr_getstack() failed: %d", errno);
-    else {
-        stackSize = BlackBerry::Platform::Settings::instance()->secondaryThreadStackSize();
-        if (pthread_attr_setstack(&attr, stackAddr, stackSize))
-            LOG_ERROR("pthread_attr_getstack() failed: %d", errno);
-    }
-
-    OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(new ThreadFunctionInvocation(entryPoint, data));
-    pthread_t threadHandle;
-    if (pthread_create(&threadHandle, &attr, wtfThreadEntryPoint, invocation.get())) {
-        LOG_ERROR("pthread_create() failed: %d", errno);
-        threadHandle = 0;
-    }
-    pthread_setname_np(threadHandle, threadName);
-
-    pthread_attr_destroy(&attr);
-
-    if (!threadHandle)
-        return 0;
-
-    // Balanced by adoptPtr() in wtfThreadEntryPoint.
-    ThreadFunctionInvocation* leakedInvocation = invocation.leakPtr();
-    UNUSED_PARAM(leakedInvocation);
-
-    return establishIdentifierForPthreadHandle(threadHandle);
-}
-#else
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
 {
     OwnPtr<ThreadFunctionInvocation> invocation = adoptPtr(new ThreadFunctionInvocation(entryPoint, data));
@@ -218,12 +174,13 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 
     return establishIdentifierForPthreadHandle(threadHandle);
 }
-#endif
 
 void initializeCurrentThreadInternal(const char* threadName)
 {
 #if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
+#elif OS(QNX)
+    pthread_setname_np(pthread_self(), threadName);
 #else
     UNUSED_PARAM(threadName);
 #endif
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 89d450281..352b54e6d 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -354,6 +354,7 @@ SET(WebCore_IDL_FILES
     dom/PopStateEvent.idl
     dom/ProcessingInstruction.idl
     dom/ProgressEvent.idl
+    dom/PropertyNodeList.idl
     dom/RangeException.idl
     dom/Range.idl
     dom/RequestAnimationFrameCallback.idl
@@ -464,6 +465,7 @@ SET(WebCore_IDL_FILES
     html/ImageData.idl
     html/MediaController.idl
     html/MediaError.idl
+    html/MicroDataItemValue.idl
     html/RadioNodeList.idl
     html/TextMetrics.idl
     html/TimeRanges.idl
@@ -935,6 +937,7 @@ SET(WebCore_SOURCES
     accessibility/AccessibilityMenuListOption.cpp
     accessibility/AccessibilityMenuListPopup.cpp
     accessibility/AccessibilityMockObject.cpp
+    accessibility/AccessibilityNodeObject.cpp
     accessibility/AccessibilityObject.cpp
     accessibility/AccessibilityProgressIndicator.cpp
     accessibility/AccessibilityRenderObject.cpp
@@ -1130,6 +1133,7 @@ SET(WebCore_SOURCES
     dom/PositionIterator.cpp
     dom/ProcessingInstruction.cpp
     dom/ProgressEvent.cpp
+    dom/PropertyNodeList.cpp
     dom/QualifiedName.cpp
     dom/Range.cpp
     dom/RangeException.cpp
@@ -1700,6 +1704,7 @@ SET(WebCore_SOURCES
     platform/KURL.cpp
     platform/KillRingNone.cpp
     platform/Language.cpp
+    platform/LayoutTestSupport.cpp
     platform/Length.cpp
     platform/LengthBox.cpp
     platform/LinkHash.cpp
@@ -1985,6 +1990,7 @@ SET(WebCore_SOURCES
     rendering/RenderLayer.cpp
     rendering/RenderLayerBacking.cpp
     rendering/RenderLayerCompositor.cpp
+    rendering/RenderLayerFilterInfo.cpp
     rendering/RenderLineBoxList.cpp
     rendering/RenderListBox.cpp
     rendering/RenderListItem.cpp
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b14f60022..9b673e1dd 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,2020 @@
+2012-07-24  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        HarfBuzzFaceNG.h forward declarations conflict with newer versions of Harfbuzz
+        https://bugs.webkit.org/show_bug.cgi?id=92103
+
+        Reviewed by Philippe Normand.
+
+        As preparation for enabling harfbuzz-ng for EFL, I would like to include the header
+        here since the forward declarations are conflicting with the harfbuzz version
+        we will use for EFL.
+
+        No new tests, no change in behavior.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h:
+
+2012-07-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix blend filter for autovectorizing
+        https://bugs.webkit.org/show_bug.cgi?id=91398
+
+        Reviewed by Nikolas Zimmermann.
+
+        To support auto-vectorizing, the loop had to be unswitched, and regular arrays used that 
+        did not do boundary-checks in the inner loop. Finally the integer division by 255
+        was optimized not use integer division intrinsics.
+
+        On a X86-64 architechture using GCC -O3 on the file, this gives a speed-up of 2.9x.
+
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::fastDivideBy255):
+        (BlendNormal):
+        (WebCore::BlendNormal::apply):
+        (BlendMultiply):
+        (WebCore::BlendMultiply::apply):
+        (BlendScreen):
+        (WebCore::BlendScreen::apply):
+        (BlendDarken):
+        (WebCore::BlendDarken::apply):
+        (BlendLighten):
+        (WebCore::BlendLighten::apply):
+        (BlendUnknown):
+        (WebCore::BlendUnknown::apply):
+        (WebCore::platformApply):
+        (WebCore::FEBlend::platformApplyGeneric):
+        (WebCore::FEBlend::platformApplySoftware):
+        * platform/graphics/filters/FEBlend.h:
+        (FEBlend):
+
+2012-07-23  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Add the SpeechRecognitionResult.emma attribute
+        https://bugs.webkit.org/show_bug.cgi?id=91743
+
+        Reviewed by Adam Barth.
+
+        Implement the 'emma' attribute as described in the spec draft at
+        http://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
+
+        Test: fast/speech/scripted/emma.html
+
+        * Modules/speech/SpeechRecognitionResult.cpp:
+        (WebCore::SpeechRecognitionResult::~SpeechRecognitionResult):
+        (WebCore):
+        (WebCore::SpeechRecognitionResult::emma):
+        * Modules/speech/SpeechRecognitionResult.h:
+        (WebCore):
+        (SpeechRecognitionResult):
+        * Modules/speech/SpeechRecognitionResult.idl:
+        * WebCore.gypi:
+        * bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp:
+        (WebCore):
+        (WebCore::V8SpeechRecognitionResult::visitDOMWrapper):
+          We need to add an implicit reference from the result object to the
+          emma object to keep the latters DOM tree alive across
+          garbage-collection.
+
+2012-07-24  Andrei Poenaru  <poenaru@adobe.com>
+
+        Web Inspector: Protocol Extension: add getFlowByName command
+        https://bugs.webkit.org/show_bug.cgi?id=91855
+
+        Reviewed by Pavel Feldman.
+
+        The "getFlowByName" command should return a NamedFlow for a given document and name.
+
+        Test: inspector/styles/protocol-css-regions-commands.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getFlowByName):
+        (WebCore):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
+        (WebInspector.CSSStyleModel.prototype.getFlowByNameAsync):
+        (WebInspector.NamedFlow):
+        (WebInspector.NamedFlow.parsePayload):
+
+2012-07-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Fix compilation against namespaced Qt
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/Font.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/qt/ThirdPartyCookiesQt.h:
+
+2012-07-24  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Enable initiator column in network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=65533
+
+        Reviewed by Vsevolod Vlasov.
+
+        With 40118 fixed for webkit, Preferences.displayInitiator should be set to true.
+        Removed references to it since the optionality is no longer required.
+
+        Test: http/tests/inspector/network/network-initiator.html
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._createTable):
+        (WebInspector.NetworkLogView.prototype.switchToDetailedView):
+        (WebInspector.NetworkLogView.prototype.switchToBriefView):
+        (WebInspector.NetworkDataGridNode.prototype.createCells):
+        (WebInspector.NetworkDataGridNode.prototype.refreshRequest):
+        * inspector/front-end/Settings.js:
+
+2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing *explicit* keyword in dom and page.
+        https://bugs.webkit.org/show_bug.cgi?id=92074
+
+        Reviewed by Kentaro Hara.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        Some files in dom directory can't use explicit keyword because of build breaks.
+
+        No new tests. Covered by existing tests.
+
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeTextInsertedEvent.h:
+        (BeforeTextInsertedEvent):
+        * dom/ChildListMutationScope.h:
+        (WebCore::ChildListMutationScope::ChildListMutationScope):
+        * dom/ChildNodeList.h:
+        (ChildNodeList):
+        * dom/ClientRect.h:
+        (ClientRect):
+        * dom/ClientRectList.h:
+        (ClientRectList):
+        * dom/ComposedShadowTreeWalker.h:
+        (ComposedShadowTreeParentWalker):
+        * dom/DOMCoreException.h:
+        (WebCore::DOMCoreException::DOMCoreException):
+        * dom/DOMImplementation.h:
+        (DOMImplementation):
+        * dom/DatasetDOMStringMap.h:
+        (WebCore::DatasetDOMStringMap::DatasetDOMStringMap):
+        * dom/DeviceMotionController.h:
+        (DeviceMotionController):
+        * dom/DeviceOrientationController.h:
+        (DeviceOrientationController):
+        * dom/DocumentParser.h:
+        (DocumentParser):
+        * dom/EventException.h:
+        (WebCore::EventException::EventException):
+        * dom/EventListener.h:
+        (WebCore::EventListener::EventListener):
+        * dom/ExceptionBase.h:
+        (ExceptionBase):
+        * dom/GenericEventQueue.h:
+        (GenericEventQueue):
+        * dom/KeyboardEvent.h:
+        (WebCore::KeypressCommand::KeypressCommand):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryObjectInfo::MemoryObjectInfo):
+        * dom/MessageChannel.h:
+        (MessageChannel):
+        * dom/MessagePort.h:
+        (MessagePort):
+        * dom/MessagePortChannel.h:
+        (MessagePortChannel):
+        * dom/MutationObserver.h:
+        * dom/NamedNodeMap.h:
+        (WebCore::NamedNodeMap::NamedNodeMap):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::NodeFilter):
+        * dom/NodeWithIndex.h:
+        (WebCore::NodeWithIndex::NodeWithIndex):
+        * dom/Range.h:
+        * dom/RangeException.h:
+        (WebCore::RangeException::RangeException):
+        * dom/RawDataDocumentParser.h:
+        (WebCore::RawDataDocumentParser::RawDataDocumentParser):
+        * dom/ScriptRunner.h:
+        (ScriptRunner):
+        * dom/SelectorQuery.h:
+        (SelectorQuery):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/SpaceSplitString.h:
+        (SpaceSplitStringData):
+        * dom/StaticHashSetNodeList.h:
+        (StaticHashSetNodeList):
+        * dom/StaticNodeList.h:
+        (WebCore::StaticNodeList::StaticNodeList):
+        * dom/TransformSource.h:
+        (TransformSource):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * dom/WebKitNamedFlowCollection.h:
+        (WebKitNamedFlowCollection):
+        * page/EventHandler.h:
+        (EventHandler):
+        * page/FocusController.h:
+        (FocusController):
+        * page/FrameView.h:
+        (FrameView):
+        * page/MemoryInfo.h:
+        (MemoryInfo):
+        * page/Page.h:
+        (Page):
+        * page/PageGroup.h:
+        (PageGroup):
+        * page/PrintContext.h:
+        (PrintContext):
+        * page/Settings.h:
+        (Settings):
+        * page/SpeechInput.h:
+        (SpeechInput):
+        * page/SpeechInputResultList.h:
+        (SpeechInputResultList):
+        * page/WebKitAnimation.h:
+        * page/WindowFeatures.h:
+        (WindowFeatures):
+        * page/WorkerNavigator.h:
+        (WorkerNavigator):
+
+2012-07-24  Kent Tamura  <tkent@chromium.org>
+
+        Replace some callsites of shadowAncestorNode() with shadowHost()
+        https://bugs.webkit.org/show_bug.cgi?id=92060
+
+        Reviewed by Hajime Morita.
+
+        shadowAncestorNode() is deprecated.
+
+        No new tests. This shouldn't change behaviors.
+
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement):
+        * html/shadow/TextControlInnerElements.h:
+        (WebCore::SpinButtonElement::isEnabledFormControl):
+        (WebCore::SpinButtonElement::isReadOnlyFormControl):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintMediaFullscreenButton):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getMediaElementFromRenderObject):
+        (WebCore::centerRectVerticallyInParentInputElement):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        Removed an ASSERT() because nullness of o->node() is already asserted.
+        * rendering/RenderInputSpeech.cpp:
+        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSliderThumb):
+        Passing shadowHost() to toParentMediaElement(), which accepts 0 and will return 0.
+        (WebCore::paintMediaVolumeSliderThumb): ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        Remove an ASSERT(input) because input never be null unless o->node() is
+        null. If o->node() is null, this function crashes.
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        It's ok to ignore "node is a media element" case because this function
+        works only if node->isMediaControlElement().
+        (WebCore::RenderThemeMac::paintMediaPlayButton): ditto.
+        (WebCore::RenderThemeMac::paintMediaSliderTrack): ditto.
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton):
+        Remove an ASSERT(input) because input never be null unless o->node() is
+        null. If o->node() is null, this function crashes.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration): ditto.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton): ditto.
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::mediaElementParent):
+
+2012-07-24  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Build fix for Android after r123424
+        https://bugs.webkit.org/show_bug.cgi?id=92082
+
+        Unreviewed build fix.
+
+        Mark removed the PlatformSupport.h header from ScrollbarThemeChromiumAndroid.cpp
+        in r123424, while there still are two references left to another method and a
+        constant. Re-add the include directive.
+
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+
+2012-07-24  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm generates wrong code
+        for static attributes in supplemental IDL files
+        https://bugs.webkit.org/show_bug.cgi?id=91925
+
+        Reviewed by Adam Barth.
+
+        r122912 implemented static attributes in CodeGeneratorJS.pm.
+        However, it generates wrong code for static attributes in supplemental
+        IDL files. This patch fixes it as shown in JSTestInterface.cpp.
+        This fix aligns with the fix in CodeGeneratorV8.pm (r123308).
+
+        Test: bindings/scripts/test/TestSupplemental.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+
+2012-07-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Add *explicit* keyword to constructor which has a parameter in bridge, history, loader and plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92064
+
+        Reviewed by Kentaro Hara.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        No new tests. Covered by existing tests.
+
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::IdentifierRep):
+        * history/BackForwardListImpl.h:
+        (BackForwardListImpl):
+        * history/CachedFrame.h:
+        (CachedFrame):
+        * history/HistoryItem.h:
+        (HistoryItem):
+        * loader/DocumentWriter.h:
+        (DocumentWriter):
+        * loader/FrameNetworkingContext.h:
+        (WebCore::FrameNetworkingContext::FrameNetworkingContext):
+        * loader/HistoryController.h:
+        * loader/ImageLoader.h:
+        (ImageLoader):
+        * loader/LinkLoader.h:
+        (LinkLoader):
+        * loader/MainResourceLoader.h:
+        (MainResourceLoader):
+        * loader/NavigationAction.h:
+        (NavigationAction):
+        * loader/NavigationScheduler.h:
+        (NavigationScheduler):
+        * loader/PolicyChecker.h:
+        (PolicyChecker):
+        * loader/SubframeLoader.h:
+        (SubframeLoader):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * plugins/PluginData.h:
+        (PluginData):
+        * plugins/PluginViewBase.h:
+        (WebCore::PluginViewBase::PluginViewBase):
+
+2012-07-24  Patrick Gansterer  <paroga@webkit.org>
+
+        [Qt] Fix conversion from GregorianDateTime to QTime
+        https://bugs.webkit.org/show_bug.cgi?id=92068
+
+        Reviewed by Simon Hausmann.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2012-07-24  Arko Saha  <arko@motorola.com>
+
+        Microdata: Implement PropertyNodeList interface.
+        https://bugs.webkit.org/show_bug.cgi?id=80269
+
+        Reviewed by Ryosuke Niwa.
+
+        Added support for PropertyNodeList interface. Currently HTMLPropertiesCollection.namedItem(name)
+        returns NodeList object. Made changes so that it will return PropertyNodeList object.
+
+        Implemented propertyNodeList.getValues() method. It returns an array of various values. Its
+        values are obtained from the "itemValue" DOM property of each of the elements represented by
+        the object, in tree order.
+
+        Spec: http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#propertynodelist
+
+        Tests: fast/dom/MicroData/nameditem-returns-propertynodelist.html
+               fast/dom/MicroData/propertynodelist-getvalues-array-values-obtained-from-itemvalue-of-each-element.html
+               fast/dom/MicroData/propertynodelist-getvalues-test.html
+               fast/dom/MicroData/propertynodelist-test-add-remove-element.html
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/gobject/GNUmakefile.am:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSMicroDataItemValueCustom.cpp: Added.
+        (WebCore):
+        (WebCore::toJS): Added toJS() custom method. Returns Node if itemValue is node else returns String.
+        * bindings/v8/custom/V8MicroDataItemValueCustom.cpp: Added.
+        (WebCore):
+        (WebCore::toV8): Added toV8 custom code.
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeListCacheBase::rootNode): Return document if owner node has itemref attribute specified.
+        (WebCore):
+        (WebCore::DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute): Returns true if owner node has itemref attribute
+        specified with root type NodeListRootedAtDocumentIfOwnerHasItemrefAttr.
+        (WebCore::DynamicNodeListCacheBase::invalidateCache):
+        (WebCore::DynamicNodeList::itemWithName): Update itemrefElements cache if root type is
+        NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
+        * dom/DynamicNodeList.h: Added m_hasItemRefElements in DynamicNodeListCacheBase to check if itemRefElmenets cache
+        is valid.
+        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
+        (DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isItemRefElementsCacheValid):
+        (WebCore::DynamicNodeListCacheBase::setItemRefElementsCacheValid):
+        (WebCore::DynamicNodeListCacheBase::rootType): Returns cached root type.
+        (WebCore::DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange): Invalidate NodeListCache on itemref
+        attribute change.
+        * dom/Node.cpp:
+        (WebCore::Node::propertyNodeList):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/PropertyNodeList.cpp: Added.
+        (WebCore):
+        (WebCore::PropertyNodeList::PropertyNodeList):
+        (WebCore::PropertyNodeList::~PropertyNodeList):
+        (WebCore::PropertyNodeList::elementIsPropertyOfRefElement): Checks if the testElement is a property of Microdata
+        item.
+        (WebCore::PropertyNodeList::updateRefElements):
+        (WebCore::PropertyNodeList::nodeMatches):
+        (WebCore::PropertyNodeList::getValues): Returns PropertyValueArray whose values are obtained from the
+        itemValue DOM property of each of the elements represented by the object, in tree order.
+        * dom/PropertyNodeList.h: Added.
+        (WebCore):
+        (PropertyNodeList):
+        (WebCore::PropertyNodeList::create):
+        * dom/PropertyNodeList.idl: Added.
+        * html/HTMLCollection.cpp:
+        (WebCore::DynamicNodeListCacheBase::itemCommon): Update itemrefElements cache if its a NodeListCollectionType with
+        root type NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr.
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::properties):
+        (WebCore):
+        (WebCore::HTMLElement::getItemRefElements): Returns the ItemRefElements list of given element. Added this
+        method to share the code between HTMLPropertiesCollection and PropertyNodeList to update itemRefElements.
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::updateRefElements):
+        (WebCore::HTMLPropertiesCollection::updateNameCache):
+        (WebCore::HTMLPropertiesCollection::namedItem): Return PropertyNodeList object instead of NodeList.
+        (WebCore::HTMLPropertiesCollection::hasNamedItem): Return true if it finds an item with given
+        name in the properties collection.
+        * html/HTMLPropertiesCollection.h: Removed m_hasItemRefElements member variable, now DynamicNodeListCacheBase
+        has isItemRefElementsCacheValid. Also removed m_hasPropertyNameCache, as DynamicNodeListCacheBase already has
+        hasNameCache() and setHasNameCache().
+        (WebCore):
+        (HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::invalidateCache):
+        (WebCore::HTMLPropertiesCollection::updatePropertyCache):
+        * html/HTMLPropertiesCollection.idl:
+        * html/MicroDataItemValue.idl: Added.
+        * page/DOMWindow.idl:
+
+2012-07-24  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] REGRESSION(r122912): CodeGeneratorJS.pm should not
+        implicitly assume ScriptExecutionContext for static attributes
+        https://bugs.webkit.org/show_bug.cgi?id=91924
+
+        Reviewed by Adam Barth.
+
+        r122912 implemented static attributes in CodeGeneratorJS.pm.
+        However, the generated code assumes that static attributes
+        always require ScriptExecutionContext, which is wrong.
+        If we need a ScriptExecutionContext, we should specify
+        [CallWith=ScriptExecutionContext].
+
+        This patch fixes CodeGeneratorJS.pm so that static attributes
+        do not assume ScriptExecutionContext. This fix aligns with
+        the fix in CodeGeneratorV8.pm in r123308.
+
+        Test: bindings/scripts/test/TestObj.idl
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjConstructorStaticReadOnlyIntAttr):
+        (WebCore::jsTestObjConstructorStaticStringAttr):
+        (WebCore::setJSTestObjConstructorStaticStringAttr):
+
+2012-07-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Missing *explicit* keyword in editing.
+        https://bugs.webkit.org/show_bug.cgi?id=92055
+
+        Reviewed by Ryosuke Niwa.
+
+        Some constructors missed to use *explicit* keyword. They need to be added
+        *explicit* keyword to contructor which has a parameter in order to avoid
+        implicit type conversion.
+
+        No new tests. Covered by existing tests.
+
+        * editing/AlternativeTextController.h:
+        (WebCore::AlternativeTextController::UNLESS_ENABLED):
+        * editing/BreakBlockquoteCommand.h:
+        (BreakBlockquoteCommand):
+        * editing/DeleteButton.h:
+        (DeleteButton):
+        * editing/DeleteButtonController.h:
+        (DeleteButtonController):
+        * editing/EditCommand.h:
+        (EditCommand):
+        (WebCore::SimpleEditCommand::SimpleEditCommand):
+        * editing/EditingBehavior.h:
+        (WebCore::EditingBehavior::EditingBehavior):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/Editor.h:
+        (Editor):
+        * editing/FrameSelection.h:
+        (FrameSelection):
+        * editing/InsertLineBreakCommand.h:
+        (InsertLineBreakCommand):
+        * editing/ModifySelectionListLevel.h:
+        (ModifySelectionListLevelCommand):
+        (DecreaseSelectionListLevelCommand):
+        * editing/RemoveFormatCommand.h:
+        (RemoveFormatCommand):
+        * editing/RemoveNodeCommand.h:
+        (RemoveNodeCommand):
+        * editing/RemoveNodePreservingChildrenCommand.h:
+        (RemoveNodePreservingChildrenCommand):
+        * editing/ReplaceNodeWithSpanCommand.h:
+        (ReplaceNodeWithSpanCommand):
+        * editing/TextInsertionBaseCommand.h:
+        (TextInsertionBaseCommand):
+        * editing/UndoManager.h:
+        (UndoManager):
+        * editing/UnlinkCommand.h:
+        (UnlinkCommand):
+        * editing/WrapContentsInDummySpanCommand.h:
+        (WrapContentsInDummySpanCommand):
+
+2012-07-23  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Need AccessibilityObjects for nodes without renderers in canvas subtree
+        https://bugs.webkit.org/show_bug.cgi?id=87899
+
+        Reviewed by Chris Fleizach.
+
+        Refactors AccessibilityRenderObject so that it inherits from a new class,
+        AccessibilityNodeObject, that can be constructed from a Node without a
+        renderer. Modifies AXObjectCache so that it automatically creates an
+        AccessibilityNodeObject for elements in a canvas subtree but not otherwise.
+        A new layout test verifies that this correctly exposes an accessibility
+        tree with appropriate roles for elements in a canvas subtree.
+
+        This patch does not try to complete the implementation of
+        AccessibilityNodeObject. Most AX methods are still unimplemented and need
+        to be migrated from AccessibilityRenderObject to AccessibilityNodeObject
+        in a future patch.
+        
+        This patch also doesn't change anything outside of WebCore/accessibility, so
+        the rest of WebCore only calls AXObjectCache when there are changes to a
+        RenderObject, not to a Node. Accessible notifications on nodes without
+        renderers need to be implemented in a future patch.
+
+        Test: accessibility/canvas-accessibilitynodeobject.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        (WebCore):
+        (WebCore::createFromNode):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AXObjectCache.h:
+        (AXObjectCache):
+        (WebCore::AXObjectCache::get):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::remove):
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
+        (WebCore):
+        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::init):
+        (WebCore::AccessibilityARIAGrid::create):
+        * accessibility/AccessibilityARIAGrid.h:
+        (AccessibilityARIAGrid):
+        * accessibility/AccessibilityARIAGridCell.cpp:
+        (WebCore::AccessibilityARIAGridCell::create):
+        * accessibility/AccessibilityARIAGridRow.cpp:
+        (WebCore::AccessibilityARIAGridRow::create):
+        * accessibility/AccessibilityAllInOne.cpp:
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::create):
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::create):
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::create):
+        (WebCore::AccessibilityMediaControlsContainer::create):
+        (WebCore::AccessibilityMediaTimeline::create):
+        (WebCore::AccessibilityMediaTimeDisplay::create):
+        * accessibility/AccessibilityMenuList.cpp:
+        (WebCore::AccessibilityMenuList::create):
+        (WebCore):
+        * accessibility/AccessibilityMenuList.h:
+        (AccessibilityMenuList):
+        * accessibility/AccessibilityNodeObject.cpp: Added.
+        (WebCore):
+        (WebCore::AccessibilityNodeObject::AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::~AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::init):
+        (WebCore::AccessibilityNodeObject::create):
+        (WebCore::AccessibilityNodeObject::detach):
+        (WebCore::AccessibilityNodeObject::childrenChanged):
+        (WebCore::AccessibilityNodeObject::updateAccessibilityRole):
+        (WebCore::AccessibilityNodeObject::firstChild):
+        (WebCore::AccessibilityNodeObject::lastChild):
+        (WebCore::AccessibilityNodeObject::previousSibling):
+        (WebCore::AccessibilityNodeObject::nextSibling):
+        (WebCore::AccessibilityNodeObject::parentObjectIfExists):
+        (WebCore::AccessibilityNodeObject::parentObject):
+        (WebCore::AccessibilityNodeObject::elementRect):
+        (WebCore::AccessibilityNodeObject::setNode):
+        (WebCore::AccessibilityNodeObject::document):
+        (WebCore::AccessibilityNodeObject::determineAccessibilityRole):
+        (WebCore::AccessibilityNodeObject::addChildren):
+        (WebCore::AccessibilityNodeObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityNodeObject::canSetFocusAttribute):
+        (WebCore::AccessibilityNodeObject::determineAriaRoleAttribute):
+        (WebCore::AccessibilityNodeObject::ariaRoleAttribute):
+        (WebCore::AccessibilityNodeObject::remapAriaRoleDueToParent):
+        * accessibility/AccessibilityNodeObject.h: Added.
+        (WebCore):
+        (AccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::isAccessibilityNodeObject):
+        (WebCore::AccessibilityNodeObject::node):
+        (WebCore::AccessibilityNodeObject::isDetached):
+        (WebCore::toAccessibilityNodeObject):
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isAccessibilityNodeObject):
+        * accessibility/AccessibilityProgressIndicator.cpp:
+        (WebCore::AccessibilityProgressIndicator::create):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
+        (WebCore::AccessibilityRenderObject::init):
+        (WebCore):
+        (WebCore::AccessibilityRenderObject::create):
+        (WebCore::AccessibilityRenderObject::detach):
+        (WebCore::AccessibilityRenderObject::setRenderer):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::addCanvasChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::create):
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore):
+        (WebCore::AccessibilityTable::~AccessibilityTable):
+        (WebCore::AccessibilityTable::init):
+        (WebCore::AccessibilityTable::create):
+        * accessibility/AccessibilityTable.h:
+        (AccessibilityTable):
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::create):
+        * accessibility/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::create):
+
+2012-07-23  David Barr  <davidbarr@chromium.org>
+
+        Fix ENABLE_CSS_IMAGE_ORIENTATION compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=91961
+
+        Reviewed by Tony Chang.
+
+        https://bugs.webkit.org/show_bug.cgi?id=89055
+        A rule was missed implementing the ENABLE_CSS_IMAGE_ORIENTATION compile flag.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+        Half of the missing rule was inadvertently added together with ENABLE_CSS_STICKY_POSITION.
+
+        No new tests; build configuration fix.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Douglas Stockwell  <dstockwell@chromium.org>
+
+        Null-pointer crash when a derived color like -webkit-activelink is set in a gradient stop
+        https://bugs.webkit.org/show_bug.cgi?id=89148
+
+        Reviewed by Simon Fraser.
+
+        CSSGradientValue attempted to resolve colors during paint, this crashed
+        when a derived color like -webkit-activelink was encountered because the
+        corresponding element was no longer available in the StyleResolver.
+        Instead, by adding a field to CSSGradientColorStop we can resolve and
+        then cache the resolved colors at the correct time. To avoid sharing
+        cached derived colors between elements we clone the gradient values when
+        needed.
+
+        Test: fast/css/crash-on-gradient-with-derived-color.html
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::gradientWithStylesResolved): Added. Resolve and cache
+        resolved colors, clone if colors are derived from the element.
+        (WebCore):
+        (WebCore::CSSGradientValue::addStops):
+        (WebCore::CSSGradientValue::isCacheable): Defer to new logic in
+        StyleResolver.
+        * css/CSSGradientValue.h:
+        (CSSGradientColorStop): Added cache of resolved color.
+        (CSSGradientValue):
+        (CSSLinearGradientValue):
+        (CSSRadialGradientValue):
+        * css/CSSImageGeneratorValue.h:
+        (WebCore):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isGradientValue):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        * css/StyleResolver.h:
+        (StyleResolver):
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::image): Revert change from r96449. This
+        is no longer necessary as the gradient colors are now resolved at a
+        time when the style is set on StyleResolver.
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move GregorianDateTime from JSC to WTF namespace
+        https://bugs.webkit.org/show_bug.cgi?id=91948
+
+        Reviewed by Geoffrey Garen.
+
+        Moving GregorianDateTime into the WTF namespace allows us to us to
+        use it in WebCore too. The new class has the same behaviour as the
+        old struct. Only the unused timeZone member has been removed.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2012-07-23  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Move layoutTestMode to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=92010
+
+        Reviewed by Adam Barth.
+
+        Part of a refactoring series. See tracking bug 82948.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        * platform/LayoutTestSupport.cpp: Added.
+        (WebCore):
+        (WebCore::isRunningLayoutTest):
+        (WebCore::setIsRunningLayoutTest):
+        * platform/LayoutTestSupport.h: Added.
+        (WebCore):
+        * platform/chromium/PlatformSupport.h:
+        (PlatformSupport):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore):
+        (WebCore::LookupAltName):
+        (WebCore::fontContainsCharacter):
+        (WebCore::FillLogFont):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontSkia.cpp:
+        (WebCore::Font::drawGlyphs):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::systemColor):
+        (WebCore::RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::usesTestModeFocusRingColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore):
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        (WebCore::menuListButtonWidth):
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+
+2012-07-23  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Add droppedFrameCount to renderingStats.
+        https://bugs.webkit.org/show_bug.cgi?id=91694
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCFrameRateCounter.cpp:
+        (WebCore):
+        (WebCore::CCFrameRateCounter::frameInterval):
+        (WebCore::CCFrameRateCounter::frameIndex):
+        (WebCore::CCFrameRateCounter::CCFrameRateCounter):
+        (WebCore::CCFrameRateCounter::markBeginningOfFrame):
+        (WebCore::CCFrameRateCounter::isBadFrame):
+        * platform/graphics/chromium/cc/CCFrameRateCounter.h:
+        (WebCore::CCFrameRateCounter::droppedFrameCount):
+        (CCFrameRateCounter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::renderingStats):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCRenderingStats.h:
+        (CCRenderingStats):
+        (WebCore::CCRenderingStats::CCRenderingStats):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::implSideRenderingStats):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::implSideRenderingStatsOnImplThread):
+
+2012-07-23  Dan Bernstein  <mitz@apple.com>
+
+        Fixed the build after r123418.
+
+        * WebCore.exp.in: Added DocumentMarkerController::addTextMatchMarker.
+
+2012-07-23  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: optimise blending expression
+        https://bugs.webkit.org/show_bug.cgi?id=90037
+
+        Reviewed by Tony Chang.
+
+        Introduce a new calc expression node - a BlendLength node. Given two Lengths and a progress
+        this blends them together when evaluated.
+
+        An alternative and more general approach of being able to blend two CalcExpressionNodes was
+        tested, but involves more memory allocations, was measurably slower, and nothing currently
+        would make use of the generality. 
+
+        No functional change. Covered by existing tests.
+
+        * platform/CalculationValue.h:
+        (CalcExpressionBlendLength):
+        (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):
+        (WebCore::CalcExpressionBlendLength::operator==):
+        (WebCore::CalcExpressionBlendLength::evaluate):
+        (WebCore):
+        * platform/Length.cpp:
+        (WebCore::Length::blendCalculation):
+
+2012-07-23  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Show search tickmarks on css-styled scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=91949
+
+        Reviewed by Adrienne Walker.
+
+        This is done by letting RenderScrollbarTheme::paintTickmarks()
+        delegate to the native ScrollbarTheme. To make this possible,
+        move paintTickmarks() from ScrollbarThemeComposite to the
+        superclass ScrollbarTheme.
+
+        For testing, add internals.addTextMatchMarker() and add a pixel test.
+
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintTickmarks):
+        Moved paintTickmarks() from ScrollbarThemeComposite to here.
+        * platform/ScrollbarThemeComposite.h:
+        Remove paintTickmarks().
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        Switch to drawing tickmarks as vectors, so they can be arbitrarily wide.
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (ScrollbarThemeChromiumMac):
+        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        (WebCore::ScrollbarThemeChromiumMac::paintTickmarks):
+        Implement paintTickmarks(), so that css-styled scrollbars get tickmarks on mac.
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintTickmarks):
+        Delegate to the native ScrollbarTheme for tickmark drawing.
+        (WebCore):
+        * rendering/RenderScrollbarTheme.h:
+        (RenderScrollbarTheme):
+        Override paintTickmarks().
+
+2012-07-23  Brian Anderson  <brianderson@chromium.org>
+
+        [chromium] Use shallow flushes that don't glFlush
+        https://bugs.webkit.org/show_bug.cgi?id=90325
+
+        Reviewed by Kenneth Russell.
+
+        Adds plumbing for the shallowFlushCHROMIUM extension and uses
+        shallow flushes instead of normal flushes when uploading textures.
+        Shallow flushes allow us to initiate command buffer flushes to
+        the GPU thread/process without the overhead of a true glFlush.
+
+        CCTextureUpdaterTest updated to recognize shallow flushes.
+
+        * platform/chromium/support/Extensions3DChromium.cpp:
+        (WebCore::Extensions3DChromium::shallowFlushCHROMIUM):
+        (WebCore):
+        * platform/graphics/chromium/Extensions3DChromium.h:
+        (Extensions3DChromium):
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        (WebCore::CCResourceProvider::shallowFlushIfSupported):
+        (WebCore):
+        (WebCore::CCResourceProvider::CCResourceProvider):
+        (WebCore::CCResourceProvider::initialize):
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        (CCResourceProvider):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::update):
+
+2012-07-23  Hanyee Kim  <choco@company100.net>
+
+        When using TextureMapper, WebKit does not retain final value of opacity in animations, unless it is specified on the last key frame.
+        https://bugs.webkit.org/show_bug.cgi?id=91322
+
+        Reviewed by Noam Rosenthal.
+
+        When -webkit-fill-mode is forwards, GraphicsLayerAnimation::apply does not apply
+        the property values defined in the last executing keyframe after the final iteration of animation.
+
+        This patch does not return right after the end of animation, but it keeps applying
+        the property values defined in the last executing keyframe.
+        Add normalizedAnimationValueForFillsForwards function that returns a normalized value of the
+        last executing keyframe.
+
+        Link to CSS Animations spec: http://www.w3.org/TR/css3-animations/#animation-fill-mode-property
+
+        Test: animations/fill-mode-forwards2.html
+
+        * platform/graphics/GraphicsLayerAnimation.cpp:
+        (WebCore::normalizedAnimationValueForFillsForwards):
+        (WebCore):
+        (WebCore::GraphicsLayerAnimation::apply):
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123184, r123195, and r123197.
+        http://trac.webkit.org/changeset/123184
+        http://trac.webkit.org/changeset/123195
+        http://trac.webkit.org/changeset/123197
+        https://bugs.webkit.org/show_bug.cgi?id=92049
+
+        pagecycler regression (Requested by morrita on #webkit).
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::suggestedMIMEType):
+        * dom/Document.h:
+        (WebCore):
+        (WebCore::Node::isDocumentNode):
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::setDocument):
+        (WebCore):
+        (WebCore::Node::setTreeScope):
+        (WebCore::Node::treeScope):
+        (WebCore::Node::isInShadowTree):
+        (WebCore::Node::reportMemoryUsage):
+        * dom/Node.h:
+        (Node):
+        (WebCore::Node::document):
+        (WebCore::Node::inDocument):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::NodeRareData):
+        (WebCore::NodeRareData::treeScope):
+        (WebCore::NodeRareData::setTreeScope):
+        (NodeRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::TreeScope):
+        (WebCore::TreeScope::setParentTreeScope):
+        * dom/TreeScope.h:
+        (WebCore):
+        (WebCore::TreeScope::idTargetObserverRegistry):
+        (TreeScope):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveNodeToNewDocument):
+        * editing/MoveSelectionCommand.cpp:
+        * editing/RemoveNodeCommand.cpp:
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        * inspector/PageConsoleAgent.cpp:
+
+2012-07-23  Roger Fong  <roger_fong@apple.com>
+
+        On Windows, if select element is off screen horizontally, 
+        menu is either inappropriately resized or positioned offscreen.
+        https://bugs.webkit.org/show_bug.cgi?id=91913
+        <rdar://problem/7611229>
+
+        Reviewed by Tim Horton.
+
+        If the select element is positioned off the edge of the screen to the left, 
+        the menu is resized. It should not be resized, just shifted to remain on the screen.
+        If the select element is positioned off the edge of the screen to the right, 
+        the menu goes off screen instead of being shifted over to appear on screen.
+        This problem only occurs on Windows.
+        
+        Test: ManualTests/win/select-menu-off-screen.html
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::calculatePositionAndSize):
+        Modified final horizontal position calculation code to position
+        popup menu on screen if it would otherwise go off.
+        
+2012-07-23  David Dorwin  <ddorwin@chromium.org>
+
+        Fixed crash in webkitAddKey() when key parameter is null.
+        https://bugs.webkit.org/show_bug.cgi?id=85444
+
+        Reviewed by Kentaro Hara.
+
+        Reference: Step 1 of http://dvcs.w3.org/hg/html-media/raw-file/5f76a0b43836/encrypted-media/encrypted-media.html#dom-addkey
+
+        Tests: media/encrypted-media/encrypted-media-syntax.html 
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::webkitAddKey):
+
+2012-07-23  Hayato Ito  <hayato@chromium.org>
+
+        A FocusScope for a distributed node should not be its TreeScope.
+        https://bugs.webkit.org/show_bug.cgi?id=91829
+
+        Reviewed by Dimitri Glazkov.
+
+        Current implementation of FocusScope::focusScopeOf(Node*) returns
+        the given node's treeScope().  That does not apply if the node is
+        a distributed node.  We should calculate a FocusScope for a
+        distributed node by traversing ancestor nodes in Composed Shadow
+        Tree.
+
+        Test: fast/dom/shadow/focus-navigation-with-distributed-nodes.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusScope::focusScopeOf):
+
+2012-07-23  Douglas Stockwell  <dstockwell@google.com>
+
+        Null-pointer crash when parsing border-image
+        https://bugs.webkit.org/show_bug.cgi?id=91963
+
+        Reviewed by Darin Adler.
+
+        Test: fast/css/border-image-fill-crash.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseBorderImageRepeat): Handle the case where
+        parseBorderImageRepeat is called when the value list is empty.
+
+2012-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>
+
+        [CSS Exclusions] SVG shape errors should invalidate exclusion shapes
+        https://bugs.webkit.org/show_bug.cgi?id=91761
+
+        Reviewed by Andreas Kling.
+
+        CSS exclusion shapes that are specified with negative radiuses or
+        height/width are now considered invalid and ignored.
+
+        Tests added to
+        LayoutTests/fast/exclusions/parsing-wrap-shape-lengths.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseExclusionShapeRectangle):
+        (WebCore::CSSParser::parseExclusionShapeCircle):
+        (WebCore::CSSParser::parseExclusionShapeEllipse):
+
+2012-07-23  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Implement scrollbar theme for Android
+        https://bugs.webkit.org/show_bug.cgi?id=91674
+
+        Reviewed by Adam Barth.
+
+        Previously the scrollbar for Android was implemented as an extra
+        drawing pass in the compositor. Now we switch to use the standard
+        ScrollbarTheme mechanism.
+
+        No new tests. We use mock scrollbars during layout test to share
+        pixel results with Linux.
+
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumAndroid::thumbPosition):
+        (WebCore::ScrollbarThemeChromiumAndroid::thumbLength):
+        (WebCore::ScrollbarThemeChromiumAndroid::backButtonRect):
+        (WebCore::ScrollbarThemeChromiumAndroid::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromiumAndroid::trackRect):
+        (WebCore):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintThumb):
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
+        (WebCore::ScrollbarThemeChromiumAndroid::usesOverlayScrollbars):
+        (ScrollbarThemeChromiumAndroid):
+        (WebCore::ScrollbarThemeChromiumAndroid::hasButtons):
+        (WebCore::ScrollbarThemeChromiumAndroid::hasThumb):
+
+2012-07-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Use the original token to create an element in "reconstruct the active formatting elements" and "call the adoption agency"
+        https://bugs.webkit.org/show_bug.cgi?id=91703
+
+        Reviewed by Adam Barth.
+
+        The current WebKit HTML5 parser implementation does not hold the original token
+        in the stack of open elements and the active formatting elements. This is
+        problematic because the original token is used to create an element in
+        "reconstruct the active formatting elements" and "call the adoption agency".
+
+        As a workaround, WebKit uses the saved element instead of the original token
+        to create an element. But this causes us to fail examples like this:
+        <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
+        reconstructTheActiveFormattingElements calls this method to open a second <b>
+        tag to wrap TEXT, it will have id "2", even though the HTML5 spec implies it
+        should be "1".
+
+        Created a ref-counted container class, HTMLStackItem to hold the original token
+        and the namespace URI as well as the element. Changed HTMLElementStack and
+        HTMLFormattingElementList to use HTMLStackItem.
+        Changed HTMLConstructionSite::reconstructTheActiveFormattingElements and
+        HTMLTreeBuilder::callTheAdoptionAgency to create an element from the saved token
+        instead of the saved element.
+
+        Updated test expectation for html5lib/runner-expected.txt
+        because now resources/scripted/adoption01.dat passes.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
+        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+        (WebCore::HTMLConstructionSite::insertHTMLElement):
+        (WebCore::HTMLConstructionSite::insertFormattingElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::insertForeignElement):
+        (WebCore::HTMLConstructionSite::createElementFromSavedToken):
+        (WebCore::HTMLConstructionSite::reconstructTheActiveFormattingElements):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+        (WebCore::HTMLConstructionSite::currentElementRecord):
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
+        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
+        (WebCore::HTMLElementStack::pushRootNode):
+        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLElementStack::pushRootNodeCommon):
+        (WebCore::HTMLElementStack::pushHTMLHeadElement):
+        (WebCore::HTMLElementStack::pushHTMLBodyElement):
+        (WebCore::HTMLElementStack::push):
+        (WebCore::HTMLElementStack::insertAbove):
+        (WebCore::HTMLElementStack::pushCommon):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::HTMLElementStack::ElementRecord::element):
+        (WebCore::HTMLElementStack::ElementRecord::node):
+        (WebCore::HTMLElementStack::ElementRecord::stackItem):
+        (ElementRecord):
+        (HTMLElementStack):
+        * html/parser/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::swapTo):
+        (WebCore::HTMLFormattingElementList::append):
+        * html/parser/HTMLFormattingElementList.h:
+        (WebCore::HTMLFormattingElementList::Entry::Entry):
+        (WebCore::HTMLFormattingElementList::Entry::isMarker):
+        (WebCore::HTMLFormattingElementList::Entry::stackItem):
+        (WebCore::HTMLFormattingElementList::Entry::element):
+        (WebCore::HTMLFormattingElementList::Entry::replaceElement):
+        (WebCore::HTMLFormattingElementList::Entry::operator==):
+        (WebCore::HTMLFormattingElementList::Entry::operator!=):
+        (Entry):
+        (HTMLFormattingElementList):
+        * html/parser/HTMLStackItem.h: Added.
+        (WebCore):
+        (HTMLStackItem):
+        (WebCore::HTMLStackItem::create):
+        (WebCore::HTMLStackItem::element):
+        (WebCore::HTMLStackItem::node):
+        (WebCore::HTMLStackItem::token):
+        (WebCore::HTMLStackItem::namespaceURI):
+        (WebCore::HTMLStackItem::HTMLStackItem):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2012-07-23  Andreas Kling  <kling@webkit.org>
+
+        Report the extra memory used by immutable StylePropertySet objects.
+        <http://webkit.org/b/92032>
+
+        Reviewed by Anders Carlsson.
+
+        Add an optional parameter to the MemoryClassInfo constructor for passing in additional base object
+        size on top of sizeof(T).
+
+        Use this in StylePropertySet::reportMemoryUsage() to properly account for the CSSProperty array
+        tacked onto the end of the object when m_isMutable == false.
+
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::reportMemoryUsage):
+        * dom/MemoryInstrumentation.h:
+        (WebCore::MemoryObjectInfo::reportObjectInfo):
+        (WebCore::MemoryClassInfo::MemoryClassInfo):
+
+2012-07-23  Gregg Tavares  <gman@google.com>
+
+        Fix WebGL texSubImage2D for cube maps
+        https://bugs.webkit.org/show_bug.cgi?id=91927
+
+        Reviewed by Kenneth Russell.
+
+        Fixes texSubImage2D so any size rectangle can be passed in
+        for cube maps.
+
+        Test: fast/canvas/webgl/tex-sub-image-cube-maps.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::copyTexImage2D):
+        (WebCore::WebGLRenderingContext::texImage2DBase):
+        (WebCore::WebGLRenderingContext::texSubImage2DBase):
+        (WebCore::WebGLRenderingContext::validateTexFuncParameters):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123387.
+        http://trac.webkit.org/changeset/123387
+        https://bugs.webkit.org/show_bug.cgi?id=92036
+
+        Broke chromium win build (Requested by tony^work on #webkit).
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/rule_bison.py:
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor):
+        * make-hash-tools.pl:
+
+2012-07-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Ref-count AtomicHTMLToken
+        https://bugs.webkit.org/show_bug.cgi?id=91981
+
+        Reviewed by Adam Barth.
+
+        Ref-count AtomicHTMLToken to avoid copying AtomicHTMLToken in Bug 91703.
+
+        No new tests - no functional changes.
+
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagInBody):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyStartTagInBody):
+        (WebCore::HTMLConstructionSite::insertDoctype):
+        (WebCore::HTMLConstructionSite::insertComment):
+        (WebCore::HTMLConstructionSite::insertCommentOnDocument):
+        (WebCore::HTMLConstructionSite::insertCommentOnHTMLHtmlElement):
+        (WebCore::HTMLConstructionSite::insertHTMLHeadElement):
+        (WebCore::HTMLConstructionSite::insertHTMLBodyElement):
+        (WebCore::HTMLConstructionSite::insertHTMLFormElement):
+        (WebCore::HTMLConstructionSite::insertHTMLElement):
+        (WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement):
+        (WebCore::HTMLConstructionSite::insertFormattingElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::insertForeignElement):
+        (WebCore::HTMLConstructionSite::createElement):
+        (WebCore::HTMLConstructionSite::createHTMLElement):
+        (WebCore::HTMLConstructionSite::createHTMLElementFromSavedElement):
+        * html/parser/HTMLConstructionSite.h:
+        (HTMLConstructionSite):
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::create):
+        (AtomicHTMLToken):
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::ExternalCharacterTokenBuffer::ExternalCharacterTokenBuffer):
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processToken):
+        (WebCore::HTMLTreeBuilder::processDoctypeToken):
+        (WebCore::HTMLTreeBuilder::processFakeStartTag):
+        (WebCore::HTMLTreeBuilder::processFakeEndTag):
+        (WebCore::HTMLTreeBuilder::processFakePEndTagIfPInButtonScope):
+        (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
+        (WebCore::HTMLTreeBuilder::processIsindexStartTagForInBody):
+        (WebCore):
+        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processStartTagForInTable):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processBodyEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+        (WebCore::HTMLTreeBuilder::processEndTagForInTableBody):
+        (WebCore::HTMLTreeBuilder::processEndTagForInRow):
+        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
+        (WebCore::HTMLTreeBuilder::processEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processEndTagForInTable):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        (WebCore::HTMLTreeBuilder::defaultForBeforeHTML):
+        (WebCore::HTMLTreeBuilder::defaultForBeforeHead):
+        (WebCore::HTMLTreeBuilder::defaultForInHead):
+        (WebCore::HTMLTreeBuilder::defaultForInHeadNoscript):
+        (WebCore::HTMLTreeBuilder::defaultForAfterHead):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        (WebCore::HTMLTreeBuilder::processGenericRCDATAStartTag):
+        (WebCore::HTMLTreeBuilder::processGenericRawTextStartTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::parseError):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+        * html/parser/TextDocumentParser.cpp:
+        (WebCore::TextDocumentParser::insertFakePreElement):
+
+2012-07-23  Scott Graham  <scottmg@google.com>
+
+        Use native (non-cygwin) binaries for perl, gperf, and bison in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=91667
+
+        Reviewed by Tony Chang.
+
+        Using native tools instead of cygwin version improves build time
+        performance by roughly 50% (on top of previous cl-instead-of-gcc
+        change).
+
+        Also, use - instead of / for cl flags because a layer of project
+        generator converts them to \ otherwise, which causes the preprocessing
+        to fail (very slowly because of the cygwin-loop with a sleep 1).
+
+        No new tests.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/rule_bison.py:
+        * bindings/scripts/preprocessor.pm:
+        (applyPreprocessor):
+        * make-hash-tools.pl:
+
+2012-06-12  Jer Noble  <jer.noble@apple.com>
+
+        MediaController.currentTime should be kept stable during script execution.
+        https://bugs.webkit.org/show_bug.cgi?id=88555
+
+        Reviewed by Eric Carlson.
+
+        Test: media/media-controller-time-constant.html
+
+        To keep MediaController.currentTime stable, add a new m_position variable and 
+        a new m_clearPositionTimer timer.  Both must be mutable variables as they will
+        be updated from within const functions.  Calls to currentTime() will result in
+        stable values until the next runloop iteration.
+
+        * html/MediaController.cpp:
+        (MediaController::MediaController):
+        (MediaController::currentTime):
+        (MediaController::setCurrentTime):
+        (MediaController::clearPositionTimerFired):
+        * html/MediaController.h:
+
+2012-07-23  Huang Dongsung  <luxtella@company100.net>
+
+        Destroy CSS decoded data more eagerly once they become dead caches.
+        https://bugs.webkit.org/show_bug.cgi?id=91733
+
+        Reviewed by Geoffrey Garen.
+
+        Internal review by Kwang Yul Seo.
+
+        There are three CachedResources with decoded data: CachedImage, CachedScript
+        and CachedCSSStyleSheet. In the cases of CachedImage and CachedScript, we
+        eagerly destroy the decoded data using Timer in CacehdResource::allClientsRemoved().
+        We must apply the same policy here in CachedCSSStyleSheet because priority
+        inversion can occur. For example, we can't destroy the decoded data of CachedImages
+        when they are referenced by CachedCSSStyleSheet as background, mask or border
+        images.
+
+        No new tests - no new testable functionality.
+
+        * loader/cache/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::CachedCSSStyleSheet):
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
+        (WebCore::CachedCSSStyleSheet::destroyDecodedData):
+        (WebCore):
+        (WebCore::CachedCSSStyleSheet::decodedDataDeletionTimerFired):
+        * loader/cache/CachedCSSStyleSheet.h:
+        (CachedCSSStyleSheet):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION. Add support for parsing the new '-webkit-sticky'
+        value for position, returning it from getComputedStyle(), and storing it in RenderStyle.
+
+        Test: fast/css/sticky/parsing-position-sticky.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EPosition):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2012-07-23  Stephen Chenney  <schenney@chromium.org>
+
+        Crash when setting empty class name on a new element
+        https://bugs.webkit.org/show_bug.cgi?id=92024
+
+        Reviewed by Andreas Kling.
+
+        Add a check for null attributeData() when setting the className to an
+        empty string on a newly created element. New SVG elements have null
+        attributeData() on baseVal upon creation.
+
+        Test: svg/custom/empty-className-baseVal-crash.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged): Add check for null attributeData()
+
+2012-07-23  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: clean up clipRect and drawableContentRect design
+        https://bugs.webkit.org/show_bug.cgi?id=80622
+
+        Reviewed by Adrienne Walker.
+
+        clipRect(), usesLayerClipping(), and drawableContentRect() have been
+        very confusing in CCLayerTreeHostCommon for a while. This patch
+        refactors it so that (1) clipping is only done locally in
+        calcDrawTransforms, and (2) the layer's drawableContentRect value
+        is now meaningful value outside of calcDrawTransforms.
+        Additionally, the layer is now always clipped to the root
+        surface's contentBounds (which are set to the viewport bounds).
+        This refactor not only makes calcDrawTransforms far more readable and intuitive, but
+        this patch enables more upcoming beneficial refactors, including
+        the pending refactor in https://bugs.webkit.org/show_bug.cgi?id=88953.
+
+        Tests are also significantly updated to keep up with this refactoring change.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        Removed m_usesLayerClipping and m_clipRect and associated accessors.
+
+        * platform/graphics/chromium/RenderSurfaceChromium.h:
+        (RenderSurfaceChromium):
+        Updated comment
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        Removed m_usesLayerClipping and m_clipRect and associated accessors.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+        removed setClipRect code that no longer applies
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::calculateLayerScissorRect):
+        scissor rect is now a little bit tighter, the intersection between damage and layer's new drawableContentRect.
+
+        (WebCore::calculateSurfaceScissorRect):
+        scissor rect is now a little bit tighter, except when filters are involved.
+
+        (WebCore::layerClipsSubtree):
+        new helper function
+
+        (WebCore):
+        (WebCore::calculateVisibleContentRect):
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+        (WebCore::calculateDrawTransformsInternal):
+           - added drawableContentRectOfSubtree to the function args, it is valid only after recursion returns,
+           - added clipRectFromAncestor and bool ancestorClipsSubtree to function args, this replaces the layer's clipRect and usesLayerClipping.
+           - removed the boolean return value, which was redundant with drawableContentRectOfSubtree.
+           - replaced all the "setDrawableContentRect" logic with more intuitive, clear logic.
+           - now, layer's drawableContentRect represents the clipped bounds of the layer expressed in the target surface space.
+
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransforms):
+        (WebCore::pointIsClippedBySurfaceOrClipRect):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderSurfaceLayerList):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::layerScissorRectInTargetSurface):
+        Updated this accessor.  It could be removed in the future, but not appropriate for this patch.
+
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMAKE] Added missing RenderLayerFilterInfo.cpp to build system.
+
+        * CMakeLists.txt:
+
+2012-07-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r123281): childNodes sometimes returns wrong nodes
+        https://bugs.webkit.org/show_bug.cgi?id=92014
+
+        Reviewed by Anders Carlsson.
+
+        The bug was caused by a typo in itemBeforeOrAfter. Namely, it should have been calling firstNode as
+        firstNode(forward, rootNode(), shouldOnlyIncludeDirectChildren()),
+        NOT firstNode(forward, rootNode(), previous)
+        as evident from the argument list of the function.
+
+        Test: fast/dom/NodeList/childNodes-reverse-iteration.html
+
+        * html/HTMLCollection.cpp:
+        (WebCore::DynamicNodeListCacheBase::itemBeforeOrAfter):
+
+2012-07-23  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Chrome/Skia: PDF print output does not have clickable links.
+        https://bugs.webkit.org/show_bug.cgi?id=91171
+
+        Reviewed by Stephen White.
+
+        Connect GraphicsContext::setURLForRect to Skia's new API for annotations.
+
+        Printing is not generally testable.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setURLForRect):
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        The rationale here is that the client doesn't need to know about the touch
+        event handler count. needTouchEvents was already used for that purpose.
+
+        Test: fast/events/touch/touch-handler-count.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::didAddTouchEventHandler): Only notify the client if needed.
+        (WebCore::Document::didRemoveTouchEventHandler): Ditto. Also unset the TOUCH_LISTENER
+        flag for the document if we reach a count of zero. The rationale being that
+        hasListenerType() is relied upon in other places in combination with TOUCH_LISTENER for
+        the same purpose.
+        * dom/Document.h:
+        (Document):
+        (WebCore::Document::touchEventHandlerCount):
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        (ChromeClient):
+        * page/Frame.cpp: Removed notifyChromeClientTouchEventHandlerCountChanged.
+        (WebCore::Frame::setDocument): call needsTouchEvents directly.
+        * page/Frame.h: Ditto.
+        (Frame):
+        * testing/Internals.cpp:
+        (WebCore::Internals::hasTouchEventListener): expose Document::hasListenerType indirectly
+        for additional testing.
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-23  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] RenderThemeQtMobile highlight colors are not being used
+        https://bugs.webkit.org/show_bug.cgi?id=92004
+
+        Reviewed by Noam Rosenthal.
+
+        The issue here is that setPaletteFromPageClientIfExists() is being used as a
+        virtual function, but it isn't, so when platformActiveSelectionBackgroundColor()
+        runs, it doesn't pick the right palette.
+
+        Besides fixing this virtual behavior, the patch changes the structure a bit,
+        because setPaletteFromPageClientIfExists() was being "overriden" in mobile theme
+        to set the palette, which isn't exactly what the function name says.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeQt::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeQt::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeQt::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeQt::platformFocusRingColor):
+        (WebCore::RenderThemeQt::systemColor):
+        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack):
+        Use the virtual colorPalette() to get the palette.
+
+        (WebCore::RenderThemeQt::colorPalette):
+        (WebCore): Removed the code for getting the page client from here since it is
+        used only by the QStyle variant.
+
+        * platform/qt/RenderThemeQt.h:
+        (RenderThemeQt):
+        * platform/qt/RenderThemeQtMobile.cpp:
+        (WebCore::RenderThemeQtMobile::colorPalette):
+        (WebCore):
+        * platform/qt/RenderThemeQtMobile.h:
+        (RenderThemeQtMobile):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123339.
+        http://trac.webkit.org/changeset/123339
+        https://bugs.webkit.org/show_bug.cgi?id=92006
+
+        massive media tests failure (Requested by philn on #webkit).
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (setGstElementClassMetadata):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+
+2012-07-21  Vincent Scheib  <scheib@chromium.org>
+
+        webkitFullscreenElement, webkitCurrentFullScreenElement, webkitPointerLockElement block cross origin access.
+        https://bugs.webkit.org/show_bug.cgi?id=91892
+
+        Reviewed by Adam Barth.
+
+        PointerLockElement only returned when requested from the document that owns it.
+
+        Tests: http/tests/fullscreen/fullscreenelement-different-origin.html
+               http/tests/fullscreen/fullscreenelement-same-origin.html
+               http/tests/pointer-lock/pointerlockelement-different-origin.html
+               http/tests/pointer-lock/pointerlockelement-same-origin.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitPointerLockElement):
+
+2012-07-23  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK][jhbuild] Switch to GStreamer 0.11 build
+        https://bugs.webkit.org/show_bug.cgi?id=91727
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a new function to encapsulate the GStreamer API removal of
+        GST_OBJECT_IS_FLOATING in the upcoming 1.0 release. Use of this
+        macro can now be replaced by calling the g_object_is_floating
+        function.
+
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::adoptGRef):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp:
+        (gstObjectIsFloating):
+        * platform/graphics/gstreamer/GStreamerVersioning.h:
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] media/controls-styling.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=91984
+
+        Reviewed by Eric Carlson.
+
+        Make sure that the CSS properties letter-spacing, word-spacing,
+        line-height, text-transform, text-indent, text-shadow,
+        text-decoration and color do not affect the media element controls,
+        that display text.
+
+        No new tests. Already tested by media/controls-styling.html and
+        media/controls-styling-strict.html
+
+        * css/mediaControlsEfl.css:
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+
+2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header files.
+
+2012-07-23  Kent Tamura  <tkent@chromium.org>
+
+        Replace some instances of shadowAncestorNode() with shadowHost()
+        https://bugs.webkit.org/show_bug.cgi?id=91966
+
+        Reviewed by Hajime Morita.
+
+        shadowAncestorNode() is deprecated. We should use shadowHost().
+        No new tests. This doesn't change any behavior.
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkSelector):
+        * dom/TreeScope.cpp:
+        (WebCore::listTreeScopes):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::isClickableControl):
+        * html/shadow/DetailsMarkerControl.cpp:
+        (WebCore::DetailsMarkerControl::summaryElement):
+        * html/shadow/MeterShadowElement.cpp:
+        (WebCore::MeterShadowElement::meterElement):
+        * html/shadow/ProgressShadowElement.cpp:
+        (WebCore::ProgressShadowElement::progressElement):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::RenderSliderThumb::layout):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::SliderThumbElement::hostInput):
+        (WebCore::TrackLimiterElement::shadowPseudoId):
+        (WebCore::SliderContainerElement::shadowPseudoId):
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::customStyleForRenderer):
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        (WebCore::TextControlInnerTextElement::createRenderer):
+        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
+        (WebCore::SearchFieldResultsButtonElement::shadowPseudoId):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::step):
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::setState):
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult):
+        (WebCore::InputFieldSpeechButtonElement::startSpeechInput):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+
+2012-07-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        [WK2] REGRESSION r122966: Crash when closing tab with Web Inspector open in WebKit::PageOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=91782
+
+        Reviewed by Yury Semikhatsky.
+
+        hideHighlight was never called once user hovered over a node.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        (WebCore::InspectorOverlay::update):
+
+2012-07-23  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Build fix for the Windows builder following r123311
+        https://bugs.webkit.org/show_bug.cgi?id=91979
+
+        Unreviewed build fix.
+
+        Changeset r123311 moved the TextCodecWinCE.{cpp,h} files to the Windows
+        directory. Update Chromium's references to these files to fix the build.
+
+        * WebCore.gypi:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove ICU dependencies from UniscribeController
+        https://bugs.webkit.org/show_bug.cgi?id=91921
+
+        Reviewed by Ryosuke Niwa.
+
+        Replace ICU specific functions and macros with the corresponding code from WTF::Unicode.
+        This allows us to use UniscribeController with an other Unicode implementation too.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::advance):
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] media/controls-styling-strict.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=91960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use "display: -webkit-box;" instead of inline-block
+        for current-time control. This is needed because
+        inline-block behaves differently in strict mode.
+
+        No new test, already tested by media/controls-styling-strict.html
+
+        * css/mediaControlsEfl.css:
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+
+2012-07-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with ENABLE_DATALIST_ELEMENT.
+
+        Add an implementation for virtual pure methods sliderTickSize()
+        and sliderTickOffsetFromTrackCenter() when HTML5 datalist element
+        is enabled.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore):
+        (WebCore::RenderThemeGtk::sliderTickSize):
+        (WebCore::RenderThemeGtk::sliderTickOffsetFromTrackCenter):
+        * platform/gtk/RenderThemeGtk.h:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace getCurrentLocalTime() with GetLocalTime() in LocaleWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=91937
+
+        Reviewed by Ryosuke Niwa.
+
+        The windows function returns the required year directly and
+        removes one additonal dependecy on getCurrentLocalTime().
+
+        * platform/text/LocaleWin.cpp:
+        (WebCore::LocaleWin::LocaleWin):
+
+2012-07-23  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Drag and drop should not be started on right mouse click.
+        https://bugs.webkit.org/show_bug.cgi?id=91728
+
+        Reviewed by Pavel Feldman.
+
+        Introduced WebInspector.installDragHandle method to control drag and drop support, checking whichg mouse button is pressed.
+        Simplified WebInspector._elementDragStart, removed "element" parameter.
+        Simplified tab moving support in TabbedPane, removed "mousemove" handler.
+        Removed while loop determining which element was dragged in TimelineOverviewPane, each drag support is now installed independently.
+        Drive-by: fixed TimelineOverviewPane window moving on resources-dividers-label-bar drang-and-drop.
+        Drive-by: fixed CSSStyleModel compilation.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getNamedFlowCollectionAsync):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype._positionResizers):
+        (WebInspector.DataGrid.prototype._startResizerDragging):
+        (WebInspector.DataGrid.prototype._endResizerDragging):
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer):
+        (WebInspector.Drawer.prototype._animationDuration):
+        (WebInspector.Drawer.prototype._startStatusBarDragging):
+        (WebInspector.Drawer.prototype._endStatusBarDragging):
+        * inspector/front-end/HeapSnapshotView.js:
+        (WebInspector.HeapSnapshotView.prototype._startRetainersHeaderDragging):
+        (WebInspector.HeapSnapshotView.prototype._endRetainersHeaderDragging):
+        * inspector/front-end/SidebarOverlay.js:
+        (WebInspector.SidebarOverlay.prototype.set _startResizerDragging):
+        (WebInspector.SidebarOverlay.prototype._endResizerDragging):
+        (WebInspector.SidebarOverlay.prototype._installResizer):
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/SplitView.js:
+        (WebInspector.SplitView.prototype._startResizerDragging):
+        (WebInspector.SplitView.prototype._endResizerDragging):
+        (WebInspector.SplitView.prototype.installResizer):
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabMouseDown):
+        (WebInspector.TabbedPaneTab.prototype._startTabDragging):
+        (WebInspector.TabbedPaneTab.prototype._endTabDragging):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._leftResizeElementDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._rightResizeElementDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._startWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowSelectorDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._startWindowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._windowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._endWindowDragging):
+        (WebInspector.TimelineOverviewWindow.prototype._moveWindow):
+        (WebInspector.TimelineOverviewWindow.prototype._onMouseWheel):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._startSplitterDragging):
+        (WebInspector.TimelinePanel.prototype._endSplitterDragging):
+        * inspector/front-end/Toolbar.js:
+        (WebInspector.Toolbar):
+        (WebInspector.Toolbar.prototype._toolbarDragStart):
+        (WebInspector.Toolbar.prototype._toolbarDragEnd):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector.installDragHandle):
+        (WebInspector._elementDragStart):
+        (WebInspector._elementDragEnd):
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-overview-grid .resources-dividers-label-bar):
+
+2012-07-23  Hayato Ito  <hayato@chromium.org>
+
+        ComposedShadowTreeWalker should skip an empty insertion points.
+        https://bugs.webkit.org/show_bug.cgi?id=91826
+
+        Reviewed by Hajime Morita.
+
+        ComposedShadowTreeWalker wrongly returns 'null' if it encounters
+        an insertion point into where no nodes are distributed.  We should
+        skip such an insertion point and continue walking using the next
+        possible node, which might be a next sibling or a next distributed
+        node, and resolve the next node recursively.
+
+        Test: fast/dom/shadow/composed-shadow-tree-walker.html
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseLightChildren):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblings):
+        (WebCore::ComposedShadowTreeWalker::traverseNode):
+        (WebCore::ComposedShadowTreeWalker::traverseDistributedeNodes):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint):
+        (WebCore::ComposedShadowTreeWalker::traverseSiblingInCurrentTree):
+        (WebCore::ComposedShadowTreeWalker::traverseBackToYoungerShadowRoot):
+        * dom/ComposedShadowTreeWalker.h:
+        (ComposedShadowTreeWalker):
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Rename TextCodecWinCE to TextCodecWin
+        https://bugs.webkit.org/show_bug.cgi?id=91947
+
+        Reviewed by Ryosuke Niwa.
+
+        Since TextCodecWinCE is used by other (non-upstreamed) windows ports too,
+        TextCodecWin is a better name for the implementation.
+        Also remove the dependency on WinCE FontCache to make it more usable.
+
+        * PlatformWinCE.cmake:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::extendTextCodecMaps):
+        * platform/text/win/TextCodecWin.cpp: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.cpp.
+        * platform/text/win/TextCodecWin.h: Renamed from Source/WebCore/platform/text/wince/TextCodecWinCE.h.
+
 2012-07-22  Kentaro Hara  <haraken@chromium.org>
 
         [V8] CodeGeneratorV8.pm should support static attributes
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 80259a75e..49182f3a0 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -37,14 +37,16 @@ ENABLE_ANIMATION_API = ;
 ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
-ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
-ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
+ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
+ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
+ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
@@ -134,4 +136,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index bd1758334..0e5c3b032 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 7287d9cbb..a4d374152 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -267,6 +267,7 @@
 #include "JSPositionErrorCallback.cpp"
 #include "JSProcessingInstruction.cpp"
 #include "JSProgressEvent.cpp"
+#include "JSPropertyNodeList.cpp"
 #include "JSRadioNodeList.cpp"
 #include "JSRange.cpp"
 #include "JSRangeException.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index ea60b26b7..50e630af2 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -242,6 +242,8 @@ BINDING_IDLS = \
     $(WebCore)/dom/PopStateEvent.idl \
     $(WebCore)/dom/ProcessingInstruction.idl \
     $(WebCore)/dom/ProgressEvent.idl \
+    $(WebCore)/dom/ProgressEvent.idl \
+    $(WebCore)/dom/PropertyNodeList.idl \
     $(WebCore)/dom/Range.idl \
     $(WebCore)/dom/RangeException.idl \
     $(WebCore)/dom/RequestAnimationFrameCallback.idl \
@@ -348,6 +350,7 @@ BINDING_IDLS = \
     $(WebCore)/html/ImageData.idl \
     $(WebCore)/html/MediaController.idl \
     $(WebCore)/html/MediaError.idl \
+    $(WebCore)/html/MicroDataItemValue.idl \
     $(WebCore)/html/RadioNodeList.idl \
     $(WebCore)/html/TextMetrics.idl \
     $(WebCore)/html/TimeRanges.idl \
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 2c29c8f52..97178edf7 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -252,6 +252,7 @@ IDL_BINDINGS += \
     $$PWD/dom/PopStateEvent.idl \
     $$PWD/dom/ProcessingInstruction.idl \
     $$PWD/dom/ProgressEvent.idl \
+    $$PWD/dom/PropertyNodeList.idl \
     $$PWD/dom/RangeException.idl \
     $$PWD/dom/Range.idl \
     $$PWD/dom/RequestAnimationFrameCallback.idl \
@@ -396,6 +397,7 @@ IDL_BINDINGS += \
     $$PWD/html/ImageData.idl \
     $$PWD/html/MediaController.idl \
     $$PWD/html/MediaError.idl \
+    $$PWD/html/MicroDataItemValue.idl \
     $$PWD/html/RadioNodeList.idl \
     $$PWD/html/TextMetrics.idl \
     $$PWD/html/TimeRanges.idl \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index 3eb943991..9698d6f58 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -405,6 +405,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMessageEvent.h \
 	DerivedSources/WebCore/JSMessagePort.cpp \
 	DerivedSources/WebCore/JSMessagePort.h \
+	DerivedSources/WebCore/JSMicroDataItemValue.cpp \
+	DerivedSources/WebCore/JSMicroDataItemValue.h \
 	DerivedSources/WebCore/JSMouseEvent.cpp \
 	DerivedSources/WebCore/JSMouseEvent.h \
 	DerivedSources/WebCore/JSMutationCallback.cpp \
@@ -477,6 +479,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSProcessingInstruction.h \
 	DerivedSources/WebCore/JSProgressEvent.cpp \
 	DerivedSources/WebCore/JSProgressEvent.h \
+	DerivedSources/WebCore/JSPropertyNodeList.cpp \
+	DerivedSources/WebCore/JSPropertyNodeList.h \
 	DerivedSources/WebCore/JSRadioNodeList.cpp \
 	DerivedSources/WebCore/JSRadioNodeList.h \
 	DerivedSources/WebCore/JSRange.cpp \
@@ -795,6 +799,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/PopStateEvent.idl \
 	$(WebCore)/dom/ProcessingInstruction.idl \
 	$(WebCore)/dom/ProgressEvent.idl \
+	$(WebCore)/dom/PropertyNodeList.idl \
 	$(WebCore)/dom/Range.idl \
 	$(WebCore)/dom/RangeException.idl \
 	$(WebCore)/dom/ShadowRoot.idl \
@@ -900,6 +905,7 @@ dom_binding_idls += \
 	$(WebCore)/html/MediaError.idl \
 	$(WebCore)/html/MediaKeyError.idl \
 	$(WebCore)/html/MediaKeyEvent.idl \
+	$(WebCore)/html/MicroDataItemValue.idl \
 	$(WebCore)/html/RadioNodeList.idl \
 	$(WebCore)/html/TextMetrics.idl \
 	$(WebCore)/html/TimeRanges.idl \
@@ -1317,6 +1323,8 @@ webcore_sources += \
 	Source/WebCore/accessibility/AccessibilityMenuListPopup.h \
 	Source/WebCore/accessibility/AccessibilityMockObject.cpp \
 	Source/WebCore/accessibility/AccessibilityMockObject.h \
+	Source/WebCore/accessibility/AccessibilityNodeObject.cpp \
+	Source/WebCore/accessibility/AccessibilityNodeObject.h \
 	Source/WebCore/accessibility/AccessibilityObject.cpp \
 	Source/WebCore/accessibility/AccessibilityObject.h \
 	Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp \
@@ -1483,6 +1491,7 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSMessageEventCustom.cpp \
 	Source/WebCore/bindings/js/JSMessagePortCustom.cpp \
 	Source/WebCore/bindings/js/JSMessagePortCustom.h \
+	Source/WebCore/bindings/js/JSMicroDataItemValueCustom.cpp \
 	Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp \
 	Source/WebCore/bindings/js/JSMutationObserverCustom.cpp \
 	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
@@ -2014,6 +2023,8 @@ webcore_sources += \
 	Source/WebCore/dom/ProcessingInstruction.h \
 	Source/WebCore/dom/ProgressEvent.cpp \
 	Source/WebCore/dom/ProgressEvent.h \
+	Source/WebCore/dom/PropertyNodeList.cpp \
+	Source/WebCore/dom/PropertyNodeList.h \
 	Source/WebCore/dom/QualifiedName.cpp \
 	Source/WebCore/dom/QualifiedName.h \
 	Source/WebCore/dom/RangeBoundaryPoint.h \
@@ -3508,6 +3519,8 @@ webcore_sources += \
 	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
 	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
 	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
+	Source/WebCore/platform/LayoutTestSupport.cpp \
+	Source/WebCore/platform/LayoutTestSupport.h \
 	Source/WebCore/platform/linux/GamepadDeviceLinux.cpp \
 	Source/WebCore/platform/linux/GamepadDeviceLinux.h \
 	Source/WebCore/platform/mediastream/DeprecatedPeerConnectionHandler.h \
@@ -4111,6 +4124,7 @@ webcore_sources += \
 	Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp \
 	Source/WebCore/rendering/style/SVGRenderStyleDefs.h \
 	Source/WebCore/rendering/style/SVGRenderStyle.h \
+	Source/WebCore/rendering/style/WrapShapes.h \
 	Source/WebCore/rendering/svg/RenderSVGBlock.cpp \
 	Source/WebCore/rendering/svg/RenderSVGBlock.h \
 	Source/WebCore/rendering/svg/RenderSVGContainer.cpp \
@@ -5914,6 +5928,7 @@ webcore_built_sources += \
 
 webcore_sources += \
 	Source/ThirdParty/ANGLE/include/GLSLANG/ShaderLang.h \
+	Source/ThirdParty/ANGLE/src/common/angleutils.h \
 	Source/ThirdParty/ANGLE/src/compiler/BaseTypes.h \
 	Source/ThirdParty/ANGLE/src/compiler/BuiltInFunctionEmulator.cpp \
 	Source/ThirdParty/ANGLE/src/compiler/BuiltInFunctionEmulator.h \
@@ -6007,6 +6022,7 @@ webcore_sources += \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/new/Token.h \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/new/Tokenizer.cpp \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/new/Tokenizer.h \
+	Source/ThirdParty/ANGLE/src/compiler/preprocessor/new/pp_utils.h \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/parser.h \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocess.h \
 	Source/ThirdParty/ANGLE/src/compiler/preprocessor/scanner.c \
@@ -6265,4 +6281,3 @@ dom_binding_idls += \
 	$(WebCore)/Modules/quota/StorageInfoUsageCallback.idl
 
 endif  # END ENABLE_QUOTA
-
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
index 1dff24c19..968ab1843 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
@@ -29,8 +29,16 @@
 
 #include "SpeechRecognitionResult.h"
 
+#include "Document.h"
+#include "Element.h"
+#include "Text.h"
+
 namespace WebCore {
 
+SpeechRecognitionResult::~SpeechRecognitionResult()
+{
+}
+
 PassRefPtr<SpeechRecognitionResult> SpeechRecognitionResult::create(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
 {
     return adoptRef(new SpeechRecognitionResult(alternatives, final));
@@ -44,6 +52,46 @@ SpeechRecognitionAlternative* SpeechRecognitionResult::item(unsigned long index)
     return m_alternatives[index].get();
 }
 
+Document* SpeechRecognitionResult::emma()
+{
+    if (m_emma)
+        return m_emma.get();
+
+    RefPtr<Document> document = Document::create(0, KURL());
+
+    const char emmaNamespaceUrl[] = "http://www.w3.org/2003/04/emma";
+    RefPtr<Element> emmaElement = document->createElement(QualifiedName("emma", "emma", emmaNamespaceUrl), false);
+    ExceptionCode ec = 0;
+    emmaElement->setAttribute("version", "1.0", ec);
+    ASSERT(!ec);
+    if (ec)
+        return 0;
+
+    RefPtr<Element> oneOf = document->createElement(QualifiedName("emma", "one-of", emmaNamespaceUrl), false);
+    oneOf->setAttribute(QualifiedName("emma", "medium", emmaNamespaceUrl), "acoustic");
+    oneOf->setAttribute(QualifiedName("emma", "mode", emmaNamespaceUrl), "voice");
+    oneOf->setIdAttribute("one-of");
+
+    for (size_t i = 0; i < m_alternatives.size(); ++i) {
+        const RefPtr<SpeechRecognitionAlternative>& alternative = m_alternatives[i];
+
+        RefPtr<Element> interpretation = document->createElement(QualifiedName("emma", "interpretation", emmaNamespaceUrl), false);
+        interpretation->setIdAttribute(String::number(i + 1));
+        interpretation->setAttribute(QualifiedName("emma", "confidence", emmaNamespaceUrl), String::number(alternative->confidence()));
+
+        RefPtr<Element> literal = document->createElement(QualifiedName("emma", "literal", emmaNamespaceUrl), false);
+        literal->appendChild(document->createTextNode(alternative->transcript()));
+        interpretation->appendChild(literal.release());
+        oneOf->appendChild(interpretation.release());
+    }
+
+    emmaElement->appendChild(oneOf.release());
+    document->appendChild(emmaElement.release());
+
+    m_emma = document;
+    return m_emma.get();
+}
+
 SpeechRecognitionResult::SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
     : m_alternatives(alternatives)
     , m_final(final)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.h b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
index 38645cb04..18f76e147 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
@@ -34,19 +34,24 @@
 
 namespace WebCore {
 
+class Document;
+
 class SpeechRecognitionResult : public RefCounted<SpeechRecognitionResult> {
 public:
+    ~SpeechRecognitionResult();
     static PassRefPtr<SpeechRecognitionResult> create(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
 
     unsigned long length() { return m_alternatives.size(); }
     SpeechRecognitionAlternative* item(unsigned long index);
     bool final() { return m_final; }
+    Document* emma();
 
 private:
     SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
 
     Vector<RefPtr<SpeechRecognitionAlternative> > m_alternatives;
     bool m_final;
+    RefPtr<Document> m_emma;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
index 3f912621c..b3356c15d 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
@@ -26,11 +26,14 @@
 module core {
     interface [
         Conditional=SCRIPTED_SPEECH,
-        IndexedGetter
+        CustomIsReachable,
+        IndexedGetter,
+        V8DependentLifetime
     ] SpeechRecognitionResult {
         readonly attribute unsigned long length;
         SpeechRecognitionAlternative item(in [IsIndex] unsigned long index);
         readonly attribute boolean final;
+        readonly attribute Document emma;
     };
 }
 
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 66fa903d5..102e6699a 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -1,7 +1,6 @@
 LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/wince"
     "${WEBCORE_DIR}/platform/win"
-    "${WEBCORE_DIR}/platform/text/wince"
     "${WEBCORE_DIR}/platform/graphics/wince"
     "${WEBCORE_DIR}/platform/graphics/win"
     "${WEBCORE_DIR}/platform/network/win"
@@ -114,8 +113,9 @@ LIST(APPEND WebCore_SOURCES
 
     platform/text/TextEncodingDetectorNone.cpp
 
+    platform/text/win/TextCodecWin.cpp
+
     platform/text/wince/TextBreakIteratorWince.cpp
-    platform/text/wince/TextCodecWinCE.cpp
 )
 
 LIST(APPEND WebCore_LIBRARIES
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 23bc2d0e2..d86719516 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -52,6 +52,7 @@ SOURCES += \
     accessibility/AccessibilityList.cpp \
     accessibility/AccessibilityListBox.cpp \
     accessibility/AccessibilityListBoxOption.cpp \
+    accessibility/AccessibilityNodeObject.cpp \
     accessibility/AccessibilityProgressIndicator.cpp \
     accessibility/AccessibilityRenderObject.cpp \
     accessibility/AccessibilityScrollbar.cpp \
@@ -166,6 +167,7 @@ SOURCES += \
      bindings/js/JSMessageEventCustom.cpp \
      bindings/js/JSMessagePortCustom.cpp \
      bindings/js/JSMessagePortCustom.h \
+     bindings/js/JSMicroDataItemValueCustom.cpp \
      bindings/js/JSMutationCallbackCustom.cpp \
      bindings/js/JSMutationObserverCustom.cpp \
      bindings/js/JSNamedNodeMapCustom.cpp \
@@ -439,6 +441,7 @@ SOURCES += \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
     dom/ProgressEvent.cpp \
+    dom/PropertyNodeList.cpp \
     dom/QualifiedName.cpp \
     dom/Range.cpp \
     dom/RangeException.cpp \
@@ -997,6 +1000,7 @@ SOURCES += \
     platform/KillRingNone.cpp \
     platform/KURL.cpp \
     platform/Language.cpp \
+    platform/LayoutTestSupport.cpp \
     platform/Length.cpp \
     platform/LengthBox.cpp \
     platform/text/LineEnding.cpp \
@@ -1561,6 +1565,7 @@ HEADERS += \
     dom/PositionIterator.h \
     dom/ProcessingInstruction.h \
     dom/ProgressEvent.h \
+    dom/PropertyNodeList.h \
     dom/QualifiedName.h \
     dom/Range.h \
     dom/RegisteredEventListener.h \
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index 7fe841965..c4c908848 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -115,6 +115,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSMessageChannelCustom.cpp
     bindings/js/JSMessageEventCustom.cpp
     bindings/js/JSMessagePortCustom.cpp
+    bindings/js/JSMicroDataItemValueCustom.cpp
     bindings/js/JSMutationCallbackCustom.cpp
     bindings/js/JSMutationObserverCustom.cpp
     bindings/js/JSNamedNodeMapCustom.cpp
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 239cb4ef1..8690ab238 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -130,6 +130,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8MessageChannelConstructor.cpp
     bindings/v8/custom/V8MessageEventCustom.cpp
     bindings/v8/custom/V8MessagePortCustom.cpp
+    bindings/v8/custom/V8MicroDataItemValueCustom.cpp
     bindings/v8/custom/V8MutationCallbackCustom.cpp
     bindings/v8/custom/V8MutationObserverCustom.cpp
     bindings/v8/custom/V8NamedNodeMapCustom.cpp
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 98843d634..1658a432e 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -591,6 +591,7 @@ __ZN7WebCore24ComposedShadowTreeWalker8previousEv
 __ZN7WebCore24ComposedShadowTreeWalker9lastChildEv
 __ZN7WebCore24DocumentMarkerController10markersForEPNS_4NodeENS_14DocumentMarker11MarkerTypesE
 __ZN7WebCore24DocumentMarkerController13removeMarkersENS_14DocumentMarker11MarkerTypesE
+__ZN7WebCore24DocumentMarkerController18addTextMatchMarkerEPKNS_5RangeEb
 __ZN7WebCore24DocumentMarkerController23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore24FrameDestructionObserver12observeFrameEPNS_5FrameE
 __ZN7WebCore24FrameDestructionObserver14frameDestroyedEv
@@ -1029,7 +1030,6 @@ __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
 __ZN7WebCore9TimerBaseD2Ev
-__ZN7WebCore9TreeScope12nullInstanceEv
 __ZN7WebCore9closeFileERi
 __ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore9fontCacheEv
@@ -1274,6 +1274,7 @@ __ZNK7WebCore4Node20traversePreviousNodeEPKS0_
 __ZNK7WebCore4Node27traverseNextAncestorSiblingEv
 __ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv
 __ZNK7WebCore4Node9nodeIndexEv
+__ZNK7WebCore4Node9treeScopeEv
 __ZNK7WebCore4Page10pluginDataEv
 __ZNK7WebCore4Page14renderTreeSizeEv
 __ZNK7WebCore4Page15backForwardListEv
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index a172d5e5b..395e27856 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -287,6 +287,8 @@
             'platform/KURL.h',
             'platform/KURLHash.h',
             'platform/Language.h',
+            'platform/LayoutTestSupport.cpp',
+            'platform/LayoutTestSupport.h',
             'platform/Length.h',
             'platform/LengthBox.h',
             'platform/LengthSize.h',
@@ -989,6 +991,7 @@
             'dom/PopStateEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
+            'dom/PropertyNodeList.idl',
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/RequestAnimationFrameCallback.idl',
@@ -1096,6 +1099,7 @@
             'html/ImageData.idl',
             'html/MediaController.idl',
             'html/MediaError.idl',
+            'html/MicroDataItemValue.idl',
             'html/MediaKeyError.idl',
             'html/MediaKeyEvent.idl',
             'html/RadioNodeList.idl',
@@ -1792,6 +1796,8 @@
             'accessibility/AccessibilityMenuListPopup.h',
             'accessibility/AccessibilityMockObject.cpp',
             'accessibility/AccessibilityMockObject.h',
+            'accessibility/AccessibilityNodeObject.cpp',
+            'accessibility/AccessibilityNodeObject.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityProgressIndicator.cpp',
             'accessibility/AccessibilityProgressIndicator.h',
@@ -2035,6 +2041,7 @@
             'bindings/js/JSMessageEventCustom.cpp',
             'bindings/js/JSMessagePortCustom.cpp',
             'bindings/js/JSMessagePortCustom.h',
+            'bindings/js/JSMicroDataItemValueCustom.cpp',
             'bindings/js/JSMutationCallbackCustom.cpp',
             'bindings/js/JSMutationObserverCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
@@ -2346,6 +2353,7 @@
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
             'bindings/v8/custom/V8MessageEventCustom.cpp',
             'bindings/v8/custom/V8MessagePortCustom.cpp',
+            'bindings/v8/custom/V8MicroDataItemValueCustom.cpp',
             'bindings/v8/custom/V8MutationCallbackCustom.cpp',
             'bindings/v8/custom/V8MutationObserverCustom.cpp',
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
@@ -2367,6 +2375,7 @@
             'bindings/v8/custom/V8SVGPathSegCustom.cpp',
             'bindings/v8/custom/V8ScriptProfileCustom.cpp',
             'bindings/v8/custom/V8ScriptProfileNodeCustom.cpp',
+            'bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8StyleSheetCustom.cpp',
             'bindings/v8/custom/V8StyleSheetListCustom.cpp',
@@ -4457,9 +4466,9 @@
             'platform/text/transcoder/FontTranscoder.cpp',
             'platform/text/transcoder/FontTranscoder.h',
             'platform/text/win/TextBreakIteratorInternalICUWin.cpp',
+            'platform/text/win/TextCodecWin.cpp',
+            'platform/text/win/TextCodecWin.h',
             'platform/text/wince/TextBreakIteratorWinCE.cpp',
-            'platform/text/wince/TextCodecWinCE.cpp',
-            'platform/text/wince/TextCodecWinCE.h',
             'platform/win/BString.cpp',
             'platform/win/BString.h',
             'platform/win/BitmapInfo.cpp',
@@ -5238,6 +5247,8 @@
             'dom/ProcessingInstruction.h',
             'dom/ProgressEvent.cpp',
             'dom/ProgressEvent.h',
+            'dom/PropertyNodeList.cpp',
+            'dom/PropertyNodeList.h',
             'dom/QualifiedName.cpp',
             'dom/Range.cpp',
             'dom/RangeException.cpp',
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 14123fea1..f284098f5 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -11310,6 +11310,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMicroDataItemValue.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMicroDataItemValue.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMetadata.cpp"
 				>
 				<FileConfiguration
@@ -12990,6 +13046,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSPropertyNodeList.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSPropertyNodeList.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSRadioNodeList.cpp"
 				>
 				<FileConfiguration
@@ -28163,6 +28275,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\LayoutTestSupport.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\platform\LayoutTestSupport.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\Length.cpp"
 				>
 			</File>
@@ -52859,6 +52979,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\PropertyNodeList.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\PropertyNodeList.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\QualifiedName.cpp"
 				>
 			</File>
@@ -68366,6 +68542,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\JSMicroDataItemValueCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSMicroDataItemValueCustom.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\JSMutationCallbackCustom.cpp"
 					>
 					<FileConfiguration
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 67e6bc5d8..1066ce6df 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -280,6 +280,13 @@
 		0FF5026A102BA9430066F39A /* JSStyleMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF50268102BA9430066F39A /* JSStyleMedia.h */; };
 		0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF5026E102BA9660066F39A /* StyleMedia.cpp */; };
 		0FF50272102BA96A0066F39A /* StyleMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF5026F102BA96A0066F39A /* StyleMedia.h */; };
+		1059457315B42953004D37FD /* JSMicroDataItemValueCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1059457215B42953004D37FD /* JSMicroDataItemValueCustom.cpp */; };
+		1059457715B42A0D004D37FD /* JSMicroDataItemValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1059457515B42A0D004D37FD /* JSMicroDataItemValue.cpp */; };
+		1059457A15B42A43004D37FD /* JSMicroDataItemValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 1059457915B42A43004D37FD /* JSMicroDataItemValue.h */; };
+		1059459715B42A8E004D37FD /* PropertyNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1059459615B42A8E004D37FD /* PropertyNodeList.cpp */; };
+		1059459915B42AA0004D37FD /* PropertyNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1059459815B42AA0004D37FD /* PropertyNodeList.h */; };
+		1059459D15B42B0C004D37FD /* JSPropertyNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1059459C15B42B0C004D37FD /* JSPropertyNodeList.cpp */; };
+		1059459F15B42B1A004D37FD /* JSPropertyNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1059459E15B42B1A004D37FD /* JSPropertyNodeList.h */; };
 		10FB084B14E15C7E00A3DB98 /* PublicURLManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 10FB084A14E15C7E00A3DB98 /* PublicURLManager.h */; };
 		12F35EB6158745A40035CB63 /* WebKitNamedFlowCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 12F35EB4158745A40035CB63 /* WebKitNamedFlowCollection.h */; };
 		12F35EB7158745A40035CB63 /* WebKitNamedFlowCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 12F35EB5158745A40035CB63 /* WebKitNamedFlowCollection.cpp */; };
@@ -5895,6 +5902,7 @@
 		D630E2AC149BF344005B2F94 /* StatsCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F94 /* StatsCounter.h */; };
 		D630E2AC149BF344005B2F95 /* MemoryUsageSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F95 /* MemoryUsageSupport.h */; };
 		D630E2AC149BF344005B2F96 /* EventTracer.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F96 /* EventTracer.h */; };
+		D630E2AC149BF344005B2F93 /* LayoutTestSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = D630E2AB149BF344005B2F97 /* LayoutTestSupport.h */; };
 		D6E276AF14637455001D280A /* MutationObserverRegistration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6E276AD14637455001D280A /* MutationObserverRegistration.cpp */; };
 		D6E276B014637455001D280A /* MutationObserverRegistration.h in Headers */ = {isa = PBXBuildFile; fileRef = D6E276AE14637455001D280A /* MutationObserverRegistration.h */; };
 		D6E528A3149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6E528A1149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp */; };
@@ -5903,6 +5911,7 @@
 		D6FDAEF3149C06190037B1E2 /* StatsCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6FDAEF2149C06190037B1E2 /* StatsCounter.cpp */; };
 		D6FDAEF3149C06190037B1E3 /* MemoryUsageSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6FDAEF2149C06190037B1E3 /* MemoryUsageSupport.cpp */; };
 		D6FDAEF3149C06190037B1E4 /* EventTracer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6FDAEF2149C06190037B1E4 /* EventTracer.cpp */; };
+		D6FDAEF3149C06190037B1E5 /* LayoutTestSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D6FDAEF2149C06190037B1E5 /* LayoutTestSupport.cpp */; };
 		D70AD65713E1342B005B50B4 /* RenderRegion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D70AD65513E1342B005B50B4 /* RenderRegion.cpp */; };
 		D70AD65813E1342B005B50B4 /* RenderRegion.h in Headers */ = {isa = PBXBuildFile; fileRef = D70AD65613E1342B005B50B4 /* RenderRegion.h */; };
 		D72F6D79153159A3001EE44E /* FlowThreadController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D72F6D77153159A3001EE44E /* FlowThreadController.cpp */; };
@@ -7243,6 +7252,15 @@
 		0FF5026E102BA9660066F39A /* StyleMedia.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StyleMedia.cpp; sourceTree = "<group>"; };
 		0FF5026F102BA96A0066F39A /* StyleMedia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StyleMedia.h; sourceTree = "<group>"; };
 		0FF50270102BA96A0066F39A /* StyleMedia.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = StyleMedia.idl; sourceTree = "<group>"; };
+		1059457115B428C3004D37FD /* MicroDataItemValue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MicroDataItemValue.idl; sourceTree = "<group>"; };
+		1059457215B42953004D37FD /* JSMicroDataItemValueCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMicroDataItemValueCustom.cpp; sourceTree = "<group>"; };
+		1059457515B42A0D004D37FD /* JSMicroDataItemValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMicroDataItemValue.cpp; sourceTree = "<group>"; };
+		1059457915B42A43004D37FD /* JSMicroDataItemValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMicroDataItemValue.h; sourceTree = "<group>"; };
+		1059459615B42A8E004D37FD /* PropertyNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyNodeList.cpp; sourceTree = "<group>"; };
+		1059459815B42AA0004D37FD /* PropertyNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyNodeList.h; sourceTree = "<group>"; };
+		1059459A15B42AC0004D37FD /* PropertyNodeList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PropertyNodeList.idl; sourceTree = "<group>"; };
+		1059459C15B42B0C004D37FD /* JSPropertyNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNodeList.cpp; sourceTree = "<group>"; };
+		1059459E15B42B1A004D37FD /* JSPropertyNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNodeList.h; sourceTree = "<group>"; };
 		10FB084A14E15C7E00A3DB98 /* PublicURLManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PublicURLManager.h; sourceTree = "<group>"; };
 		12F35EB4158745A40035CB63 /* WebKitNamedFlowCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitNamedFlowCollection.h; sourceTree = "<group>"; };
 		12F35EB5158745A40035CB63 /* WebKitNamedFlowCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitNamedFlowCollection.cpp; sourceTree = "<group>"; };
@@ -13146,6 +13164,7 @@
 		D630E2AB149BF344005B2F94 /* StatsCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StatsCounter.h; sourceTree = "<group>"; };
 		D630E2AB149BF344005B2F95 /* MemoryUsageSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryUsageSupport.h; sourceTree = "<group>"; };
 		D630E2AB149BF344005B2F96 /* EventTracer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTracer.h; sourceTree = "<group>"; };
+		D630E2AB149BF344005B2F97 /* HistogramSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutTestSupport.h; sourceTree = "<group>"; };
 		D6E276AD14637455001D280A /* MutationObserverRegistration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationObserverRegistration.cpp; sourceTree = "<group>"; };
 		D6E276AE14637455001D280A /* MutationObserverRegistration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutationObserverRegistration.h; sourceTree = "<group>"; };
 		D6E528A1149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationObserverInterestGroup.cpp; sourceTree = "<group>"; };
@@ -13154,6 +13173,7 @@
 		D6FDAEF2149C06190037B1E2 /* StatsCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StatsCounter.cpp; sourceTree = "<group>"; };
 		D6FDAEF2149C06190037B1E3 /* MemoryUsageSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryUsageSupport.cpp; sourceTree = "<group>"; };
 		D6FDAEF2149C06190037B1E4 /* EventTracer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTracer.cpp; sourceTree = "<group>"; };
+		D6FDAEF2149C06190037B1E5 /* LayoutTestSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LayoutTestSupport.cpp; sourceTree = "<group>"; };
 		D70AD65513E1342B005B50B4 /* RenderRegion.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderRegion.cpp; sourceTree = "<group>"; };
 		D70AD65613E1342B005B50B4 /* RenderRegion.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderRegion.h; sourceTree = "<group>"; };
 		D72F6D77153159A3001EE44E /* FlowThreadController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FlowThreadController.cpp; sourceTree = "<group>"; };
@@ -17475,6 +17495,7 @@
 				07A6D1EA1491137700051D0C /* MediaFragmentURIParser.h */,
 				9B2F7CF714562120007F8B50 /* MicroDataItemValue.cpp */,
 				9B2F7CF814562120007F8B50 /* MicroDataItemValue.h */,
+				1059457115B428C3004D37FD /* MicroDataItemValue.idl */,
 				F55B3D911251F12D003EF269 /* MonthInputType.cpp */,
 				F55B3D921251F12D003EF269 /* MonthInputType.h */,
 				F55B3D931251F12D003EF269 /* NumberInputType.cpp */,
@@ -18246,6 +18267,8 @@
 				CD27F6E3145767580078207D /* JSMediaController.h */,
 				E44614100CD6826900FADA75 /* JSMediaError.cpp */,
 				E44614110CD6826900FADA75 /* JSMediaError.h */,
+				1059457515B42A0D004D37FD /* JSMicroDataItemValue.cpp */,
+				1059457915B42A43004D37FD /* JSMicroDataItemValue.h */,
 				9001787E12E0370700648462 /* JSOESStandardDerivatives.cpp */,
 				9001787F12E0370700648462 /* JSOESStandardDerivatives.h */,
 				6EBF0E7412A9868800DB1709 /* JSOESTextureFloat.cpp */,
@@ -18760,6 +18783,8 @@
 				65DF31EC09D1CC60000BE325 /* JSProcessingInstruction.h */,
 				E4B423850CBFB73C00AF2ECE /* JSProgressEvent.cpp */,
 				E4B423860CBFB73C00AF2ECE /* JSProgressEvent.h */,
+				1059459C15B42B0C004D37FD /* JSPropertyNodeList.cpp */,
+				1059459E15B42B1A004D37FD /* JSPropertyNodeList.h */,
 				4998AECB13F9D6C90090B1AA /* JSRequestAnimationFrameCallback.cpp */,
 				4998AECC13F9D6C90090B1AA /* JSRequestAnimationFrameCallback.h */,
 				4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */,
@@ -20165,6 +20190,7 @@
 				410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */,
 				E1ADED460E76B8DD004A1A5E /* JSMessagePortCustom.cpp */,
 				41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */,
+				1059457215B42953004D37FD /* JSMicroDataItemValueCustom.cpp */,
 				C6F09184143A6C3B00685849 /* JSMutationCallbackCustom.cpp */,
 				C6F0917E143A2BB900685849 /* JSMutationObserverCustom.cpp */,
 				BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */,
@@ -20571,6 +20597,8 @@
 				26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */,
 				E18772F0126E2629003DD586 /* Language.cpp */,
 				85EC9AF90A71A2C600EEEAED /* Language.h */,
+				D6FDAEF2149C06190037B1E5 /* LayoutTestSupport.cpp */,
+				D630E2AB149BF344005B2F97 /* LayoutTestSupport.h */,
 				BCE65BE80EACDF16007E4533 /* Length.cpp */,
 				BCE65BE90EACDF16007E4533 /* Length.h */,
 				146CC113156988BD00109E37 /* LengthBox.cpp */,
@@ -21570,6 +21598,9 @@
 				E4B41E010CBF8EAA00AF2ECE /* ProgressEvent.cpp */,
 				E4B41E020CBF8EAA00AF2ECE /* ProgressEvent.h */,
 				E4B41E030CBF8EAA00AF2ECE /* ProgressEvent.idl */,
+				1059459615B42A8E004D37FD /* PropertyNodeList.cpp */,
+				1059459815B42AA0004D37FD /* PropertyNodeList.h */,
+				1059459A15B42AC0004D37FD /* PropertyNodeList.idl */,
 				550A0BC7085F6039007353D6 /* QualifiedName.cpp */,
 				550A0BC8085F6039007353D6 /* QualifiedName.h */,
 				F523D30302DE4476018635CA /* Range.cpp */,
@@ -24070,6 +24101,7 @@
 				2917B5631473496C0052C9D0 /* LayerFlushSchedulerClient.h in Headers */,
 				A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */,
 				2D9066070BE141D400956998 /* LayoutState.h in Headers */,
+				D630E2AC149BF344005B2F97 /* LayoutTestSupport.h in Headers */,
 				BACF290113B2A0D500781F90 /* LayoutTypes.h in Headers */,
 				512DD8F50D91E6AF000F89EE /* LegacyWebArchive.h in Headers */,
 				BCE65BEB0EACDF16007E4533 /* Length.h in Headers */,
@@ -25237,6 +25269,9 @@
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
 				C3CF17A515B0063F00276D39 /* IdTargetObserver.h in Headers */,
 				C3CF17A715B0063F00276D39 /* IdTargetObserverRegistry.h in Headers */,
+				1059457A15B42A43004D37FD /* JSMicroDataItemValue.h in Headers */,
+				1059459915B42AA0004D37FD /* PropertyNodeList.h in Headers */,
+				1059459F15B42B1A004D37FD /* JSPropertyNodeList.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -27352,6 +27387,7 @@
 				2917B566147349950052C9D0 /* LayerFlushSchedulerMac.cpp in Sources */,
 				A120ACA413F998CA00FE4AC7 /* LayoutRepainter.cpp in Sources */,
 				2D9066060BE141D400956998 /* LayoutState.cpp in Sources */,
+				D6FDAEF3149C06190037B1E5 /* LayoutTestSupport.cpp in Sources */,
 				512DD8F40D91E6AF000F89EE /* LegacyWebArchive.cpp in Sources */,
 				51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */,
 				BCE65BEA0EACDF16007E4533 /* Length.cpp in Sources */,
@@ -28296,6 +28332,10 @@
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
 				C3CF17A415B0063F00276D39 /* IdTargetObserver.cpp in Sources */,
 				C3CF17A615B0063F00276D39 /* IdTargetObserverRegistry.cpp in Sources */,
+				1059457315B42953004D37FD /* JSMicroDataItemValueCustom.cpp in Sources */,
+				1059457715B42A0D004D37FD /* JSMicroDataItemValue.cpp in Sources */,
+				1059459715B42A8E004D37FD /* PropertyNodeList.cpp in Sources */,
+				1059459D15B42B0C004D37FD /* JSPropertyNodeList.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index 04d3687cf..dad4c840f 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -188,6 +188,23 @@ AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
     return m_objects.get(axID).get();    
 }
 
+AccessibilityObject* AXObjectCache::get(Node* node)
+{
+    if (!node)
+        return 0;
+
+    // Always prefer building the AccessibilityObject from the renderer if there is one.
+    if (node->renderer())
+        return get(node->renderer());
+
+    AXID axID = m_nodeObjectMapping.get(node);
+    ASSERT(!HashTraits<AXID>::isDeletedValue(axID));
+    if (!axID)
+        return 0;
+
+    return m_objects.get(axID).get();
+}
+
 // FIXME: This probably belongs on Node.
 // FIXME: This should take a const char*, but one caller passes nullAtom.
 bool nodeHasRole(Node* node, const String& role)
@@ -252,6 +269,11 @@ static PassRefPtr<AccessibilityObject> createFromRenderer(RenderObject* renderer
     return AccessibilityRenderObject::create(renderer);
 }
 
+static PassRefPtr<AccessibilityObject> createFromNode(Node* node)
+{
+    return AccessibilityNodeObject::create(node);
+}
+
 AccessibilityObject* AXObjectCache::getOrCreate(Widget* widget)
 {
     if (!widget)
@@ -273,7 +295,32 @@ AccessibilityObject* AXObjectCache::getOrCreate(Widget* widget)
     attachWrapper(newObj.get());
     return newObj.get();
 }
-    
+
+AccessibilityObject* AXObjectCache::getOrCreate(Node* node)
+{
+    if (!node)
+        return 0;
+
+    if (AccessibilityObject* obj = get(node))
+        return obj;
+
+    if (node->renderer())
+        return getOrCreate(node->renderer());
+
+    // It's only allowed to create an AccessibilityObject from a Node if it's in a canvas subtree.
+    if (!node->parentElement() || !node->parentElement()->isInCanvasSubtree())
+        return 0;
+
+    RefPtr<AccessibilityObject> newObj = createFromNode(node);
+
+    getAXID(newObj.get());
+
+    m_nodeObjectMapping.set(node, newObj->axObjectID());
+    m_objects.set(newObj->axObjectID(), newObj);
+    attachWrapper(newObj.get());
+    return newObj.get();
+}
+
 AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
 {
     if (!renderer)
@@ -388,6 +435,24 @@ void AXObjectCache::remove(RenderObject* renderer)
     m_renderObjectMapping.remove(renderer);
 }
 
+void AXObjectCache::remove(Node* node)
+{
+    if (!node)
+        return;
+
+    removeNodeForUse(node);
+
+    // This is all safe even if we didn't have a mapping.
+    AXID axID = m_nodeObjectMapping.get(node);
+    remove(axID);
+    m_nodeObjectMapping.remove(node);
+
+    if (node->renderer()) {
+        remove(node->renderer());
+        return;
+    }
+}
+
 void AXObjectCache::remove(Widget* view)
 {
     if (!view)
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index bc458e1c2..b768b7dd8 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -70,6 +70,7 @@ public:
     // For AX objects with elements that back them.
     AccessibilityObject* getOrCreate(RenderObject*);
     AccessibilityObject* getOrCreate(Widget*);
+    AccessibilityObject* getOrCreate(Node*);
 
     // used for objects without backing elements
     AccessibilityObject* getOrCreate(AccessibilityRole);
@@ -77,8 +78,10 @@ public:
     // will only return the AccessibilityObject if it already exists
     AccessibilityObject* get(RenderObject*);
     AccessibilityObject* get(Widget*);
+    AccessibilityObject* get(Node*);
     
     void remove(RenderObject*);
+    void remove(Node*);
     void remove(Widget*);
     void remove(AXID);
 
@@ -182,6 +185,7 @@ private:
     HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
     HashMap<RenderObject*, AXID> m_renderObjectMapping;
     HashMap<Widget*, AXID> m_widgetObjectMapping;
+    HashMap<Node*, AXID> m_nodeObjectMapping;
     HashSet<Node*> m_textMarkerNodes;
     static bool gAccessibilityEnabled;
     static bool gAccessibilityEnhancedUserInterfaceEnabled;
@@ -204,9 +208,11 @@ inline AXObjectCache::AXObjectCache(const Document* doc) : m_document(const_cast
 inline AXObjectCache::~AXObjectCache() { }
 inline AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page*) { return 0; }
 inline AccessibilityObject* AXObjectCache::get(RenderObject*) { return 0; }
+inline AccessibilityObject* AXObjectCache::get(Node*) { return 0; }
 inline AccessibilityObject* AXObjectCache::get(Widget*) { return 0; }
 inline AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole) { return 0; }
 inline AccessibilityObject* AXObjectCache::getOrCreate(RenderObject*) { return 0; }
+inline AccessibilityObject* AXObjectCache::getOrCreate(Node*) { return 0; }
 inline AccessibilityObject* AXObjectCache::getOrCreate(Widget*) { return 0; }
 inline AccessibilityObject* AXObjectCache::rootObject() { return 0; }
 inline AccessibilityObject* AXObjectCache::rootObjectForFrame(Frame*) { return 0; }
@@ -233,6 +239,7 @@ inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool
 inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
 inline void AXObjectCache::remove(AXID) { }
 inline void AXObjectCache::remove(RenderObject*) { }
+inline void AXObjectCache::remove(Node*) { }
 inline void AXObjectCache::remove(Widget*) { }
 inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
 #endif
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
index cc12c3e39..5e2106bae 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -43,6 +43,15 @@ namespace WebCore {
 AccessibilityARIAGrid::AccessibilityARIAGrid(RenderObject* renderer)
     : AccessibilityTable(renderer)
 {
+}
+
+AccessibilityARIAGrid::~AccessibilityARIAGrid()
+{
+}
+
+void AccessibilityARIAGrid::init()
+{
+    AccessibilityTable::init();
 #if ACCESSIBILITY_TABLES
     m_isAccessibilityTable = true;
 #else
@@ -50,13 +59,11 @@ AccessibilityARIAGrid::AccessibilityARIAGrid(RenderObject* renderer)
 #endif
 }
 
-AccessibilityARIAGrid::~AccessibilityARIAGrid()
-{
-}
-
 PassRefPtr<AccessibilityARIAGrid> AccessibilityARIAGrid::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityARIAGrid(renderer));
+    AccessibilityARIAGrid* obj = new AccessibilityARIAGrid(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityARIAGrid::addChild(AccessibilityObject* child, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount)
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGrid.h b/Source/WebCore/accessibility/AccessibilityARIAGrid.h
index 89b917240..063e18ba1 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/Source/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -44,6 +44,8 @@ private:
 public:
     static PassRefPtr<AccessibilityARIAGrid> create(RenderObject*);
     virtual ~AccessibilityARIAGrid();
+
+    virtual void init();
     
     virtual bool isAriaTable() const { return true; }    
     
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp b/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
index 55d09ad47..9d16584e1 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
@@ -48,7 +48,9 @@ AccessibilityARIAGridCell::~AccessibilityARIAGridCell()
 
 PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityARIAGridCell(renderer));
+    AccessibilityARIAGridCell* obj = new AccessibilityARIAGridCell(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp
index 2b9603649..d32ba8af9 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -48,7 +48,9 @@ AccessibilityARIAGridRow::~AccessibilityARIAGridRow()
 
 PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityARIAGridRow(renderer));
+    AccessibilityARIAGridRow* obj = new AccessibilityARIAGridRow(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityARIAGridRow::isARIATreeGridRow() const
diff --git a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
index b329ad016..e353556f7 100644
--- a/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
+++ b/Source/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -34,6 +34,7 @@
 #include "AccessibilityListBox.cpp"
 #include "AccessibilityListBoxOption.cpp"
 #include "AccessibilityMediaControls.cpp"
+#include "AccessibilityNodeObject.cpp"
 #include "AccessibilityObject.cpp"
 #include "AccessibilityRenderObject.cpp"
 #include "AccessibilityScrollView.cpp"
diff --git a/Source/WebCore/accessibility/AccessibilityList.cpp b/Source/WebCore/accessibility/AccessibilityList.cpp
index 073b0fc36..680731415 100644
--- a/Source/WebCore/accessibility/AccessibilityList.cpp
+++ b/Source/WebCore/accessibility/AccessibilityList.cpp
@@ -50,7 +50,9 @@ AccessibilityList::~AccessibilityList()
 
 PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityList(renderer));
+    AccessibilityList* obj = new AccessibilityList(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityList::accessibilityIsIgnored() const
diff --git a/Source/WebCore/accessibility/AccessibilityListBox.cpp b/Source/WebCore/accessibility/AccessibilityListBox.cpp
index 22e5b8185..60f854642 100644
--- a/Source/WebCore/accessibility/AccessibilityListBox.cpp
+++ b/Source/WebCore/accessibility/AccessibilityListBox.cpp
@@ -54,7 +54,9 @@ AccessibilityListBox::~AccessibilityListBox()
     
 PassRefPtr<AccessibilityListBox> AccessibilityListBox::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityListBox(renderer));
+    AccessibilityListBox* obj = new AccessibilityListBox(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
     
 bool AccessibilityListBox::canSetSelectedChildrenAttribute() const
diff --git a/Source/WebCore/accessibility/AccessibilityMediaControls.cpp b/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
index 563669132..977830138 100644
--- a/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -67,8 +67,11 @@ PassRefPtr<AccessibilityObject> AccessibilityMediaControl::create(RenderObject*
     case MediaControlsPanel:
         return AccessibilityMediaControlsContainer::create(renderer);
 
-    default:
-        return adoptRef(new AccessibilityMediaControl(renderer));
+    default: {
+        AccessibilityMediaControl* obj = new AccessibilityMediaControl(renderer);
+        obj->init();
+        return adoptRef(obj);
+        }
     }
 }
 
@@ -207,7 +210,9 @@ AccessibilityMediaControlsContainer::AccessibilityMediaControlsContainer(RenderO
 
 PassRefPtr<AccessibilityObject> AccessibilityMediaControlsContainer::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityMediaControlsContainer(renderer));
+    AccessibilityMediaControlsContainer* obj = new AccessibilityMediaControlsContainer(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 String AccessibilityMediaControlsContainer::accessibilityDescription() const
@@ -251,7 +256,9 @@ AccessibilityMediaTimeline::AccessibilityMediaTimeline(RenderObject* renderer)
 
 PassRefPtr<AccessibilityObject> AccessibilityMediaTimeline::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityMediaTimeline(renderer));
+    AccessibilityMediaTimeline* obj = new AccessibilityMediaTimeline(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 String AccessibilityMediaTimeline::valueDescription() const
@@ -281,7 +288,9 @@ AccessibilityMediaTimeDisplay::AccessibilityMediaTimeDisplay(RenderObject* rende
 
 PassRefPtr<AccessibilityObject> AccessibilityMediaTimeDisplay::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityMediaTimeDisplay(renderer));
+    AccessibilityMediaTimeDisplay* obj = new AccessibilityMediaTimeDisplay(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityMediaTimeDisplay::accessibilityIsIgnored() const
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.cpp b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
index baec7d00c..eebd784c4 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.cpp
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -37,6 +37,13 @@ AccessibilityMenuList::AccessibilityMenuList(RenderMenuList* renderer)
 {
 }
 
+PassRefPtr<AccessibilityMenuList> AccessibilityMenuList::create(RenderMenuList* renderer)
+{
+    AccessibilityMenuList* obj = new AccessibilityMenuList(renderer);
+    obj->init();
+    return adoptRef(obj);
+}
+
 bool AccessibilityMenuList::press() const
 {
     RenderMenuList* menuList = static_cast<RenderMenuList*>(m_renderer);
diff --git a/Source/WebCore/accessibility/AccessibilityMenuList.h b/Source/WebCore/accessibility/AccessibilityMenuList.h
index 089cdc378..281d73629 100644
--- a/Source/WebCore/accessibility/AccessibilityMenuList.h
+++ b/Source/WebCore/accessibility/AccessibilityMenuList.h
@@ -37,7 +37,7 @@ class RenderMenuList;
 
 class AccessibilityMenuList : public AccessibilityRenderObject {
 public:
-    static PassRefPtr<AccessibilityMenuList> create(RenderMenuList* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
+    static PassRefPtr<AccessibilityMenuList> create(RenderMenuList* renderer);
 
     virtual bool isCollapsed() const;
     virtual bool press() const;
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
new file mode 100644
index 000000000..d38af5045
--- /dev/null
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
@@ -0,0 +1,387 @@
+/*
+* Copyright (C) 2012, Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1.  Redistributions of source code must retain the above copyright
+*     notice, this list of conditions and the following disclaimer.
+* 2.  Redistributions in binary form must reproduce the above copyright
+*     notice, this list of conditions and the following disclaimer in the
+*     documentation and/or other materials provided with the distribution.
+* 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+*     its contributors may be used to endorse or promote products derived
+*     from this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "AccessibilityNodeObject.h"
+
+#include "AXObjectCache.h"
+#include "AccessibilityImageMapLink.h"
+#include "AccessibilityListBox.h"
+#include "AccessibilitySpinButton.h"
+#include "AccessibilityTable.h"
+#include "EventNames.h"
+#include "FloatRect.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameSelection.h"
+#include "FrameView.h"
+#include "HTMLAreaElement.h"
+#include "HTMLFieldSetElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLFrameElementBase.h"
+#include "HTMLImageElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLLabelElement.h"
+#include "HTMLLegendElement.h"
+#include "HTMLMapElement.h"
+#include "HTMLNames.h"
+#include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
+#include "HTMLOptionsCollection.h"
+#include "HTMLPlugInImageElement.h"
+#include "HTMLSelectElement.h"
+#include "HTMLTextAreaElement.h"
+#include "HTMLTextFormControlElement.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
+#include "LocalizedStrings.h"
+#include "MathMLNames.h"
+#include "NodeList.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "Text.h"
+#include "TextControlInnerElements.h"
+#include "TextIterator.h"
+#include "Widget.h"
+#include "htmlediting.h"
+#include "visible_units.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/unicode/CharacterNames.h>
+
+using namespace std;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+AccessibilityNodeObject::AccessibilityNodeObject(Node* node)
+    : AccessibilityObject()
+    , m_ariaRole(UnknownRole)
+    , m_childrenDirty(false)
+    , m_roleForMSAA(UnknownRole)
+    , m_node(node)
+{
+}
+
+AccessibilityNodeObject::~AccessibilityNodeObject()
+{
+    ASSERT(isDetached());
+}
+
+void AccessibilityNodeObject::init()
+{
+    m_role = determineAccessibilityRole();
+}
+
+PassRefPtr<AccessibilityNodeObject> AccessibilityNodeObject::create(Node* node)
+{
+    AccessibilityNodeObject* obj = new AccessibilityNodeObject(node);
+    obj->init();
+    return adoptRef(obj);
+}
+
+void AccessibilityNodeObject::detach()
+{
+    clearChildren();
+    AccessibilityObject::detach();
+    m_node = 0;
+}
+
+void AccessibilityNodeObject::childrenChanged()
+{
+    // This method is meant as a quick way of marking a portion of the accessibility tree dirty.
+    if (!node() && !renderer())
+        return;
+
+    axObjectCache()->postNotification(this, document(), AXObjectCache::AXChildrenChanged, true);
+
+    // Go up the accessibility parent chain, but only if the element already exists. This method is
+    // called during render layouts, minimal work should be done. 
+    // If AX elements are created now, they could interrogate the render tree while it's in a funky state.
+    // At the same time, process ARIA live region changes.
+    for (AccessibilityObject* parent = this; parent; parent = parent->parentObjectIfExists()) {
+        parent->setNeedsToUpdateChildren();
+
+        // These notifications always need to be sent because screenreaders are reliant on them to perform. 
+        // In other words, they need to be sent even when the screen reader has not accessed this live region since the last update.
+
+        // If this element supports ARIA live regions, then notify the AT of changes.
+        if (parent->supportsARIALiveRegion())
+            axObjectCache()->postNotification(parent, parent->document(), AXObjectCache::AXLiveRegionChanged, true);
+        
+        // If this element is an ARIA text control, notify the AT of changes.
+        if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->rendererIsEditable())
+            axObjectCache()->postNotification(parent, parent->document(), AXObjectCache::AXValueChanged, true);
+    }
+}
+
+void AccessibilityNodeObject::updateAccessibilityRole()
+{
+    bool ignoredStatus = accessibilityIsIgnored();
+    m_role = determineAccessibilityRole();
+    
+    // The AX hierarchy only needs to be updated if the ignored status of an element has changed.
+    if (ignoredStatus != accessibilityIsIgnored())
+        childrenChanged();
+}
+    
+AccessibilityObject* AccessibilityNodeObject::firstChild() const
+{
+    if (!node())
+        return 0;
+    
+    Node* firstChild = node()->firstChild();
+
+    if (!firstChild)
+        return 0;
+    
+    return axObjectCache()->getOrCreate(firstChild);
+}
+
+AccessibilityObject* AccessibilityNodeObject::lastChild() const
+{
+    if (!node())
+        return 0;
+    
+    Node* lastChild = node()->lastChild();
+    if (!lastChild)
+        return 0;
+    
+    return axObjectCache()->getOrCreate(lastChild);
+}
+
+AccessibilityObject* AccessibilityNodeObject::previousSibling() const
+{
+    if (!node())
+        return 0;
+
+    Node* previousSibling = node()->previousSibling();
+    if (!previousSibling)
+        return 0;
+
+    return axObjectCache()->getOrCreate(previousSibling);
+}
+
+AccessibilityObject* AccessibilityNodeObject::nextSibling() const
+{
+    if (!node())
+        return 0;
+
+    Node* nextSibling = node()->nextSibling();
+    if (!nextSibling)
+        return 0;
+
+    return axObjectCache()->getOrCreate(nextSibling);
+}
+    
+AccessibilityObject* AccessibilityNodeObject::parentObjectIfExists() const
+{
+    return parentObject();
+}
+    
+AccessibilityObject* AccessibilityNodeObject::parentObject() const
+{
+    if (!node())
+        return 0;
+
+    Node* parentObj = node()->parentNode();
+    if (parentObj)
+        return axObjectCache()->getOrCreate(parentObj);
+    
+    return 0;
+}
+
+LayoutRect AccessibilityNodeObject::elementRect() const
+{
+    return boundingBoxRect();
+}
+
+void AccessibilityNodeObject::setNode(Node* node)
+{
+    m_node = node;
+}
+
+Document* AccessibilityNodeObject::document() const
+{
+    if (!node())
+        return 0;
+    return node()->document();
+}
+
+AccessibilityRole AccessibilityNodeObject::determineAccessibilityRole()
+{
+    if (!node())
+        return UnknownRole;
+
+    m_ariaRole = determineAriaRoleAttribute();
+    
+    AccessibilityRole ariaRole = ariaRoleAttribute();
+    if (ariaRole != UnknownRole)
+        return ariaRole;
+
+    if (node()->isLink())
+        return WebCoreLinkRole;
+    if (node()->isTextNode())
+        return StaticTextRole;
+    if (node()->hasTagName(buttonTag))
+        return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+    if (node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
+        if (input->isCheckbox())
+            return CheckBoxRole;
+        if (input->isRadioButton())
+            return RadioButtonRole;
+        if (input->isTextButton())
+            return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+        return TextFieldRole;
+    }
+    if (node()->hasTagName(selectTag)) {
+        HTMLSelectElement* selectElement = toHTMLSelectElement(node());
+        return selectElement->multiple() ? ListRole : PopUpButtonRole;
+    }
+    if (node()->isFocusable())
+        return GroupRole;
+    
+    return UnknownRole;
+}
+
+void AccessibilityNodeObject::addChildren()
+{
+    // If the need to add more children in addition to existing children arises, 
+    // childrenChanged should have been called, leaving the object with no children.
+    ASSERT(!m_haveChildren); 
+    
+    if (!m_node)
+        return;
+
+    m_haveChildren = true;
+
+    // The only time we add children from the DOM tree to a node with a renderer is when it's a canvas.
+    if (renderer() && !m_node->hasTagName(canvasTag))
+        return;
+    
+    for (Node* child = m_node->firstChild(); child; child = child->nextSibling()) {
+        RefPtr<AccessibilityObject> obj = axObjectCache()->getOrCreate(child);
+        obj->clearChildren();
+        if (obj->accessibilityIsIgnored()) {
+            AccessibilityChildrenVector children = obj->children();
+            size_t length = children.size();
+            for (size_t i = 0; i < length; ++i)
+                m_children.append(children[i]);
+        } else {
+            ASSERT(obj->parentObject() == this);
+            m_children.append(obj);
+        }
+    }
+}
+
+bool AccessibilityNodeObject::accessibilityIsIgnored() const
+{
+    return m_role == UnknownRole;
+}
+
+bool AccessibilityNodeObject::canSetFocusAttribute() const
+{
+    Node* node = this->node();
+
+    if (isWebArea())
+        return true;
+    
+    // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
+    // do anything. For example, setFocusedNode() will do nothing if the current focused
+    // node will not relinquish the focus.
+    if (!node)
+        return false;
+
+    if (node->isElementNode() && !static_cast<Element*>(node)->isEnabledFormControl())
+        return false;
+
+    return node->supportsFocus();
+}
+
+AccessibilityRole AccessibilityNodeObject::determineAriaRoleAttribute() const
+{
+    const AtomicString& ariaRole = getAttribute(roleAttr);
+    if (ariaRole.isNull() || ariaRole.isEmpty())
+        return UnknownRole;
+    
+    AccessibilityRole role = ariaRoleToWebCoreRole(ariaRole);
+
+    // ARIA states if an item can get focus, it should not be presentational.
+    if (role == PresentationalRole && canSetFocusAttribute())
+        return UnknownRole;
+    
+    if (role == ButtonRole && ariaHasPopup())
+        role = PopUpButtonRole;
+
+    if (role == TextAreaRole && !ariaIsMultiline())
+        role = TextFieldRole;
+
+    role = remapAriaRoleDueToParent(role);
+    
+    if (role)
+        return role;
+
+    return UnknownRole;
+}
+
+AccessibilityRole AccessibilityNodeObject::ariaRoleAttribute() const
+{
+    return m_ariaRole;
+}
+
+AccessibilityRole AccessibilityNodeObject::remapAriaRoleDueToParent(AccessibilityRole role) const
+{
+    // Some objects change their role based on their parent.
+    // However, asking for the unignoredParent calls accessibilityIsIgnored(), which can trigger a loop. 
+    // While inside the call stack of creating an element, we need to avoid accessibilityIsIgnored().
+    // https://bugs.webkit.org/show_bug.cgi?id=65174
+
+    if (role != ListBoxOptionRole && role != MenuItemRole)
+        return role;
+    
+    for (AccessibilityObject* parent = parentObject(); parent && !parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
+        AccessibilityRole parentAriaRole = parent->ariaRoleAttribute();
+
+        // Selects and listboxes both have options as child roles, but they map to different roles within WebCore.
+        if (role == ListBoxOptionRole && parentAriaRole == MenuRole)
+            return MenuItemRole;
+        // An aria "menuitem" may map to MenuButton or MenuItem depending on its parent.
+        if (role == MenuItemRole && parentAriaRole == GroupRole)
+            return MenuButtonRole;
+        
+        // If the parent had a different role, then we don't need to continue searching up the chain.
+        if (parentAriaRole)
+            break;
+    }
+    
+    return role;
+}   
+
+} // namespace WebCore
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.h b/Source/WebCore/accessibility/AccessibilityNodeObject.h
new file mode 100644
index 000000000..9082f8bbc
--- /dev/null
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityNodeObject_h
+#define AccessibilityNodeObject_h
+
+#include "AccessibilityObject.h"
+#include "LayoutTypes.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+    
+class AXObjectCache;
+class Element;
+class Frame;
+class FrameView;
+class HitTestResult;
+class HTMLAnchorElement;
+class HTMLAreaElement;
+class HTMLElement;
+class HTMLLabelElement;
+class HTMLMapElement;
+class HTMLSelectElement;
+class IntPoint;
+class IntSize;
+class Node;
+class RenderListBox;
+class RenderTextControl;
+class RenderView;
+class VisibleSelection;
+class Widget;
+    
+class AccessibilityNodeObject : public AccessibilityObject {
+protected:
+    AccessibilityNodeObject(Node*);
+public:
+    static PassRefPtr<AccessibilityNodeObject> create(Node*);
+    virtual ~AccessibilityNodeObject();
+
+    virtual void init();
+    
+    virtual bool isAccessibilityNodeObject() const { return true; }
+
+    virtual bool canSetFocusAttribute() const;
+    
+    virtual AccessibilityObject* firstChild() const;
+    virtual AccessibilityObject* lastChild() const;
+    virtual AccessibilityObject* previousSibling() const;
+    virtual AccessibilityObject* nextSibling() const;
+    virtual AccessibilityObject* parentObject() const;
+    virtual AccessibilityObject* parentObjectIfExists() const;
+
+    void setNode(Node*);
+    virtual Node* node() const { return m_node; }
+    virtual Document* document() const;
+
+    virtual void detach();
+    virtual void childrenChanged();
+    void updateAccessibilityRole();
+
+    virtual LayoutRect elementRect() const;
+
+protected:
+    AccessibilityRole m_ariaRole;
+    bool m_childrenDirty;
+    mutable AccessibilityRole m_roleForMSAA;
+
+    virtual bool isDetached() const { return !m_node; }
+
+    virtual AccessibilityRole determineAccessibilityRole();
+    virtual void addChildren();
+    virtual bool accessibilityIsIgnored() const;
+    AccessibilityRole ariaRoleAttribute() const;
+    AccessibilityRole determineAriaRoleAttribute() const;
+    AccessibilityRole remapAriaRoleDueToParent(AccessibilityRole) const;
+
+private:
+    Node* m_node;
+};
+
+inline AccessibilityNodeObject* toAccessibilityNodeObject(AccessibilityObject* object)
+{
+    ASSERT(!object || object->isAccessibilityNodeObject());
+    return static_cast<AccessibilityNodeObject*>(object);
+}
+
+inline const AccessibilityNodeObject* toAccessibilityNodeObject(const AccessibilityObject* object)
+{
+    ASSERT(!object || object->isAccessibilityNodeObject());
+    return static_cast<const AccessibilityNodeObject*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toAccessibilityNodeObject(const AccessibilityNodeObject*);
+
+} // namespace WebCore
+
+#endif // AccessibilityNodeObject_h
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 649ddd70c..88b1f3909 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -317,6 +317,7 @@ public:
 
     typedef Vector<RefPtr<AccessibilityObject> > AccessibilityChildrenVector;
     
+    virtual bool isAccessibilityNodeObject() const { return false; }    
     virtual bool isAccessibilityRenderObject() const { return false; }
     virtual bool isAccessibilityScrollbar() const { return false; }
     virtual bool isAccessibilityScrollView() const { return false; }
diff --git a/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp b/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
index 494d1c20b..d3c76bd72 100644
--- a/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
+++ b/Source/WebCore/accessibility/AccessibilityProgressIndicator.cpp
@@ -39,7 +39,9 @@ AccessibilityProgressIndicator::AccessibilityProgressIndicator(RenderProgress* r
 
 PassRefPtr<AccessibilityProgressIndicator> AccessibilityProgressIndicator::create(RenderProgress* renderer)
 {
-    return adoptRef(new AccessibilityProgressIndicator(renderer));
+    AccessibilityProgressIndicator* obj = new AccessibilityProgressIndicator(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityProgressIndicator::accessibilityIsIgnored() const
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 31e64e7dc..1d68ae50c 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -93,14 +93,9 @@ namespace WebCore {
 using namespace HTMLNames;
 
 AccessibilityRenderObject::AccessibilityRenderObject(RenderObject* renderer)
-    : AccessibilityObject()
+    : AccessibilityNodeObject(renderer->node())
     , m_renderer(renderer)
-    , m_ariaRole(UnknownRole)
-    , m_childrenDirty(false)
-    , m_roleForMSAA(UnknownRole)
 {
-    m_role = determineAccessibilityRole();
-
 #ifndef NDEBUG
     m_renderer->setHasAXObject(true);
 #endif
@@ -111,21 +106,27 @@ AccessibilityRenderObject::~AccessibilityRenderObject()
     ASSERT(isDetached());
 }
 
+void AccessibilityRenderObject::init()
+{
+    AccessibilityNodeObject::init();
+}
+
 PassRefPtr<AccessibilityRenderObject> AccessibilityRenderObject::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityRenderObject(renderer));
+    AccessibilityRenderObject* obj = new AccessibilityRenderObject(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 void AccessibilityRenderObject::detach()
 {
-    clearChildren();
-    AccessibilityObject::detach();
+    AccessibilityNodeObject::detach();
     
 #ifndef NDEBUG
     if (m_renderer)
         m_renderer->setHasAXObject(false);
 #endif
-    m_renderer = 0;    
+    m_renderer = 0;
 }
 
 RenderBoxModelObject* AccessibilityRenderObject::renderBoxModelObject() const
@@ -135,6 +136,12 @@ RenderBoxModelObject* AccessibilityRenderObject::renderBoxModelObject() const
     return toRenderBoxModelObject(m_renderer);
 }
 
+void AccessibilityRenderObject::setRenderer(RenderObject* renderer)
+{
+    m_renderer = renderer;
+    setNode(renderer->node());
+}
+
 static inline bool isInlineWithContinuation(RenderObject* object)
 {
     if (!object->isBoxModelObject())
@@ -3084,75 +3091,6 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     return 0;
 }
 
-AccessibilityRole AccessibilityRenderObject::remapAriaRoleDueToParent(AccessibilityRole role) const
-{
-    // Some objects change their role based on their parent.
-    // However, asking for the unignoredParent calls accessibilityIsIgnored(), which can trigger a loop. 
-    // While inside the call stack of creating an element, we need to avoid accessibilityIsIgnored().
-    // https://bugs.webkit.org/show_bug.cgi?id=65174
-
-    if (role != ListBoxOptionRole && role != MenuItemRole)
-        return role;
-    
-    for (AccessibilityObject* parent = parentObject(); parent && !parent->accessibilityIsIgnored(); parent = parent->parentObject()) {
-        AccessibilityRole parentAriaRole = parent->ariaRoleAttribute();
-
-        // Selects and listboxes both have options as child roles, but they map to different roles within WebCore.
-        if (role == ListBoxOptionRole && parentAriaRole == MenuRole)
-            return MenuItemRole;
-        // An aria "menuitem" may map to MenuButton or MenuItem depending on its parent.
-        if (role == MenuItemRole && parentAriaRole == GroupRole)
-            return MenuButtonRole;
-        
-        // If the parent had a different role, then we don't need to continue searching up the chain.
-        if (parentAriaRole)
-            break;
-    }
-    
-    return role;
-}
-    
-AccessibilityRole AccessibilityRenderObject::determineAriaRoleAttribute() const
-{
-    const AtomicString& ariaRole = getAttribute(roleAttr);
-    if (ariaRole.isNull() || ariaRole.isEmpty())
-        return UnknownRole;
-    
-    AccessibilityRole role = ariaRoleToWebCoreRole(ariaRole);
-
-    // ARIA states if an item can get focus, it should not be presentational.
-    if (role == PresentationalRole && canSetFocusAttribute())
-        return UnknownRole;
-    
-    if (role == ButtonRole && ariaHasPopup())
-        role = PopUpButtonRole;
-
-    if (role == TextAreaRole && !ariaIsMultiline())
-        role = TextFieldRole;
-
-    role = remapAriaRoleDueToParent(role);
-    
-    if (role)
-        return role;
-
-    return UnknownRole;
-}
-
-AccessibilityRole AccessibilityRenderObject::ariaRoleAttribute() const
-{
-    return m_ariaRole;
-}
-    
-void AccessibilityRenderObject::updateAccessibilityRole()
-{
-    bool ignoredStatus = accessibilityIsIgnored();
-    m_role = determineAccessibilityRole();
-    
-    // The AX hierarchy only needs to be updated if the ignored status of an element has changed.
-    if (ignoredStatus != accessibilityIsIgnored())
-        childrenChanged();
-}
-    
 bool AccessibilityRenderObject::isDescendantOfElementType(const QualifiedName& tagName) const
 {
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
@@ -3389,25 +3327,6 @@ bool AccessibilityRenderObject::ariaRoleHasPresentationalChildren() const
     }
 }
 
-bool AccessibilityRenderObject::canSetFocusAttribute() const
-{
-    Node* node = this->node();
-
-    if (isWebArea())
-        return true;
-    
-    // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
-    // do anything.  For example, setFocusedNode() will do nothing if the current focused
-    // node will not relinquish the focus.
-    if (!node)
-        return false;
-
-    if (node->isElementNode() && !static_cast<Element*>(node)->isEnabledFormControl())
-        return false;
-
-    return node->supportsFocus();
-}
-    
 bool AccessibilityRenderObject::canSetExpandedAttribute() const
 {
     // An object can be expanded if it aria-expanded is true or false.
@@ -3454,39 +3373,15 @@ void AccessibilityRenderObject::contentChanged()
     }
 }
     
-void AccessibilityRenderObject::childrenChanged()
-{
-    // This method is meant as a quick way of marking a portion of the accessibility tree dirty.
-    if (!m_renderer)
-        return;
-
-    axObjectCache()->postNotification(this, document(), AXObjectCache::AXChildrenChanged, true);
-
-    // Go up the accessibility parent chain, but only if the element already exists. This method is
-    // called during render layouts, minimal work should be done. 
-    // If AX elements are created now, they could interrogate the render tree while it's in a funky state.
-    // At the same time, process ARIA live region changes.
-    for (AccessibilityObject* parent = this; parent; parent = parent->parentObjectIfExists()) {
-        parent->setNeedsToUpdateChildren();
-
-        // These notifications always need to be sent because screenreaders are reliant on them to perform. 
-        // In other words, they need to be sent even when the screen reader has not accessed this live region since the last update.
-
-        // If this element supports ARIA live regions, then notify the AT of changes.
-        if (parent->supportsARIALiveRegion())
-            axObjectCache()->postNotification(parent, parent->document(), AXObjectCache::AXLiveRegionChanged, true);
-        
-        // If this element is an ARIA text control, notify the AT of changes.
-        if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->rendererIsEditable())
-            axObjectCache()->postNotification(parent, parent->document(), AXObjectCache::AXValueChanged, true);
-    }
-}
-    
 bool AccessibilityRenderObject::canHaveChildren() const
 {
     if (!m_renderer)
         return false;
     
+    // Canvas is a special case; its role is ImageRole but it is allowed to have children.
+    if (node() && node()->hasTagName(canvasTag))
+        return true;
+
     // Elements that should not have children
     switch (roleValue()) {
     case ImageRole:
@@ -3559,6 +3454,18 @@ void AccessibilityRenderObject::addTextFieldChildren()
     m_children.append(axSpinButton);
 }
 
+void AccessibilityRenderObject::addCanvasChildren()
+{
+    if (!node() || !node()->hasTagName(canvasTag))
+        return;
+
+    // If it's a canvas, it won't have rendered children, but it might have accessible fallback content.
+    // Clear m_haveChildren because AccessibilityNodeObject::addChildren will expect it to be false.
+    ASSERT(!m_children.size());
+    m_haveChildren = false;
+    AccessibilityNodeObject::addChildren();
+}
+
 void AccessibilityRenderObject::addAttachmentChildren()
 {
     if (!isAttachment())
@@ -3595,11 +3502,7 @@ void AccessibilityRenderObject::addChildren()
     // If the need to add more children in addition to existing children arises, 
     // childrenChanged should have been called, leaving the object with no children.
     ASSERT(!m_haveChildren); 
-    
-    // nothing to add if there is no RenderObject
-    if (!m_renderer)
-        return;
-    
+
     m_haveChildren = true;
     
     if (!canHaveChildren())
@@ -3607,7 +3510,6 @@ void AccessibilityRenderObject::addChildren()
     
     // add all unignored acc children
     for (RefPtr<AccessibilityObject> obj = firstChild(); obj; obj = obj->nextSibling()) {
-        
         // If the parent is asking for this child's children, then either it's the first time (and clearing is a no-op), 
         // or its visibility has changed. In the latter case, this child may have a stale child cached. 
         // This can prevent aria-hidden changes from working correctly. Hence, whenever a parent is getting children, ensure data is not stale.
@@ -3627,6 +3529,7 @@ void AccessibilityRenderObject::addChildren()
     addAttachmentChildren();
     addImageMapChildren();
     addTextFieldChildren();
+    addCanvasChildren();
 
 #if PLATFORM(MAC)
     updateAttachmentViewParents();
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.h b/Source/WebCore/accessibility/AccessibilityRenderObject.h
index a43b71d55..264e70b37 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.h
@@ -29,7 +29,7 @@
 #ifndef AccessibilityRenderObject_h
 #define AccessibilityRenderObject_h
 
-#include "AccessibilityObject.h"
+#include "AccessibilityNodeObject.h"
 #include "LayoutTypes.h"
 #include <wtf/Forward.h>
 
@@ -55,7 +55,7 @@ class RenderView;
 class VisibleSelection;
 class Widget;
     
-class AccessibilityRenderObject : public AccessibilityObject {
+class AccessibilityRenderObject : public AccessibilityNodeObject {
 protected:
     AccessibilityRenderObject(RenderObject*);
 public:
@@ -63,6 +63,8 @@ public:
     virtual ~AccessibilityRenderObject();
     
     virtual bool isAccessibilityRenderObject() const { return true; }
+
+    virtual void init();
     
     virtual bool isAnchor() const;
     virtual bool isAttachment() const;
@@ -111,7 +113,6 @@ public:
     virtual bool hasSameStyle(RenderObject*) const;
     virtual bool hasUnderline() const;
 
-    virtual bool canSetFocusAttribute() const;
     virtual bool canSetTextRangeAttributes() const;
     virtual bool canSetValueAttribute() const;
     virtual bool canSetExpandedAttribute() const;
@@ -149,10 +150,8 @@ public:
 
     virtual void ariaOwnsElements(AccessibilityChildrenVector&) const;
     virtual bool supportsARIAOwns() const;
-    virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
-    void updateAccessibilityRole();
     
     // Should be called on the root accessibility object to kick off a hit test.
     virtual AccessibilityObject* accessibilityHitTest(const IntPoint&) const;
@@ -168,14 +167,15 @@ public:
     virtual LayoutRect elementRect() const;
     virtual IntPoint clickPoint();
     
-    void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
+    void setRenderer(RenderObject*);
     virtual RenderObject* renderer() const { return m_renderer; }
     RenderBoxModelObject* renderBoxModelObject() const;
     virtual Node* node() const;
 
+    virtual Document* document() const;
+
     RenderView* topRenderer() const;
     RenderTextControl* textControl() const;
-    Document* document() const;
     FrameView* topDocumentFrameView() const;  
     Document* topDocument() const;
     HTMLLabelElement* labelElementContainer() const;
@@ -214,7 +214,6 @@ public:
     virtual void decrement();
     
     virtual void detach();
-    virtual void childrenChanged();
     virtual void contentChanged();
     virtual void addChildren();
     virtual bool canHaveChildren() const;
@@ -260,8 +259,6 @@ public:
 
 protected:
     RenderObject* m_renderer;
-    AccessibilityRole m_ariaRole;
-    bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
     void ariaLabeledByElements(Vector<Element*>& elements) const;
@@ -271,6 +268,8 @@ protected:
     
     virtual bool isDetached() const { return !m_renderer; }
 
+    virtual AccessibilityRole determineAccessibilityRole();
+
 private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
@@ -286,9 +285,6 @@ private:
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const;
-    AccessibilityRole determineAccessibilityRole();
-    AccessibilityRole determineAriaRoleAttribute() const;
-    AccessibilityRole remapAriaRoleDueToParent(AccessibilityRole) const;
 
     bool isTabItemSelected() const;
     void alterSliderValue(bool increase);
@@ -305,6 +301,7 @@ private:
 
     void addTextFieldChildren();
     void addImageMapChildren();
+    void addCanvasChildren();
     void addAttachmentChildren();
 #if PLATFORM(MAC)
     void updateAttachmentViewParents();
@@ -328,8 +325,6 @@ private:
     virtual bool ariaLiveRegionBusy() const;    
     
     bool inheritsPresentationalRole() const;
-    
-    mutable AccessibilityRole m_roleForMSAA;
 };
 
 inline AccessibilityRenderObject* toAccessibilityRenderObject(AccessibilityObject* object)
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.cpp b/Source/WebCore/accessibility/AccessibilitySlider.cpp
index 56cef7ff9..7a0abd03d 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySlider.cpp
@@ -47,7 +47,9 @@ AccessibilitySlider::AccessibilitySlider(RenderObject* renderer)
 
 PassRefPtr<AccessibilitySlider> AccessibilitySlider::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilitySlider(renderer));
+    AccessibilitySlider* obj = new AccessibilitySlider(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 AccessibilityOrientation AccessibilitySlider::orientation() const
diff --git a/Source/WebCore/accessibility/AccessibilityTable.cpp b/Source/WebCore/accessibility/AccessibilityTable.cpp
index 4330055f9..b1d155d42 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTable.cpp
@@ -51,6 +51,15 @@ AccessibilityTable::AccessibilityTable(RenderObject* renderer)
     : AccessibilityRenderObject(renderer),
     m_headerContainer(0)
 {
+}
+
+AccessibilityTable::~AccessibilityTable()
+{
+}
+
+void AccessibilityTable::init()
+{
+    AccessibilityRenderObject::init();
 #if ACCESSIBILITY_TABLES
     m_isAccessibilityTable = isTableExposableThroughAccessibility();
 #else
@@ -58,13 +67,11 @@ AccessibilityTable::AccessibilityTable(RenderObject* renderer)
 #endif
 }
 
-AccessibilityTable::~AccessibilityTable()
-{
-}
-
 PassRefPtr<AccessibilityTable> AccessibilityTable::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityTable(renderer));
+    AccessibilityTable* obj = new AccessibilityTable(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityTable::hasARIARole() const
diff --git a/Source/WebCore/accessibility/AccessibilityTable.h b/Source/WebCore/accessibility/AccessibilityTable.h
index 7fd7cc611..2ee1bc094 100644
--- a/Source/WebCore/accessibility/AccessibilityTable.h
+++ b/Source/WebCore/accessibility/AccessibilityTable.h
@@ -50,6 +50,8 @@ public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
     virtual ~AccessibilityTable();
 
+    virtual void init();
+
     virtual bool isAccessibilityTable() const;
     virtual bool isDataTable() const;
 
diff --git a/Source/WebCore/accessibility/AccessibilityTableCell.cpp b/Source/WebCore/accessibility/AccessibilityTableCell.cpp
index 7ec87b2d8..f2b1c958b 100644
--- a/Source/WebCore/accessibility/AccessibilityTableCell.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -51,7 +51,9 @@ AccessibilityTableCell::~AccessibilityTableCell()
 
 PassRefPtr<AccessibilityTableCell> AccessibilityTableCell::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityTableCell(renderer));
+    AccessibilityTableCell* obj = new AccessibilityTableCell(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 bool AccessibilityTableCell::accessibilityIsIgnored() const
diff --git a/Source/WebCore/accessibility/AccessibilityTableRow.cpp b/Source/WebCore/accessibility/AccessibilityTableRow.cpp
index cfbdfb5c5..b4596d861 100644
--- a/Source/WebCore/accessibility/AccessibilityTableRow.cpp
+++ b/Source/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -54,7 +54,9 @@ AccessibilityTableRow::~AccessibilityTableRow()
 
 PassRefPtr<AccessibilityTableRow> AccessibilityTableRow::create(RenderObject* renderer)
 {
-    return adoptRef(new AccessibilityTableRow(renderer));
+    AccessibilityTableRow* obj = new AccessibilityTableRow(renderer);
+    obj->init();
+    return adoptRef(obj);
 }
 
 AccessibilityRole AccessibilityTableRow::roleValue() const
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index a17688909..b66d1ae46 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -148,7 +148,7 @@ public:
     static bool deviceMotionEnabled() { return isDeviceMotionEnabled; }
     static bool deviceMotionEventEnabled() { return isDeviceMotionEnabled; }
     static bool ondevicemotionEnabled() { return isDeviceMotionEnabled; }
-    
+
     static void setDeviceOrientationEnabled(bool isEnabled) { isDeviceOrientationEnabled = isEnabled; }
     static bool deviceOrientationEnabled() { return isDeviceOrientationEnabled; }
     static bool deviceOrientationEventEnabled() { return isDeviceOrientationEnabled; }
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index fa0454203..400ff9a6a 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -428,10 +428,13 @@ endif
 
 if ENABLE_MICRODATA
 webkitgtk_built_h_api += \
-	$(top_builddir)/DerivedSources/webkit/WebKitDOMHTMLPropertiesCollection.h
+	$(top_builddir)/DerivedSources/webkit/WebKitDOMHTMLPropertiesCollection.h \
+	$(top_builddir)/DerivedSources/webkit/WebKitDOMPropertyNodeList.h
 webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMHTMLPropertiesCollection.cpp \
-	DerivedSources/webkit/WebKitDOMHTMLPropertiesCollectionPrivate.h
+	DerivedSources/webkit/WebKitDOMHTMLPropertiesCollectionPrivate.h \
+	DerivedSources/webkit/WebKitDOMPropertyNodeList.cpp \
+	DerivedSources/webkit/WebKitDOMPropertyNodeListPrivate.h
 endif
 
 if ENABLE_WEB_TIMING
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 8b94f6497..59b9fe604 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -119,6 +119,7 @@
 #include "JSMessageChannelCustom.cpp"
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
+#include "JSMicroDataItemValueCustom.cpp"
 #include "JSMutationCallbackCustom.cpp"
 #include "JSMutationObserverCustom.cpp"
 #include "JSNamedNodeMapCustom.cpp"
diff --git a/Source/WebCore/bindings/js/JSMicroDataItemValueCustom.cpp b/Source/WebCore/bindings/js/JSMicroDataItemValueCustom.cpp
new file mode 100644
index 000000000..09fc33d74
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSMicroDataItemValueCustom.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MICRODATA)
+#include "JSMicroDataItemValue.h"
+
+#include "JSNode.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, MicroDataItemValue* itemValue)
+{
+    if (!itemValue)
+        return jsNull();
+    if (itemValue->isNode())
+        return toJS(exec, globalObject, itemValue->getNode());
+    return jsString(exec, itemValue->getString());
+}
+
+}
+
+#endif // ENABLE(MICRODATA)
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index ebb5e7fa0..03cc4e730 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1771,119 +1771,115 @@ sub GenerateImplementation
                 push(@implContent, ", PropertyName)\n");
                 push(@implContent, "{\n");
 
-                if ($attribute->isStatic) {
-                    push(@implContent, "    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();\n");
-                    push(@implContent, "    if (!scriptContext)\n");
-                    push(@implContent, "        return jsUndefined();\n");
-                    push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "${implClassName}::$implGetterFunctionName(scriptContext)", "") . ";\n");
-                    push(@implContent, "    return result;\n");
-                } else {
+                if (!$attribute->isStatic) {
                     push(@implContent, "    ${className}* castedThis = jsCast<$className*>(asObject(slotBase));\n");
+                }
+
+                if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                    $needsMarkChildren = 1;
+                }
 
+                if ($dataNode->extendedAttributes->{"CheckSecurity"} &&
+                    !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"} &&
+                    !$attribute->signature->extendedAttributes->{"DoNotCheckSecurityOnGetter"}) {
+                    push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
+                    push(@implContent, "        return jsUndefined();\n");
+                }
+
+                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
+                    push(@implContent, "    return castedThis->$implGetterFunctionName(exec);\n");
+                } elsif ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
+                    $implIncludes{"JSDOMBinding.h"} = 1;
+                    push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
+                    push(@implContent, "    return shouldAllowAccessToNode(exec, impl->" . $attribute->signature->name . "()) ? " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName()", "castedThis") . " : jsNull();\n");
+                } elsif ($type eq "EventListener") {
+                    $implIncludes{"EventListener.h"} = 1;
+                    push(@implContent, "    UNUSED_PARAM(exec);\n");
+                    push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
+                    push(@implContent, "    if (EventListener* listener = impl->$implGetterFunctionName()) {\n");
+                    push(@implContent, "        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {\n");
+                    if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(impl))\n");
+                    } else {
+                        push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(impl->scriptExecutionContext()))\n");
+                    }
+                    push(@implContent, "                return jsFunction;\n");
+                    push(@implContent, "        }\n");
+                    push(@implContent, "    }\n");
+                    push(@implContent, "    return jsNull();\n");
+                } elsif ($attribute->signature->type =~ /Constructor$/) {
+                    my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
+                    $constructorType =~ s/Constructor$//;
+                    # Constructor attribute is only used by DOMWindow.idl, so it's correct to pass castedThis as the global object
+                    # Once JSDOMWrappers have a back-pointer to the globalObject we can pass castedThis->globalObject()
+                    push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
+                } elsif (!@{$attribute->getterExceptions}) {
+                    push(@implContent, "    UNUSED_PARAM(exec);\n") if !$attribute->signature->extendedAttributes->{"CallWith"};
+
+                    my $cacheIndex = 0;
                     if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
-                        $needsMarkChildren = 1;
+                        $cacheIndex = $currentCachedAttribute;
+                        $currentCachedAttribute++;
+                        push(@implContent, "    if (JSValue cachedValue = castedThis->m_" . $attribute->signature->name . ".get())\n");
+                        push(@implContent, "        return cachedValue;\n");
                     }
 
-                    if ($dataNode->extendedAttributes->{"CheckSecurity"} &&
-                            !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"} &&
-                            !$attribute->signature->extendedAttributes->{"DoNotCheckSecurityOnGetter"}) {
-                        push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
-                        push(@implContent, "        return jsUndefined();\n");
-                    }
+                    my @callWithArgs = GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()");
 
-                    if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
-                        push(@implContent, "    return castedThis->$implGetterFunctionName(exec);\n");
-                    } elsif ($attribute->signature->extendedAttributes->{"CheckSecurityForNode"}) {
-                        $implIncludes{"JSDOMBinding.h"} = 1;
-                        push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
-                        push(@implContent, "    return shouldAllowAccessToNode(exec, impl->" . $attribute->signature->name . "()) ? " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName()", "castedThis") . " : jsNull();\n");
-                    } elsif ($type eq "EventListener") {
-                        $implIncludes{"EventListener.h"} = 1;
-                        push(@implContent, "    UNUSED_PARAM(exec);\n");
-                        push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
-                        push(@implContent, "    if (EventListener* listener = impl->$implGetterFunctionName()) {\n");
-                        push(@implContent, "        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {\n");
-                        if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
-                            push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(impl))\n");
+                    if ($svgListPropertyType) {
+                        push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
+                    } elsif ($svgPropertyOrListPropertyType) {
+                        push(@implContent, "    $svgPropertyOrListPropertyType& impl = castedThis->impl()->propertyReference();\n");
+                        if ($svgPropertyOrListPropertyType eq "float") { # Special case for JSSVGNumber
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl", "castedThis") . ";\n");
                         } else {
-                            push(@implContent, "            if (JSObject* jsFunction = jsListener->jsFunction(impl->scriptExecutionContext()))\n");
+                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
+
                         }
-                        push(@implContent, "                return jsFunction;\n");
-                        push(@implContent, "        }\n");
-                        push(@implContent, "    }\n");
-                        push(@implContent, "    return jsNull();\n");
-                    } elsif ($attribute->signature->type =~ /Constructor$/) {
-                        my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
-                        $constructorType =~ s/Constructor$//;
-                        # Constructor attribute is only used by DOMWindow.idl, so it's correct to pass castedThis as the global object
-                        # Once JSDOMWrappers have a back-pointer to the globalObject we can pass castedThis->globalObject()
-                        push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec, castedThis);\n");
-                    } elsif (!@{$attribute->getterExceptions}) {
-                        push(@implContent, "    UNUSED_PARAM(exec);\n") if !$attribute->signature->extendedAttributes->{"CallWith"};
-
-                        my $cacheIndex = 0;
-                        if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
-                            $cacheIndex = $currentCachedAttribute;
-                            $currentCachedAttribute++;
-                            push(@implContent, "    if (JSValue cachedValue = castedThis->m_" . $attribute->signature->name . ".get())\n");
-                            push(@implContent, "        return cachedValue;\n");
+                    } else {
+                        my ($functionName, @arguments) = $codeGenerator->GetterExpression(\%implIncludes, $interfaceName, $attribute);
+                        if ($attribute->signature->extendedAttributes->{"ImplementedBy"}) {
+                            my $implementedBy = $attribute->signature->extendedAttributes->{"ImplementedBy"};
+                            $implIncludes{"${implementedBy}.h"} = 1;
+                            $functionName = "${implementedBy}::${functionName}";
+                            unshift(@arguments, "impl") if !$attribute->isStatic;
+                        } elsif ($attribute->isStatic) {
+                            $functionName = "${implClassName}::${functionName}";
+                        } else {
+                            $functionName = "impl->${functionName}";
                         }
 
-                        my @callWithArgs = GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()");
-
-                        if ($svgListPropertyType) {
-                            push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "castedThis->impl()->$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
-                        } elsif ($svgPropertyOrListPropertyType) {
-                            push(@implContent, "    $svgPropertyOrListPropertyType& impl = castedThis->impl()->propertyReference();\n");
-                            if ($svgPropertyOrListPropertyType eq "float") { # Special case for JSSVGNumber
-                                push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl", "castedThis") . ";\n");
-                            } else {
-                                push(@implContent, "    JSValue result =  " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . (join ", ", @callWithArgs) . ")", "castedThis") . ";\n");
+                        unshift(@arguments, @callWithArgs);
 
-                            }
+                        my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, "${functionName}(" . join(", ", @arguments) . ")", "castedThis");
+                        push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n") if !$attribute->isStatic;
+                        if ($codeGenerator->IsSVGAnimatedType($type)) {
+                            push(@implContent, "    RefPtr<$type> obj = $jsType;\n");
+                            push(@implContent, "    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get());\n");
                         } else {
-                            my ($functionName, @arguments) = $codeGenerator->GetterExpression(\%implIncludes, $interfaceName, $attribute);
-                            if ($attribute->signature->extendedAttributes->{"ImplementedBy"}) {
-                                my $implementedBy = $attribute->signature->extendedAttributes->{"ImplementedBy"};
-                                $implIncludes{"${implementedBy}.h"} = 1;
-                                $functionName = "${implementedBy}::${functionName}";
-                                unshift(@arguments, "impl");
-                            } else {
-                                $functionName = "impl->${functionName}";
-                            }
-
-                            unshift(@arguments, @callWithArgs);
-
-                            my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, "${functionName}(" . join(", ", @arguments) . ")", "castedThis");
-                            push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
-                            if ($codeGenerator->IsSVGAnimatedType($type)) {
-                                push(@implContent, "    RefPtr<$type> obj = $jsType;\n");
-                                push(@implContent, "    JSValue result =  toJS(exec, castedThis->globalObject(), obj.get());\n");
-                            } else {
-                                push(@implContent, "    JSValue result = $jsType;\n");
-                            }
+                            push(@implContent, "    JSValue result = $jsType;\n");
                         }
+                    }
 
-                        push(@implContent, "    castedThis->m_" . $attribute->signature->name . ".set(exec->globalData(), castedThis, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
-                        push(@implContent, "    return result;\n");
-
-                    } else {
-                        my @arguments = ("ec");
-                        push(@implContent, "    ExceptionCode ec = 0;\n");
+                    push(@implContent, "    castedThis->m_" . $attribute->signature->name . ".set(exec->globalData(), castedThis, result);\n") if ($attribute->signature->extendedAttributes->{"CachedAttribute"});
+                    push(@implContent, "    return result;\n");
 
-                        unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()"));
+                } else {
+                    my @arguments = ("ec");
+                    push(@implContent, "    ExceptionCode ec = 0;\n");
 
-                        if ($svgPropertyOrListPropertyType) {
-                            push(@implContent, "    $svgPropertyOrListPropertyType impl(*castedThis->impl());\n");
-                            push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . join(", ", @arguments) . ")", "castedThis") . ";\n");
-                        } else {
-                            push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
-                            push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName(" . join(", ", @arguments) . ")", "castedThis") . ";\n");
-                        }
+                    unshift(@arguments, GenerateCallWith($attribute->signature->extendedAttributes->{"CallWith"}, \@implContent, "jsUndefined()"));
 
-                        push(@implContent, "    setDOMException(exec, ec);\n");
-                        push(@implContent, "    return result;\n");
+                    if ($svgPropertyOrListPropertyType) {
+                        push(@implContent, "    $svgPropertyOrListPropertyType impl(*castedThis->impl());\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl.$implGetterFunctionName(" . join(", ", @arguments) . ")", "castedThis") . ";\n");
+                    } else {
+                        push(@implContent, "    $implClassName* impl = static_cast<$implClassName*>(castedThis->impl());\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "impl->$implGetterFunctionName(" . join(", ", @arguments) . ")", "castedThis") . ";\n");
                     }
+
+                    push(@implContent, "    setDOMException(exec, ec);\n");
+                    push(@implContent, "    return result;\n");
                 }
 
                 push(@implContent, "}\n\n");
@@ -1972,13 +1968,6 @@ sub GenerateImplementation
                         push(@implContent, ", JSValue value)\n");
                         push(@implContent, "{\n");
 
-                        if ($attribute->isStatic) {
-                            push(@implContent, "    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();\n");
-                            push(@implContent, "    if (!scriptContext)\n");
-                            push(@implContent, "        return;\n");
-                            my $nativeValue = JSValueToNative($attribute->signature, "value");
-                            push(@implContent, "    ${implClassName}::set$implSetterFunctionName(scriptContext, ${nativeValue});\n");
-                        } else {
                             push(@implContent, "    UNUSED_PARAM(exec);\n");
 
                             if ($dataNode->extendedAttributes->{"CheckSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
@@ -2027,8 +2016,10 @@ sub GenerateImplementation
                                 push(@implContent, "    // Shadowing a built-in object\n");
                                 push(@implContent, "    jsCast<$className*>(thisObject)->putDirect(exec->globalData(), Identifier(exec, \"$name\"), value);\n");
                             } else {
-                                push(@implContent, "    $className* castedThis = jsCast<$className*>(thisObject);\n");
-                                push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n");
+                                if (!$attribute->isStatic) {
+                                    push(@implContent, "    $className* castedThis = jsCast<$className*>(thisObject);\n");
+                                    push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n");
+                                }
                                 push(@implContent, "    ExceptionCode ec = 0;\n") if @{$attribute->setterExceptions};
 
                                 # If the "StrictTypeChecking" extended attribute is present, and the attribute's type is an
@@ -2080,8 +2071,10 @@ sub GenerateImplementation
                                     if ($attribute->signature->extendedAttributes->{"ImplementedBy"}) {
                                         my $implementedBy = $attribute->signature->extendedAttributes->{"ImplementedBy"};
                                         $implIncludes{"${implementedBy}.h"} = 1;
-                                        unshift(@arguments, "impl");
+                                        unshift(@arguments, "impl") if !$attribute->isStatic;
                                         $functionName = "${implementedBy}::${functionName}";
+                                    } elsif ($attribute->isStatic) {
+                                        $functionName = "${implClassName}::${functionName}";
                                     } else {
                                         $functionName = "impl->${functionName}";
                                     }
@@ -2093,7 +2086,6 @@ sub GenerateImplementation
                                     push(@implContent, "    setDOMException(exec, ec);\n") if @{$attribute->setterExceptions};
                                 }
                             }
-                        }
 
                         push(@implContent, "}\n\n");
                         push(@implContent, "#endif\n") if $attributeConditionalString;
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index c3c829c22..268c90341 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -244,10 +244,8 @@ bool JSTestInterface::getOwnPropertyDescriptor(JSObject* object, ExecState* exec
 #if ENABLE(Condition11) || ENABLE(Condition12)
 JSValue jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr(ExecState* exec, JSValue, PropertyName)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return jsUndefined();
-    JSC::JSValue result = jsNumber(TestInterface::supplementalStaticReadOnlyAttr(scriptContext));
+    UNUSED_PARAM(exec);
+    JSValue result = jsNumber(TestSupplemental::supplementalStaticReadOnlyAttr());
     return result;
 }
 
@@ -256,10 +254,8 @@ JSValue jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr(ExecState* exec
 #if ENABLE(Condition11) || ENABLE(Condition12)
 JSValue jsTestInterfaceConstructorSupplementalStaticAttr(ExecState* exec, JSValue, PropertyName)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return jsUndefined();
-    JSC::JSValue result = jsString(exec, TestInterface::supplementalStaticAttr(scriptContext));
+    UNUSED_PARAM(exec);
+    JSValue result = jsString(exec, TestSupplemental::supplementalStaticAttr());
     return result;
 }
 
@@ -328,10 +324,8 @@ void JSTestInterface::put(JSCell* cell, ExecState* exec, PropertyName propertyNa
 #if ENABLE(Condition11) || ENABLE(Condition12)
 void setJSTestInterfaceConstructorSupplementalStaticAttr(ExecState* exec, JSObject*, JSValue value)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return;
-    TestInterface::setSupplementalStaticAttr(scriptContext, ustringToString(value.isEmpty() ? UString() : value.toString(exec)->value(exec)));
+    UNUSED_PARAM(exec);
+    TestSupplemental::setSupplementalStaticAttr(ustringToString(value.isEmpty() ? UString() : value.toString(exec)->value(exec)));
 }
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index e69da7ebb..01fd88856 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -416,20 +416,16 @@ JSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, JSValue slotBase, Property
 
 JSValue jsTestObjConstructorStaticReadOnlyIntAttr(ExecState* exec, JSValue, PropertyName)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return jsUndefined();
-    JSC::JSValue result = jsNumber(TestObj::staticReadOnlyIntAttr(scriptContext));
+    UNUSED_PARAM(exec);
+    JSValue result = jsNumber(TestObj::staticReadOnlyIntAttr());
     return result;
 }
 
 
 JSValue jsTestObjConstructorStaticStringAttr(ExecState* exec, JSValue, PropertyName)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return jsUndefined();
-    JSC::JSValue result = jsString(exec, TestObj::staticStringAttr(scriptContext));
+    UNUSED_PARAM(exec);
+    JSValue result = jsString(exec, TestObj::staticStringAttr());
     return result;
 }
 
@@ -949,10 +945,8 @@ void JSTestObj::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JS
 
 void setJSTestObjConstructorStaticStringAttr(ExecState* exec, JSObject*, JSValue value)
 {
-    ScriptExecutionContext* scriptContext = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    if (!scriptContext)
-        return;
-    TestObj::setStaticStringAttr(scriptContext, ustringToString(value.isEmpty() ? UString() : value.toString(exec)->value(exec)));
+    UNUSED_PARAM(exec);
+    TestObj::setStaticStringAttr(ustringToString(value.isEmpty() ? UString() : value.toString(exec)->value(exec)));
 }
 
 
diff --git a/Source/WebCore/bindings/v8/custom/V8MicroDataItemValueCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MicroDataItemValueCustom.cpp
new file mode 100644
index 000000000..7d13bfed4
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8MicroDataItemValueCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MICRODATA)
+
+#include "V8MicroDataItemValue.h"
+
+#include "V8Binding.h"
+#include "V8Node.h"
+
+namespace WebCore {
+
+v8::Handle<v8::Value> toV8(MicroDataItemValue* itemValue, v8::Isolate* isolate)
+{
+    if (!itemValue)
+        return v8::Null();
+    if (itemValue->isNode())
+        return toV8(itemValue->getNode());
+    return v8String(itemValue->getString());
+}
+
+}
+
+#endif // ENABLE(MICRODATA)
diff --git a/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp
new file mode 100644
index 000000000..32492cfb7
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8SpeechRecognitionResultCustom.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "V8SpeechRecognitionResult.h"
+
+#include "SpeechRecognitionResult.h"
+#include "V8Binding.h"
+
+namespace WebCore {
+
+void V8SpeechRecognitionResult::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+{
+    SpeechRecognitionResult* impl = static_cast<SpeechRecognitionResult*>(object);
+    Document* emma = impl->emma();
+    v8::Persistent<v8::Value> emmaWrapper = store->domNodeMap().get(emma);
+    if (!emmaWrapper.IsEmpty())
+        v8::V8::AddImplicitReferences(wrapper, &emmaWrapper, 1);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/bridge/IdentifierRep.h b/Source/WebCore/bridge/IdentifierRep.h
index b4544422f..c061e4f06 100644
--- a/Source/WebCore/bridge/IdentifierRep.h
+++ b/Source/WebCore/bridge/IdentifierRep.h
@@ -47,13 +47,13 @@ public:
     const char* string() const { return m_isString ? m_value.m_string : 0; }
 
 private:
-    IdentifierRep(int number) 
+    explicit IdentifierRep(int number) 
         : m_isString(false)
     {
         m_value.m_number = number;
     }
     
-    IdentifierRep(const char* name)
+    explicit IdentifierRep(const char* name)
         : m_isString(true)
     {
         m_value.m_string = fastStrDup(name);
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 040d51fcb..f3aab2175 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -504,13 +504,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 GregorianDateTime gdt;
                 msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
+                    ret = QDateTime(QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
                     dist = 0;
                 } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay);
+                    ret = QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay());
                     dist = 1;
                 } else {
-                    ret = QTime(gdt.hour + 1900, gdt.minute, gdt.second);
+                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
                     dist = 2;
                 }
             } else if (type == Number) {
@@ -518,13 +518,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 GregorianDateTime gdt;
                 msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
+                    ret = QDateTime(QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
                     dist = 6;
                 } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay);
+                    ret = QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay());
                     dist = 8;
                 } else {
-                    ret = QTime(gdt.hour, gdt.minute, gdt.second);
+                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
                     dist = 10;
                 }
 #ifndef QT_NO_DATESTRING
@@ -874,13 +874,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
 
         // Dates specified this way are in local time (we convert DateTimes above)
         GregorianDateTime dt;
-        dt.year = date.year() - 1900;
-        dt.month = date.month() - 1;
-        dt.monthDay = date.day();
-        dt.hour = time.hour();
-        dt.minute = time.minute();
-        dt.second = time.second();
-        dt.isDST = -1;
+        dt.setYear(date.year() - 1900);
+        dt.setMonth(date.month() - 1);
+        dt.setMonthDay(date.day());
+        dt.setHour(time.hour());
+        dt.setMinute(time.minute());
+        dt.setSecond(time.second());
+        dt.setIsDST(-1);
         double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return DateInstance::create(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
diff --git a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
index 9682f14ec..0e936bd89 100644
--- a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
@@ -504,13 +504,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 GregorianDateTime gdt;
                 msToGregorianDateTime(exec, date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
+                    ret = QDateTime(QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
                     dist = 0;
                 } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay);
+                    ret = QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay());
                     dist = 1;
                 } else {
-                    ret = QTime(gdt.hour + 1900, gdt.minute, gdt.second);
+                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
                     dist = 2;
                 }
             } else if (type == Number) {
@@ -518,13 +518,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
                 GregorianDateTime gdt;
                 msToGregorianDateTime(exec, b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
-                    ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
+                    ret = QDateTime(QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay()), QTime(gdt.hour(), gdt.minute(), gdt.second()), Qt::UTC);
                     dist = 6;
                 } else if (hint == QMetaType::QDate) {
-                    ret = QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay);
+                    ret = QDate(gdt.year() + 1900, gdt.month() + 1, gdt.monthDay());
                     dist = 8;
                 } else {
-                    ret = QTime(gdt.hour, gdt.minute, gdt.second);
+                    ret = QTime(gdt.hour(), gdt.minute(), gdt.second());
                     dist = 10;
                 }
 #ifndef QT_NO_DATESTRING
@@ -874,13 +874,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
 
         // Dates specified this way are in local time (we convert DateTimes above)
         GregorianDateTime dt;
-        dt.year = date.year() - 1900;
-        dt.month = date.month() - 1;
-        dt.monthDay = date.day();
-        dt.hour = time.hour();
-        dt.minute = time.minute();
-        dt.second = time.second();
-        dt.isDST = -1;
+        dt.setYear(date.year() - 1900);
+        dt.setMonth(date.month() - 1);
+        dt.setMonthDay(date.day());
+        dt.setHour(time.hour());
+        dt.setMinute(time.minute());
+        dt.setSecond(time.second());
+        dt.setIsDST(-1);
         double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
         return DateInstance::create(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 26615c5f0..ae248ed09 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -608,7 +608,7 @@ static PassRefPtr<CSSValue> getPositionOffsetValue(RenderStyle* style, CSSProper
         return cssValuePool().createValue(l);
     }
 
-    if (style->position() == RelativePosition) {
+    if (style->position() == RelativePosition || style->position() == StickyPosition) {
         // FIXME: It's not enough to simply return "auto" values for one offset if the other side is defined.
         // In other words if left is auto and right is not auto, then left's computed value is negative right().
         // So we should get the opposite length unit and see if it is auto.
diff --git a/Source/WebCore/css/CSSGradientValue.cpp b/Source/WebCore/css/CSSGradientValue.cpp
index a314a8602..3f1979fee 100644
--- a/Source/WebCore/css/CSSGradientValue.cpp
+++ b/Source/WebCore/css/CSSGradientValue.cpp
@@ -105,6 +105,34 @@ struct GradientStop {
     { }
 };
 
+PassRefPtr<CSSGradientValue> CSSGradientValue::gradientWithStylesResolved(StyleResolver* styleResolver)
+{
+    bool derived = false;
+    for (unsigned i = 0; i < m_stops.size(); i++)
+        if (styleResolver->colorFromPrimitiveValueIsDerivedFromElement(m_stops[i].m_color.get())) {
+            m_stops[i].m_colorIsDerivedFromElement = true;
+            derived = true;
+            break;
+        }
+
+    RefPtr<CSSGradientValue> result;
+    if (!derived)
+        result = this;
+    else if (isLinearGradient())
+        result = static_cast<CSSLinearGradientValue*>(this)->clone();
+    else if (isRadialGradient())
+        result = static_cast<CSSRadialGradientValue*>(this)->clone();
+    else {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+
+    for (unsigned i = 0; i < result->m_stops.size(); i++)
+        result->m_stops[i].m_resolvedColor = styleResolver->colorFromPrimitiveValue(result->m_stops[i].m_color.get());
+
+    return result.release();
+}
+
 void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, RenderStyle* rootStyle, float maxLengthForRepeat)
 {
     RenderStyle* style = renderer->style();
@@ -112,10 +140,8 @@ void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, Rend
     if (m_deprecatedType) {
         sortStopsIfNeeded();
 
-        // We have to resolve colors.
         for (unsigned i = 0; i < m_stops.size(); i++) {
             const CSSGradientColorStop& stop = m_stops[i];
-            Color color = renderer->document()->styleResolver()->colorFromPrimitiveValue(stop.m_color.get());
 
             float offset;
             if (stop.m_position->isPercentage())
@@ -123,7 +149,7 @@ void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, Rend
             else
                 offset = stop.m_position->getFloatValue(CSSPrimitiveValue::CSS_NUMBER);
 
-            gradient->addColorStop(offset, color);
+            gradient->addColorStop(offset, stop.m_resolvedColor);
         }
 
         // The back end already sorted the stops.
@@ -148,7 +174,7 @@ void CSSGradientValue::addStops(Gradient* gradient, RenderObject* renderer, Rend
     for (size_t i = 0; i < numStops; ++i) {
         const CSSGradientColorStop& stop = m_stops[i];
 
-        stops[i].color = renderer->document()->styleResolver()->colorFromPrimitiveValue(stop.m_color.get());
+        stops[i].color = stop.m_resolvedColor;
 
         if (stop.m_position) {
             if (stop.m_position->isPercentage())
@@ -413,8 +439,7 @@ bool CSSGradientValue::isCacheable() const
     for (size_t i = 0; i < m_stops.size(); ++i) {
         const CSSGradientColorStop& stop = m_stops[i];
 
-        CSSPrimitiveValue* color = stop.m_color.get();
-        if (color->getIdent() == CSSValueCurrentcolor)
+        if (stop.m_colorIsDerivedFromElement)
             return false;
 
         if (!stop.m_position)
diff --git a/Source/WebCore/css/CSSGradientValue.h b/Source/WebCore/css/CSSGradientValue.h
index ea10eb8c2..0c7ef7764 100644
--- a/Source/WebCore/css/CSSGradientValue.h
+++ b/Source/WebCore/css/CSSGradientValue.h
@@ -40,8 +40,11 @@ enum CSSGradientType { CSSLinearGradient, CSSRadialGradient };
 enum CSSGradientRepeat { NonRepeating, Repeating };
 
 struct CSSGradientColorStop {
+    CSSGradientColorStop() : m_colorIsDerivedFromElement(false) { };
     RefPtr<CSSPrimitiveValue> m_position; // percentage or length
     RefPtr<CSSPrimitiveValue> m_color;
+    Color m_resolvedColor;
+    bool m_colorIsDerivedFromElement;
 };
 
 class CSSGradientValue : public CSSImageGeneratorValue {
@@ -71,6 +74,7 @@ public:
 
     bool isPending() const { return false; }
     void loadSubimages(CachedResourceLoader*) { }
+    PassRefPtr<CSSGradientValue> gradientWithStylesResolved(StyleResolver*);
 
 protected:
     CSSGradientValue(ClassType classType, CSSGradientRepeat repeat, bool deprecatedType = false)
@@ -81,6 +85,19 @@ protected:
     {
     }
 
+    CSSGradientValue(const CSSGradientValue& other, ClassType classType, bool deprecatedType = false)
+        : CSSImageGeneratorValue(classType)
+        , m_firstX(other.m_firstX)
+        , m_firstY(other.m_firstY)
+        , m_secondX(other.m_secondX)
+        , m_secondY(other.m_secondY)
+        , m_stops(other.m_stops)
+        , m_stopsSorted(other.m_stopsSorted)
+        , m_deprecatedType(deprecatedType)
+        , m_repeating(other.isRepeating() ? Repeating : NonRepeating)
+    {
+    }
+
     void addStops(Gradient*, RenderObject*, RenderStyle* rootStyle, float maxLengthForRepeat = 0);
 
     // Resolve points/radii to front end values.
@@ -117,12 +134,23 @@ public:
     // Create the gradient for a given size.
     PassRefPtr<Gradient> createGradient(RenderObject*, const IntSize&);
 
+    PassRefPtr<CSSLinearGradientValue> clone() const
+    {
+        return adoptRef(new CSSLinearGradientValue(*this));
+    }
+
 private:
     CSSLinearGradientValue(CSSGradientRepeat repeat, bool deprecatedType = false)
         : CSSGradientValue(LinearGradientClass, repeat, deprecatedType)
     {
     }
 
+    CSSLinearGradientValue(const CSSLinearGradientValue& other)
+        : CSSGradientValue(other, LinearGradientClass, other.deprecatedType())
+        , m_angle(other.m_angle)
+    {
+    }
+
     RefPtr<CSSPrimitiveValue> m_angle; // may be null.
 };
 
@@ -133,6 +161,11 @@ public:
         return adoptRef(new CSSRadialGradientValue(repeat, deprecatedType));
     }
 
+    PassRefPtr<CSSRadialGradientValue> clone() const
+    {
+        return adoptRef(new CSSRadialGradientValue(*this));
+    }
+
     String customCssText() const;
 
     void setFirstRadius(PassRefPtr<CSSPrimitiveValue> val) { m_firstRadius = val; }
@@ -153,6 +186,18 @@ private:
     {
     }
 
+    CSSRadialGradientValue(const CSSRadialGradientValue& other)
+        : CSSGradientValue(other, RadialGradientClass, other.deprecatedType())
+        , m_firstRadius(other.m_firstRadius)
+        , m_secondRadius(other.m_secondRadius)
+        , m_shape(other.m_shape)
+        , m_sizingBehavior(other.m_sizingBehavior)
+        , m_endHorizontalSize(other.m_endHorizontalSize)
+        , m_endVerticalSize(other.m_endVerticalSize)
+    {
+    }
+
+
     // Resolve points/radii to front end values.
     float resolveRadius(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, float* widthOrHeight = 0);
 
diff --git a/Source/WebCore/css/CSSImageGeneratorValue.h b/Source/WebCore/css/CSSImageGeneratorValue.h
index 877969a90..b3d84eab2 100644
--- a/Source/WebCore/css/CSSImageGeneratorValue.h
+++ b/Source/WebCore/css/CSSImageGeneratorValue.h
@@ -36,6 +36,7 @@ namespace WebCore {
 class CachedResourceLoader;
 class Image;
 class RenderObject;
+class StyleResolver;
 
 struct SizeAndCount {
     SizeAndCount(IntSize newSize = IntSize(), int newCount = 0)
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 4bd9778ad..650844060 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -615,8 +615,12 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         if (valueID == CSSValueVisible || valueID == CSSValueNone || valueID == CSSValueAll || valueID == CSSValueAuto || (valueID >= CSSValueVisiblepainted && valueID <= CSSValueStroke))
             return true;
         break;
-    case CSSPropertyPosition: // static | relative | absolute | fixed | inherit
-        if (valueID == CSSValueStatic || valueID == CSSValueRelative || valueID == CSSValueAbsolute || valueID == CSSValueFixed)
+    case CSSPropertyPosition: // static | relative | absolute | fixed | sticky | inherit
+        if (valueID == CSSValueStatic || valueID == CSSValueRelative || valueID == CSSValueAbsolute || valueID == CSSValueFixed
+#if ENABLE(CSS_STICKY_POSITION)
+            || valueID == CSSValueWebkitSticky
+#endif
+            )
             return true;
         break;
     case CSSPropertyResize: // none | both | horizontal | vertical | auto
@@ -4465,7 +4469,12 @@ PassRefPtr<CSSWrapShape> CSSParser::parseExclusionShapeRectangle(CSSParserValueL
     unsigned argumentNumber = 0;
     CSSParserValue* argument = args->current();
     while (argument) {
-        if (!validUnit(argument, FLength | FPercent))
+        Units unitFlags = FLength | FPercent;
+        if (argumentNumber > 1) {
+            // Arguments width, height, rx, and ry cannot be negative.
+            unitFlags = unitFlags | FNonNeg;
+        }
+        if (!validUnit(argument, unitFlags))
             return 0;
 
         RefPtr<CSSPrimitiveValue> length = createPrimitiveNumericValue(argument);
@@ -4518,7 +4527,13 @@ PassRefPtr<CSSWrapShape> CSSParser::parseExclusionShapeCircle(CSSParserValueList
     unsigned argumentNumber = 0;
     CSSParserValue* argument = args->current();
     while (argument) {
-        if (!validUnit(argument, FLength | FPercent))
+        Units unitFlags = FLength | FPercent;
+        if (argumentNumber == 2) {
+            // Argument radius cannot be negative.
+            unitFlags = unitFlags | FNonNeg;
+        }
+
+        if (!validUnit(argument, unitFlags))
             return 0;
 
         RefPtr<CSSPrimitiveValue> length = createPrimitiveNumericValue(argument);
@@ -4561,7 +4576,12 @@ PassRefPtr<CSSWrapShape> CSSParser::parseExclusionShapeEllipse(CSSParserValueLis
     unsigned argumentNumber = 0;
     CSSParserValue* argument = args->current();
     while (argument) {
-        if (!validUnit(argument, FLength | FPercent))
+        Units unitFlags = FLength | FPercent;
+        if (argumentNumber > 1) {
+            // Arguments radiusX and radiusY cannot be negative.
+            unitFlags = unitFlags | FNonNeg;
+        }
+        if (!validUnit(argument, unitFlags))
             return 0;
 
         RefPtr<CSSPrimitiveValue> length = createPrimitiveNumericValue(argument);
@@ -6064,6 +6084,8 @@ bool CSSParser::parseBorderImageRepeat(RefPtr<CSSValue>& result)
     RefPtr<CSSPrimitiveValue> firstValue;
     RefPtr<CSSPrimitiveValue> secondValue;
     CSSParserValue* val = m_valueList->current();
+    if (!val)
+        return false;
     if (isBorderImageRepeatKeyword(val->id))
         firstValue = cssValuePool().createIdentifierValue(val->id);
     else
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 97e0b63b1..a88f49cda 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -2032,6 +2032,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EPosition e)
         case FixedPosition:
             m_value.ident = CSSValueFixed;
             break;
+#if ENABLE(CSS_STICKY_POSITION)
+        case StickyPosition:
+            m_value.ident = CSSValueWebkitSticky;
+            break;
+#endif
     }
 }
 
@@ -2046,6 +2051,10 @@ template<> inline CSSPrimitiveValue::operator EPosition() const
             return AbsolutePosition;
         case CSSValueFixed:
             return FixedPosition;
+#if ENABLE(CSS_STICKY_POSITION)
+        case CSSValueWebkitSticky:
+            return StickyPosition;
+#endif
         default:
             ASSERT_NOT_REACHED();
             return StaticPosition;
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index 38509614e..93a6d4a91 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -72,6 +72,7 @@ public:
     bool isFontFeatureValue() const { return m_classType == FontFeatureClass; }
     bool isFontValue() const { return m_classType == FontClass; }
     bool isImageGeneratorValue() const { return m_classType >= CanvasClass && m_classType <= RadialGradientClass; }
+    bool isGradientValue() const { return m_classType >= LinearGradientClass && m_classType <= RadialGradientClass; }
 #if ENABLE(CSS_IMAGE_SET)
     bool isImageSetValue() const { return m_classType == ImageSetClass; }
 #endif
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index 8dc27c844..6e0db28f7 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -915,6 +915,11 @@ wrap
 // -webkit-line-align
 edges
 
+// position
+#if defined(ENABLE_CSS_STICKY_POSITION) && ENABLE_CSS_STICKY_POSITION
+-webkit-sticky
+#endif // CSS_STICKY_POSITION
+
 // (pointer:) media feature
 // none
 coarse
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index 66dc5874b..299e075d5 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -540,10 +540,10 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
             // If we're in the same tree-scope as the scoping element, then following a shadow descendant combinator would escape that and thus the scope.
             if (context.scope && context.scope->treeScope() == context.element->treeScope())
                 return SelectorFailsCompletely;
-            Node* shadowHostNode = context.element->shadowAncestorNode();
-            if (shadowHostNode == context.element || !shadowHostNode->isElementNode())
+            Element* shadowHostNode = context.element->shadowHost();
+            if (!shadowHostNode)
                 return SelectorFailsCompletely;
-            nextContext.element = toElement(shadowHostNode);
+            nextContext.element = shadowHostNode;
             nextContext.isSubSelector = false;
             nextContext.elementStyle = 0;
             nextContext.elementParentStyle = 0;
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 7098f7232..a4a13ef5e 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -118,7 +118,7 @@ public:
     
     void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     {
-        MemoryClassInfo<StylePropertySet> info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        MemoryClassInfo<StylePropertySet> info(memoryObjectInfo, this, MemoryInstrumentation::CSS, m_arraySize * sizeof(CSSProperty));
         if (m_isMutable)
             info.addMember(m_mutablePropertyVector);
     }
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 4ee464a4c..e55e40c58 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -3363,7 +3363,10 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
             for (CSSValueListIterator i = value; i.hasMore(); i.advance()) {
                 CSSValue* item = i.value();
                 if (item->isImageGeneratorValue()) {
-                    m_style->setContent(StyleGeneratedImage::create(static_cast<CSSImageGeneratorValue*>(item)), didSet);
+                    if (item->isGradientValue())
+                        m_style->setContent(StyleGeneratedImage::create(static_cast<CSSGradientValue*>(item)->gradientWithStylesResolved(this).get()), didSet);
+                    else
+                        m_style->setContent(StyleGeneratedImage::create(static_cast<CSSImageGeneratorValue*>(item)), didSet);
                     didSet = true;
 #if ENABLE(CSS_IMAGE_SET)
                 } else if (item->isImageSetValue()) {
@@ -4389,8 +4392,11 @@ PassRefPtr<StyleImage> StyleResolver::styleImage(CSSPropertyID property, CSSValu
     if (value->isImageValue())
         return cachedOrPendingFromValue(property, static_cast<CSSImageValue*>(value));
 
-    if (value->isImageGeneratorValue())
+    if (value->isImageGeneratorValue()) {
+        if (value->isGradientValue())
+            return generatedOrPendingFromValue(property, static_cast<CSSGradientValue*>(value)->gradientWithStylesResolved(this).get());
         return generatedOrPendingFromValue(property, static_cast<CSSImageGeneratorValue*>(value));
+    }
 
 #if ENABLE(CSS_IMAGE_SET)
     if (value->isImageSetValue())
@@ -4691,6 +4697,20 @@ static Color colorForCSSValue(int cssValueId)
     return RenderTheme::defaultTheme()->systemColor(cssValueId);
 }
 
+bool StyleResolver::colorFromPrimitiveValueIsDerivedFromElement(CSSPrimitiveValue* value)
+{
+    int ident = value->getIdent();
+    switch (ident) {
+    case CSSValueWebkitText:
+    case CSSValueWebkitLink:
+    case CSSValueWebkitActivelink:
+    case CSSValueCurrentcolor:
+        return true;
+    default:
+        return false;
+    }
+}
+
 Color StyleResolver::colorFromPrimitiveValue(CSSPrimitiveValue* value, bool forVisitedLink) const
 {
     if (value->isRGBColor())
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index b653e8444..1e7643898 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -223,6 +223,7 @@ private:
 public:
     bool useSVGZoomRules();
 
+    static bool colorFromPrimitiveValueIsDerivedFromElement(CSSPrimitiveValue*);
     Color colorFromPrimitiveValue(CSSPrimitiveValue*, bool forVisitedLink = false) const;
 
     bool hasSelectorForAttribute(const AtomicString&) const;
diff --git a/Source/WebCore/css/mediaControlsEfl.css b/Source/WebCore/css/mediaControlsEfl.css
index 55f58d994..8930ff0fa 100644
--- a/Source/WebCore/css/mediaControlsEfl.css
+++ b/Source/WebCore/css/mediaControlsEfl.css
@@ -84,13 +84,25 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
     -webkit-appearance: media-current-time-display;
     -webkit-user-select: none;
-    display: inline-block;
+    display: -webkit-box;
     height: 20px;
 
     padding: 4px;
 
     text-align: center;
     font-size: 10px;
+
+    color: black;
+    letter-spacing: normal;
+    word-spacing: normal;
+    line-height: normal;
+    text-transform: none;
+    text-indent: 0;
+    text-shadow: none;
+    text-decoration: none;
+    font-style: normal;
+    font-weight: normal;
+    font-family: serif;
 }
 
 audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
diff --git a/Source/WebCore/dom/BeforeLoadEvent.h b/Source/WebCore/dom/BeforeLoadEvent.h
index 1e6b95903..3289712d2 100644
--- a/Source/WebCore/dom/BeforeLoadEvent.h
+++ b/Source/WebCore/dom/BeforeLoadEvent.h
@@ -66,7 +66,7 @@ private:
     {
     }
 
-    BeforeLoadEvent(const String& url)
+    explicit BeforeLoadEvent(const String& url)
         : Event(eventNames().beforeloadEvent, false, true)
         , m_url(url)
     {
diff --git a/Source/WebCore/dom/BeforeTextInsertedEvent.h b/Source/WebCore/dom/BeforeTextInsertedEvent.h
index 6e45f2311..4f49d97b6 100644
--- a/Source/WebCore/dom/BeforeTextInsertedEvent.h
+++ b/Source/WebCore/dom/BeforeTextInsertedEvent.h
@@ -46,7 +46,7 @@ public:
     void setText(const String& s) { m_text = s; }
 
 private:
-    BeforeTextInsertedEvent(const String&);
+    explicit BeforeTextInsertedEvent(const String&);
 
     String m_text;
 };
diff --git a/Source/WebCore/dom/ChildListMutationScope.h b/Source/WebCore/dom/ChildListMutationScope.h
index bce26751c..e0624ef5d 100644
--- a/Source/WebCore/dom/ChildListMutationScope.h
+++ b/Source/WebCore/dom/ChildListMutationScope.h
@@ -45,7 +45,7 @@ namespace WebCore {
 class ChildListMutationScope {
     WTF_MAKE_NONCOPYABLE(ChildListMutationScope);
 public:
-    ChildListMutationScope(Node* target)
+    explicit ChildListMutationScope(Node* target)
         : m_target(target->document()->hasMutationObserversOfType(MutationObserver::ChildList) ? target : 0)
     {
         if (m_target)
diff --git a/Source/WebCore/dom/ChildNodeList.h b/Source/WebCore/dom/ChildNodeList.h
index 243e897d3..646289ded 100644
--- a/Source/WebCore/dom/ChildNodeList.h
+++ b/Source/WebCore/dom/ChildNodeList.h
@@ -39,7 +39,7 @@ namespace WebCore {
         virtual ~ChildNodeList();
 
     protected:
-        ChildNodeList(PassRefPtr<Node> rootNode);
+        explicit ChildNodeList(PassRefPtr<Node> rootNode);
 
         virtual bool nodeMatches(Element*) const;
     };
diff --git a/Source/WebCore/dom/ClientRect.h b/Source/WebCore/dom/ClientRect.h
index f7394978f..709847841 100644
--- a/Source/WebCore/dom/ClientRect.h
+++ b/Source/WebCore/dom/ClientRect.h
@@ -50,8 +50,8 @@ namespace WebCore {
 
     private:
         ClientRect();
-        ClientRect(const IntRect&);
-        ClientRect(const FloatRect&);
+        explicit ClientRect(const IntRect&);
+        explicit ClientRect(const FloatRect&);
 
         FloatRect m_rect;
     }; 
diff --git a/Source/WebCore/dom/ClientRectList.h b/Source/WebCore/dom/ClientRectList.h
index 03915b1e2..513c3bda6 100644
--- a/Source/WebCore/dom/ClientRectList.h
+++ b/Source/WebCore/dom/ClientRectList.h
@@ -47,7 +47,7 @@ namespace WebCore {
 
     private:
         ClientRectList();
-        ClientRectList(const Vector<FloatQuad>&);
+        explicit ClientRectList(const Vector<FloatQuad>&);
 
         Vector<RefPtr<ClientRect> > m_list;
     }; 
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
index 2faf8593c..d3a54f887 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
@@ -125,8 +125,15 @@ Node* ComposedShadowTreeWalker::traverseChild(const Node* node, TraversalDirecti
 Node* ComposedShadowTreeWalker::traverseLightChildren(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
-    if (Node* child = (direction == TraversalDirectionForward ? node->firstChild() : node->lastChild()))
-        return traverseNode(child, direction);
+    return traverseSiblings(direction == TraversalDirectionForward ? node->firstChild() : node->lastChild(), direction);
+}
+
+Node* ComposedShadowTreeWalker::traverseSiblings(const Node* node, TraversalDirection direction)
+{
+    for (const Node* sibling = node; sibling; sibling = (direction == TraversalDirectionForward ? sibling->nextSibling() : sibling->previousSibling())) {
+        if (Node* found = traverseNode(sibling, direction))
+            return found;
+    }
     return 0;
 }
 
@@ -138,8 +145,8 @@ Node* ComposedShadowTreeWalker::traverseNode(const Node* node, TraversalDirectio
     const InsertionPoint* insertionPoint = toInsertionPoint(node);
     if (!insertionPoint->isActive())
         return const_cast<Node*>(node);
-    if (Node* next = (direction == TraversalDirectionForward ? insertionPoint->first() : insertionPoint->last()))
-        return traverseNode(next, direction);
+    if (Node* found = traverseDistributedNodes(direction == TraversalDirectionForward ? insertionPoint->first() : insertionPoint->last(), insertionPoint, direction))
+        return found;
     return traverseLightChildren(node, direction);
 }
 
@@ -157,6 +164,15 @@ void ComposedShadowTreeWalker::previousSibling()
     assertPostcondition();
 }
 
+Node* ComposedShadowTreeWalker::traverseDistributedNodes(const Node* node, const InsertionPoint* insertionPoint, TraversalDirection direction)
+{
+    for (const Node* next = node; next; next = (direction == TraversalDirectionForward ? insertionPoint->nextTo(next) : insertionPoint->previousTo(next))) {
+        if (Node* found = traverseNode(next, direction))
+            return found;
+    }
+    return 0;
+}
+
 Node* ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
@@ -166,22 +182,23 @@ Node* ComposedShadowTreeWalker::traverseSiblingOrBackToInsertionPoint(const Node
     InsertionPoint* insertionPoint = shadow->insertionPointFor(node);
     if (!insertionPoint)
         return traverseSiblingInCurrentTree(node, direction);
-    if (Node* next = (direction == TraversalDirectionForward ? insertionPoint->nextTo(node) : insertionPoint->previousTo(node)))
-        return traverseNode(next, direction);
+
+    if (Node* found = traverseDistributedNodes(direction == TraversalDirectionForward ? insertionPoint->nextTo(node) : insertionPoint->previousTo(node), insertionPoint, direction))
+        return found;
     return traverseSiblingOrBackToInsertionPoint(insertionPoint, direction);
 }
 
 Node* ComposedShadowTreeWalker::traverseSiblingInCurrentTree(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
-    if (Node* next = (direction == TraversalDirectionForward ? node->nextSibling() : node->previousSibling()))
-        return traverseNode(next, direction);
-    if (Node* next = traverseSiblingOrBackToYoungerShadowRoot(node, direction))
+    if (Node* found = traverseSiblings(direction == TraversalDirectionForward ? node->nextSibling() : node->previousSibling(), direction))
+        return found;
+    if (Node* next = traverseBackToYoungerShadowRoot(node, direction))
         return next;
     return escapeFallbackContentElement(node, direction);
 }
 
-Node* ComposedShadowTreeWalker::traverseSiblingOrBackToYoungerShadowRoot(const Node* node, TraversalDirection direction)
+Node* ComposedShadowTreeWalker::traverseBackToYoungerShadowRoot(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
     if (node->parentNode() && node->parentNode()->isShadowRoot()) {
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.h b/Source/WebCore/dom/ComposedShadowTreeWalker.h
index 3c7e00ba4..a0dc2f604 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.h
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.h
@@ -139,7 +139,10 @@ private:
     static Node* traverseSiblingOrBackToInsertionPoint(const Node*, TraversalDirection);
     static Node* traverseSiblingInCurrentTree(const Node*, TraversalDirection);
 
-    static Node* traverseSiblingOrBackToYoungerShadowRoot(const Node*, TraversalDirection);
+    static Node* traverseSiblings(const Node*, TraversalDirection);
+    static Node* traverseDistributedNodes(const Node*, const InsertionPoint*, TraversalDirection);
+
+    static Node* traverseBackToYoungerShadowRoot(const Node*, TraversalDirection);
     static Node* escapeFallbackContentElement(const Node*, TraversalDirection);
 
     Node* traverseNodeEscapingFallbackContents(const Node*, ParentTraversalDetails* = 0) const;
@@ -165,7 +168,7 @@ inline ComposedShadowTreeWalker::ComposedShadowTreeWalker(const Node* node, Poli
 // insertion points and shadow roots.
 class ComposedShadowTreeParentWalker {
 public:
-    ComposedShadowTreeParentWalker(const Node*);
+    explicit ComposedShadowTreeParentWalker(const Node*);
     void parentIncludingInsertionPointAndShadowRoot();
     Node* get() const { return const_cast<Node*>(m_node); }
 private:
diff --git a/Source/WebCore/dom/DOMCoreException.h b/Source/WebCore/dom/DOMCoreException.h
index afd1938ab..cc21a7a14 100644
--- a/Source/WebCore/dom/DOMCoreException.h
+++ b/Source/WebCore/dom/DOMCoreException.h
@@ -43,7 +43,7 @@ public:
     static bool initializeDescription(ExceptionCode, ExceptionCodeDescription*);
 
 private:
-    DOMCoreException(const ExceptionCodeDescription& description)
+    explicit DOMCoreException(const ExceptionCodeDescription& description)
         : ExceptionBase(description)
     {
     }
diff --git a/Source/WebCore/dom/DOMImplementation.h b/Source/WebCore/dom/DOMImplementation.h
index 81ae29faa..34cd9095a 100644
--- a/Source/WebCore/dom/DOMImplementation.h
+++ b/Source/WebCore/dom/DOMImplementation.h
@@ -70,7 +70,7 @@ public:
     static bool isTextMIMEType(const String& MIMEType);
 
 private:
-    DOMImplementation(Document*);
+    explicit DOMImplementation(Document*);
 
     Document* m_document;
 };
diff --git a/Source/WebCore/dom/DatasetDOMStringMap.h b/Source/WebCore/dom/DatasetDOMStringMap.h
index cb9a61752..713feb897 100644
--- a/Source/WebCore/dom/DatasetDOMStringMap.h
+++ b/Source/WebCore/dom/DatasetDOMStringMap.h
@@ -52,7 +52,7 @@ public:
     virtual Element* element() { return m_element; }
 
 private:
-    DatasetDOMStringMap(Element* element)
+    explicit DatasetDOMStringMap(Element* element)
         : m_element(element)
     {
     }
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index 1c1f6fcba..d4aad06ac 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -58,7 +58,7 @@ public:
     static bool isActiveAt(Page*);
 
 private:
-    DeviceMotionController(DeviceMotionClient*);
+    explicit DeviceMotionController(DeviceMotionClient*);
 
     void timerFired(Timer<DeviceMotionController>*);
     
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index 0f42bf432..bfe451745 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -61,7 +61,7 @@ public:
     static bool isActiveAt(Page*);
 
 private:
-    DeviceOrientationController(DeviceOrientationClient*);
+    explicit DeviceOrientationController(DeviceOrientationClient*);
 
     void timerFired(Timer<DeviceOrientationController>*);
 
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 3449ff0ec..f0b0b65cd 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -421,7 +421,7 @@ uint64_t Document::s_globalTreeVersion = 0;
 
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     : ContainerNode(0, CreateDocument)
-    , TreeScope(this, this)
+    , TreeScope(this)
     , m_guardRefCount(0)
     , m_contextFeatures(ContextFeatures::defaultSwitch())
     , m_compatibilityMode(NoQuirksMode)
@@ -481,7 +481,9 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_writeRecursionIsTooDeep(false)
     , m_writeRecursionDepth(0)
     , m_wheelEventHandlerCount(0)
+#if ENABLE(TOUCH_EVENTS)
     , m_touchEventHandlerCount(0)
+#endif
 #if ENABLE(UNDO_MANAGER)
     , m_undoManager(0)
 #endif
@@ -493,7 +495,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_didDispatchViewportPropertiesChanged(false)
 #endif
 {
-    setTreeScope(this);
+    m_document = this;
 
     m_pageGroupUserSheetCacheValid = false;
 
@@ -676,7 +678,7 @@ Document::~Document()
     for (unsigned i = 0; i < WTF_ARRAY_LENGTH(m_collections); i++)
         ASSERT(!m_collections[i]);
 
-    setTreeScope(0);
+    m_document = 0;
 
     InspectorCounters::decrementCounter(InspectorCounters::DocumentCounter);
 }
@@ -1350,14 +1352,13 @@ void Document::setContent(const String& content)
 
 String Document::suggestedMIMEType() const
 {
-    Document* doc = document();
-    if (doc->isXHTMLDocument())
+    if (m_document->isXHTMLDocument())
         return "application/xhtml+xml";
-    if (doc->isSVGDocument())
+    if (m_document->isSVGDocument())
         return "image/svg+xml";
-    if (doc->xmlStandalone())
+    if (m_document->xmlStandalone())
         return "text/xml";
-    if (doc->isHTMLDocument())
+    if (m_document->isHTMLDocument())
         return "text/html";
 
     if (DocumentLoader* documentLoader = loader())
@@ -5821,7 +5822,13 @@ void Document::webkitExitPointerLock()
 
 Element* Document::webkitPointerLockElement() const
 {
-    return page() ? page()->pointerLockController()->element() : 0;
+    if (!page())
+        return 0;
+    if (Element* element = page()->pointerLockController()->element()) {
+        if (element->document() == this)
+            return element;
+    }
+    return 0;
 }
 #endif
 
@@ -5926,19 +5933,33 @@ void Document::didRemoveWheelEventHandler()
 
 void Document::didAddTouchEventHandler()
 {
+#if ENABLE(TOUCH_EVENTS)
     ++m_touchEventHandlerCount;
-    Frame* mainFrame = page() ? page()->mainFrame() : 0;
-    if (mainFrame)
-        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+    if (m_touchEventHandlerCount > 1)
+        return;
+    if (Page* page = this->page())
+        page->chrome()->client()->needTouchEvents(true);
+#endif
 }
 
 void Document::didRemoveTouchEventHandler()
 {
-    ASSERT(m_touchEventHandlerCount > 0);
+#if ENABLE(TOUCH_EVENTS)
+    ASSERT(m_touchEventHandlerCount);
     --m_touchEventHandlerCount;
-    Frame* mainFrame = page() ? page()->mainFrame() : 0;
-    if (mainFrame)
-        mainFrame->notifyChromeClientTouchEventHandlerCountChanged();
+    if (m_touchEventHandlerCount)
+        return;
+
+    m_listenerTypes &= ~TOUCH_LISTENER;
+    Page* page = this->page();
+    if (!page)
+        return;
+    for (const Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document() && frame->document()->touchEventHandlerCount())
+            return;
+    }
+    page->chrome()->client()->needTouchEvents(false);
+#endif
 }
 
 HTMLIFrameElement* Document::seamlessParentIFrame() const
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 2014dcd84..d9eb6703d 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -1124,7 +1124,12 @@ public:
     void didAddWheelEventHandler();
     void didRemoveWheelEventHandler();
 
+#if ENABLE(TOUCH_EVENTS)
     unsigned touchEventHandlerCount() const { return m_touchEventHandlerCount; }
+#else
+    unsigned touchEventHandlerCount() const { return 0; }
+#endif
+
     void didAddTouchEventHandler();
     void didRemoveTouchEventHandler();
 
@@ -1504,7 +1509,9 @@ private:
     unsigned m_writeRecursionDepth;
     
     unsigned m_wheelEventHandlerCount;
+#if ENABLE(TOUCH_EVENTS)
     unsigned m_touchEventHandlerCount;
+#endif
     
 #if ENABLE(UNDO_MANAGER)
     RefPtr<UndoManager> m_undoManager;
@@ -1539,48 +1546,20 @@ private:
 
 // Put these methods here, because they require the Document definition, but we really want to inline them.
 
-inline TreeScope* Node::treeScope() const
-{
-    return m_treeScope == TreeScope::nullInstance() ? 0 : m_treeScope;
-}
-
-inline void Node::setTreeScope(TreeScope* scope)
-{
-    m_treeScope = scope ? scope : TreeScope::nullInstance();
-    setFlag(!m_treeScope->isDocumentScope(), InShadowTree);
-}
-
-inline Document* Node::documentInternal() const
-{
-    if (getFlag(InShadowTree))
-        return m_treeScope->rootDocument();
-    return static_cast<Document*>(m_treeScope);
-}
-
-inline Document* Node::document() const
-{
-    Document* document = documentInternal();
-    // FIXME: below ASSERT is useful, but prevents the use of document() in the constructor or destructor
-    // due to the virtual function call to nodeType().
-    ASSERT(document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-    return document;
-}
-
 inline bool Node::isDocumentNode() const
 {
-    return this == documentInternal();
+    return this == m_document;
 }
 
 inline Node::Node(Document* document, ConstructionType type)
     : m_nodeFlags(type)
-    , m_treeScope(0)
+    , m_document(document)
     , m_previous(0)
     , m_next(0)
     , m_renderer(0)
 {
     if (document)
         document->guardRef();
-    setTreeScope(document);
 #if !defined(NDEBUG) || (defined(DUMP_NODE_STATISTICS) && DUMP_NODE_STATISTICS)
     trackForDebugging();
 #endif
diff --git a/Source/WebCore/dom/DocumentMarkerController.cpp b/Source/WebCore/dom/DocumentMarkerController.cpp
index 055107711..a3ebc9369 100644
--- a/Source/WebCore/dom/DocumentMarkerController.cpp
+++ b/Source/WebCore/dom/DocumentMarkerController.cpp
@@ -92,7 +92,7 @@ void DocumentMarkerController::addMarkerToNode(Node* node, unsigned startOffset,
 }
 
 
-void DocumentMarkerController::addTextMatchMarker(Range* range, bool activeMatch)
+void DocumentMarkerController::addTextMatchMarker(const Range* range, bool activeMatch)
 {
     // Use a TextIterator to visit the potentially multiple nodes the range covers.
     for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
diff --git a/Source/WebCore/dom/DocumentMarkerController.h b/Source/WebCore/dom/DocumentMarkerController.h
index 6a3724800..8dd2b04ff 100644
--- a/Source/WebCore/dom/DocumentMarkerController.h
+++ b/Source/WebCore/dom/DocumentMarkerController.h
@@ -50,7 +50,7 @@ public:
     void addMarker(Range*, DocumentMarker::MarkerType, const String& description);
     void addMarkerToNode(Node*, unsigned startOffset, unsigned length, DocumentMarker::MarkerType);
     void addMarkerToNode(Node*, unsigned startOffset, unsigned length, DocumentMarker::MarkerType, PassRefPtr<DocumentMarkerDetails>);
-    void addTextMatchMarker(Range*, bool activeMatch);
+    void addTextMatchMarker(const Range*, bool activeMatch);
 
     void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta);
     bool hasMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers());
diff --git a/Source/WebCore/dom/DocumentParser.h b/Source/WebCore/dom/DocumentParser.h
index 3d3f84ac0..4344780e3 100644
--- a/Source/WebCore/dom/DocumentParser.h
+++ b/Source/WebCore/dom/DocumentParser.h
@@ -97,7 +97,7 @@ public:
     virtual void resumeScheduledTasks();
 
 protected:
-    DocumentParser(Document*);
+    explicit DocumentParser(Document*);
 
 private:
     enum ParserState {
diff --git a/Source/WebCore/dom/DynamicNodeList.cpp b/Source/WebCore/dom/DynamicNodeList.cpp
index 96e0082cf..b6a87d41b 100644
--- a/Source/WebCore/dom/DynamicNodeList.cpp
+++ b/Source/WebCore/dom/DynamicNodeList.cpp
@@ -27,15 +27,34 @@
 #include "Element.h"
 #include "HTMLCollection.h"
 #include "HTMLPropertiesCollection.h"
+#include "PropertyNodeList.h"
 
 namespace WebCore {
 
+Node* DynamicNodeListCacheBase::rootNode() const
+{
+    if ((isRootedAtDocument() || ownerNodeHasItemRefAttribute()) && m_ownerNode->inDocument())
+        return m_ownerNode->document();
+    return m_ownerNode.get();
+}
+
+ALWAYS_INLINE bool DynamicNodeListCacheBase::ownerNodeHasItemRefAttribute() const
+{
+#if ENABLE(MICRODATA)
+    if (m_rootType == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
+        return toElement(ownerNode())->fastHasAttribute(HTMLNames::itemrefAttr);
+#endif
+
+    return false;
+}
+
 void DynamicNodeListCacheBase::invalidateCache() const
 {
     m_cachedItem = 0;
     m_isLengthCacheValid = false;
     m_isItemCacheValid = false;
     m_isNameCacheValid = false;
+    m_isItemRefElementsCacheValid = false;
     if (type() == NodeListCollectionType)
         return;
 
@@ -66,6 +85,11 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
     Node* rootNode = this->rootNode();
 
     if (rootNode->inDocument()) {
+#if ENABLE(MICRODATA)
+        if (rootType() == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
+            static_cast<const PropertyNodeList*>(this)->updateRefElements();
+#endif
+
         Element* element = rootNode->treeScope()->getElementById(elementId);
         if (element && nodeMatches(element) && element->isDescendantOf(rootNode))
             return element;
diff --git a/Source/WebCore/dom/DynamicNodeList.h b/Source/WebCore/dom/DynamicNodeList.h
index a5cd269b1..860e2269a 100644
--- a/Source/WebCore/dom/DynamicNodeList.h
+++ b/Source/WebCore/dom/DynamicNodeList.h
@@ -39,6 +39,7 @@ class Node;
 enum NodeListRootType {
     NodeListIsRootedAtNode,
     NodeListIsRootedAtDocument,
+    NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr,
 };
 
 class DynamicNodeListCacheBase {
@@ -54,20 +55,22 @@ public:
         , m_cachedItem(0)
         , m_isLengthCacheValid(false)
         , m_isItemCacheValid(false)
-        , m_rootedAtDocument(rootType == NodeListIsRootedAtDocument)
+        , m_rootType(rootType)
         , m_invalidationType(invalidationType)
         , m_shouldOnlyIncludeDirectChildren(shouldOnlyIncludeDirectChildren)
         , m_isNameCacheValid(false)
         , m_collectionType(collectionType)
         , m_overridesItemAfter(itemAfterOverrideType == OverridesItemAfter)
+        , m_isItemRefElementsCacheValid(false)
     {
+        ASSERT(m_rootType == static_cast<unsigned>(rootType));
         ASSERT(m_invalidationType == static_cast<unsigned>(invalidationType));
         ASSERT(m_collectionType == static_cast<unsigned>(collectionType));
         ASSERT(!m_overridesItemAfter || m_collectionType != NodeListCollectionType);
     }
 
 public:
-    ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootedAtDocument; }
+    ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootType == NodeListIsRootedAtDocument; }
     ALWAYS_INLINE NodeListInvalidationType invalidationType() const { return static_cast<NodeListInvalidationType>(m_invalidationType); }
     ALWAYS_INLINE CollectionType type() const { return static_cast<CollectionType>(m_collectionType); }
     Node* ownerNode() const { return m_ownerNode.get(); }
@@ -82,12 +85,7 @@ public:
 
 protected:
     Document* document() const { return m_ownerNode->document(); }
-    Node* rootNode() const
-    {
-        if (isRootedAtDocument() && m_ownerNode->inDocument())
-            return m_ownerNode->document();
-        return m_ownerNode.get();
-    }
+    Node* rootNode() const;
     bool overridesItemAfter() const { return m_overridesItemAfter; }
 
     ALWAYS_INLINE bool isItemCacheValid() const { return m_isItemCacheValid; }
@@ -111,6 +109,11 @@ protected:
     }
     void setItemCache(Node* item, unsigned offset, unsigned elementsArrayOffset) const;
 
+    ALWAYS_INLINE bool isItemRefElementsCacheValid() const { return m_isItemRefElementsCacheValid; }
+    ALWAYS_INLINE void setItemRefElementsCacheValid() const { m_isItemRefElementsCacheValid = true; }
+
+    ALWAYS_INLINE NodeListRootType rootType() const { return static_cast<NodeListRootType>(m_rootType); }
+
     bool hasNameCache() const { return m_isNameCacheValid; }
     void setHasNameCache() const { m_isNameCacheValid = true; }
 
@@ -126,6 +129,7 @@ private:
     template <bool forward> Node* iterateForNextNode(Node* current) const;
     template<bool forward> Node* itemBeforeOrAfter(Node* previousItem) const;    
     Node* itemBefore(Node* previousItem) const;
+    bool ownerNodeHasItemRefAttribute() const;
 
     RefPtr<Node> m_ownerNode;
     mutable Node* m_cachedItem;
@@ -133,7 +137,7 @@ private:
     mutable unsigned m_cachedItemOffset;
     mutable unsigned m_isLengthCacheValid : 1;
     mutable unsigned m_isItemCacheValid : 1;
-    const unsigned m_rootedAtDocument : 1;
+    const unsigned m_rootType : 2;
     const unsigned m_invalidationType : 4;
     const unsigned m_shouldOnlyIncludeDirectChildren : 1;
 
@@ -141,6 +145,7 @@ private:
     mutable unsigned m_isNameCacheValid : 1;
     const unsigned m_collectionType : 5;
     const unsigned m_overridesItemAfter : 1;
+    mutable unsigned m_isItemRefElementsCacheValid : 1;
 };
 
 ALWAYS_INLINE bool DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChange(NodeListInvalidationType type, const QualifiedName& attrName)
@@ -161,7 +166,7 @@ ALWAYS_INLINE bool DynamicNodeListCacheBase::shouldInvalidateTypeOnAttributeChan
         return attrName == HTMLNames::hrefAttr;
     case InvalidateOnItemAttrChange:
 #if ENABLE(MICRODATA)
-        return attrName == HTMLNames::itemscopeAttr || attrName == HTMLNames::itempropAttr || attrName == HTMLNames::itemtypeAttr;
+        return attrName == HTMLNames::itemscopeAttr || attrName == HTMLNames::itempropAttr || attrName == HTMLNames::itemtypeAttr || attrName == HTMLNames::itemrefAttr;
 #endif // Intentionally fall through
     case DoNotInvalidateOnAttributeChanges:
         return false;
@@ -181,6 +186,7 @@ public:
         RadioNodeListType,
         LabelsNodeListType,
         MicroDataItemListType,
+        PropertyNodeListType,
     };
     DynamicNodeList(PassRefPtr<Node> ownerNode, NodeListType type, NodeListRootType rootType, NodeListInvalidationType invalidationType)
         : DynamicNodeListCacheBase(ownerNode.get(), rootType, invalidationType, type == ChildNodeListType, NodeListCollectionType, DoesNotOverrideItemAfter)
diff --git a/Source/WebCore/dom/EventException.h b/Source/WebCore/dom/EventException.h
index cef3c3b72..71868260c 100644
--- a/Source/WebCore/dom/EventException.h
+++ b/Source/WebCore/dom/EventException.h
@@ -51,7 +51,7 @@ public:
     static bool initializeDescription(ExceptionCode, ExceptionCodeDescription*);
 
 private:
-    EventException(const ExceptionCodeDescription& description)
+    explicit EventException(const ExceptionCodeDescription& description)
         : ExceptionBase(description)
     {
     }
diff --git a/Source/WebCore/dom/EventListener.h b/Source/WebCore/dom/EventListener.h
index be7c8b57e..c3c2d6cbd 100644
--- a/Source/WebCore/dom/EventListener.h
+++ b/Source/WebCore/dom/EventListener.h
@@ -58,7 +58,7 @@ namespace WebCore {
         Type type() const { return m_type; }
 
     protected:
-        EventListener(Type type)
+        explicit EventListener(Type type)
             : m_type(type)
         {
         }
diff --git a/Source/WebCore/dom/ExceptionBase.h b/Source/WebCore/dom/ExceptionBase.h
index 88fed2d51..395227b55 100644
--- a/Source/WebCore/dom/ExceptionBase.h
+++ b/Source/WebCore/dom/ExceptionBase.h
@@ -47,7 +47,7 @@ public:
     String toString() const;
 
 protected:
-    ExceptionBase(const ExceptionCodeDescription&);
+    explicit ExceptionBase(const ExceptionCodeDescription&);
 
 private:
     unsigned short m_code;
diff --git a/Source/WebCore/dom/GenericEventQueue.h b/Source/WebCore/dom/GenericEventQueue.h
index f30439ff0..e795529e7 100644
--- a/Source/WebCore/dom/GenericEventQueue.h
+++ b/Source/WebCore/dom/GenericEventQueue.h
@@ -38,7 +38,7 @@ namespace WebCore {
 class GenericEventQueue : public EventQueue {
 
 public:
-    GenericEventQueue(EventTarget*);
+    explicit GenericEventQueue(EventTarget*);
     static PassOwnPtr<GenericEventQueue> create(EventTarget*);
     virtual ~GenericEventQueue();
 
diff --git a/Source/WebCore/dom/KeyboardEvent.h b/Source/WebCore/dom/KeyboardEvent.h
index abefe22ba..1537410be 100644
--- a/Source/WebCore/dom/KeyboardEvent.h
+++ b/Source/WebCore/dom/KeyboardEvent.h
@@ -37,7 +37,7 @@ namespace WebCore {
 #if PLATFORM(MAC)
     struct KeypressCommand {
         KeypressCommand() { }
-        KeypressCommand(const String& commandName) : commandName(commandName) { ASSERT(isASCIILower(commandName[0U])); }
+        explicit KeypressCommand(const String& commandName) : commandName(commandName) { ASSERT(isASCIILower(commandName[0U])); }
         KeypressCommand(const String& commandName, const String& text) : commandName(commandName), text(text) { ASSERT(commandName == "insertText:"); }
 
         String commandName; // Actually, a selector name - it may have a trailing colon, and a name that can be different from an editor command name.
diff --git a/Source/WebCore/dom/MemoryInstrumentation.h b/Source/WebCore/dom/MemoryInstrumentation.h
index 114f96e69..ea7fe2edf 100644
--- a/Source/WebCore/dom/MemoryInstrumentation.h
+++ b/Source/WebCore/dom/MemoryInstrumentation.h
@@ -143,7 +143,7 @@ private:
 
 class MemoryObjectInfo {
 public:
-    MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation)
+    explicit MemoryObjectInfo(MemoryInstrumentation* memoryInstrumentation)
         : m_memoryInstrumentation(memoryInstrumentation)
         , m_objectType(MemoryInstrumentation::Other)
         , m_objectSize(0)
@@ -157,12 +157,12 @@ public:
 private:
     template <typename T> friend class MemoryClassInfo;
 
-    template <typename T> void reportObjectInfo(const T*, MemoryInstrumentation::ObjectType objectType)
+    template <typename T> void reportObjectInfo(const T*, MemoryInstrumentation::ObjectType objectType, size_t extraObjectSize)
     {
         if (m_objectType != MemoryInstrumentation::Other)
             return;
         m_objectType = objectType;
-        m_objectSize = sizeof(T);
+        m_objectSize = sizeof(T) + extraObjectSize;
     }
 
     MemoryInstrumentation* m_memoryInstrumentation;
@@ -191,11 +191,11 @@ void MemoryInstrumentation::addInstrumentedMemberImpl(const T* const& object, Me
 template <typename T>
 class MemoryClassInfo {
 public:
-    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T* ptr, MemoryInstrumentation::ObjectType objectType)
+    MemoryClassInfo(MemoryObjectInfo* memoryObjectInfo, const T* ptr, MemoryInstrumentation::ObjectType objectType, size_t extraObjectSize = 0)
         : m_memoryObjectInfo(memoryObjectInfo)
         , m_memoryInstrumentation(memoryObjectInfo->memoryInstrumentation())
     {
-        m_memoryObjectInfo->reportObjectInfo(ptr, objectType);
+        m_memoryObjectInfo->reportObjectInfo(ptr, objectType, extraObjectSize);
         m_objectType = memoryObjectInfo->objectType();
     }
 
diff --git a/Source/WebCore/dom/MessageChannel.h b/Source/WebCore/dom/MessageChannel.h
index 8e3ef9fdf..3d6579bc5 100644
--- a/Source/WebCore/dom/MessageChannel.h
+++ b/Source/WebCore/dom/MessageChannel.h
@@ -45,7 +45,7 @@ namespace WebCore {
         MessagePort* port2() const { return m_port2.get(); }
 
     private:
-        MessageChannel(ScriptExecutionContext*);
+        explicit MessageChannel(ScriptExecutionContext*);
 
         RefPtr<MessagePort> m_port1;
         RefPtr<MessagePort> m_port2;
diff --git a/Source/WebCore/dom/MessagePort.h b/Source/WebCore/dom/MessagePort.h
index a75a0d6e6..882bd3a0c 100644
--- a/Source/WebCore/dom/MessagePort.h
+++ b/Source/WebCore/dom/MessagePort.h
@@ -109,7 +109,7 @@ namespace WebCore {
         bool isCloned() { return !m_entangledChannel; }
 
     private:
-        MessagePort(ScriptExecutionContext&);
+        explicit MessagePort(ScriptExecutionContext&);
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
diff --git a/Source/WebCore/dom/MessagePortChannel.h b/Source/WebCore/dom/MessagePortChannel.h
index 07668a4e2..344b85131 100644
--- a/Source/WebCore/dom/MessagePortChannel.h
+++ b/Source/WebCore/dom/MessagePortChannel.h
@@ -107,7 +107,7 @@ namespace WebCore {
         PlatformMessagePortChannel* channel() const { return m_channel.get(); }
 
     private:
-        MessagePortChannel(PassRefPtr<PlatformMessagePortChannel>);
+        explicit MessagePortChannel(PassRefPtr<PlatformMessagePortChannel>);
         RefPtr<PlatformMessagePortChannel> m_channel;
     };
 
diff --git a/Source/WebCore/dom/MutationObserver.h b/Source/WebCore/dom/MutationObserver.h
index 7fd372069..fadb378d1 100644
--- a/Source/WebCore/dom/MutationObserver.h
+++ b/Source/WebCore/dom/MutationObserver.h
@@ -90,7 +90,7 @@ public:
 private:
     struct ObserverLessThan;
 
-    MutationObserver(PassRefPtr<MutationCallback>);
+    explicit MutationObserver(PassRefPtr<MutationCallback>);
     void deliver();
 
     static bool validateOptions(MutationObserverOptions);
diff --git a/Source/WebCore/dom/NamedNodeMap.h b/Source/WebCore/dom/NamedNodeMap.h
index d42d52d23..dab6bf919 100644
--- a/Source/WebCore/dom/NamedNodeMap.h
+++ b/Source/WebCore/dom/NamedNodeMap.h
@@ -64,7 +64,7 @@ public:
     Element* element() const { return m_element; }
 
 private:
-    NamedNodeMap(Element* element)
+    explicit NamedNodeMap(Element* element)
         : m_element(element)
     {
         // Only supports NamedNodeMaps with Element associated, DocumentType.entities and DocumentType.notations are not supported yet.
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 6b622c764..2e3f41342 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -119,6 +119,7 @@
 
 #if ENABLE(MICRODATA)
 #include "HTMLPropertiesCollection.h"
+#include "PropertyNodeList.h"
 #endif
 
 using namespace std;
@@ -406,7 +407,7 @@ Node::~Node()
     if (renderer())
         detach();
 
-    Document* doc = documentInternal();
+    Document* doc = m_document;
     if (AXObjectCache::accessibilityEnabled() && doc && doc->axObjectCacheExists())
         doc->axObjectCache()->removeNodeForUse(this);
     
@@ -421,6 +422,41 @@ Node::~Node()
     InspectorCounters::decrementCounter(InspectorCounters::NodeCounter);
 }
 
+void Node::setDocument(Document* document)
+{
+    ASSERT(!inDocument() || m_document == document);
+    if (inDocument() || m_document == document)
+        return;
+
+    m_document = document;
+}
+
+NodeRareData* Node::setTreeScope(TreeScope* scope)
+{
+    if (!scope) {
+        if (hasRareData()) {
+            NodeRareData* data = rareData();
+            data->setTreeScope(0);
+            return data;
+        }
+
+        return 0;
+    }
+
+    NodeRareData* data = ensureRareData();
+    data->setTreeScope(scope);
+    return data;
+}
+
+TreeScope* Node::treeScope() const
+{
+    // FIXME: Using m_document directly is not good -> see comment with document() in the header file.
+    if (!hasRareData())
+        return m_document;
+    TreeScope* scope = rareData()->treeScope();
+    return scope ? scope : m_document;
+}
+
 NodeRareData* Node::rareData() const
 {
     ASSERT(hasRareData());
@@ -1440,6 +1476,11 @@ ContainerNode* Node::nonShadowBoundaryParentNode() const
     return parent && !parent->isShadowRoot() ? parent : 0;
 }
 
+bool Node::isInShadowTree() const
+{
+    return treeScope() != document();
+}
+
 Element* Node::parentOrHostElement() const
 {
     ContainerNode* parent = parentOrHostNode();
@@ -2732,6 +2773,10 @@ void Node::setItemType(const String& value)
     ensureRareData()->setItemType(value);
 }
 
+PassRefPtr<PropertyNodeList> Node::propertyNodeList(const String& name)
+{
+    return ensureRareData()->ensureNodeLists()->addCacheWithName<PropertyNodeList>(this, DynamicNodeList::PropertyNodeListType, name);
+}
 #endif
 
 // It's important not to inline removedLastRef, because we don't want to inline the code to
@@ -2756,7 +2801,7 @@ void Node::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     MemoryClassInfo<Node> info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
     info.visitBaseClass<TreeShared<Node, ContainerNode> >(this);
     info.visitBaseClass<ScriptWrappable>(this);
-    info.addInstrumentedMember(document());
+    info.addInstrumentedMember(m_document);
     info.addInstrumentedMember(m_next);
     info.addInstrumentedMember(m_previous);
 }
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 6252273ad..86a7d39ed 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -90,6 +90,7 @@ class TreeScope;
 
 #if ENABLE(MICRODATA)
 class HTMLPropertiesCollection;
+class PropertyNodeList;
 #endif
 
 typedef int ExceptionCode;
@@ -233,8 +234,7 @@ public:
 
     // Returns 0, a child of ShadowRoot, or a legacy shadow root.
     Node* nonBoundaryShadowTreeRootNode();
-    bool isInShadowTree() const { return getFlag(InShadowTree); }
-
+    bool isInShadowTree() const;
     // Node's parent, shadow tree host.
     ContainerNode* parentOrHostNode() const;
     Element* parentOrHostElement() const;
@@ -412,7 +412,14 @@ public:
 
     // Returns the document associated with this node. This method never returns NULL, except in the case 
     // of a DocumentType node that is not used with any Document yet. A Document node returns itself.
-    Document* document() const;
+    Document* document() const
+    {
+        ASSERT(this);
+        // FIXME: below ASSERT is useful, but prevents the use of document() in the constructor or destructor
+        // due to the virtual function call to nodeType().
+        ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
+        return m_document;
+    }
 
     TreeScope* treeScope() const;
 
@@ -420,7 +427,7 @@ public:
     // node tree, false otherwise.
     bool inDocument() const 
     { 
-        ASSERT(treeScope() || !getFlag(InDocumentFlag));
+        ASSERT(m_document || !getFlag(InDocumentFlag));
         return getFlag(InDocumentFlag);
     }
 
@@ -627,6 +634,7 @@ public:
     DOMSettableTokenList* itemProp();
     DOMSettableTokenList* itemRef();
     DOMSettableTokenList* itemType();
+    PassRefPtr<PropertyNodeList> propertyNodeList(const String&);
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
@@ -690,12 +698,10 @@ private:
 #endif
         InNamedFlowFlag = 1 << 26,
         HasAttrListFlag = 1 << 27,
-        HasCustomCallbacksFlag = 1 << 28,
-        InShadowTree = 1 << 29
-
+        HasCustomCallbacksFlag = 1 << 28
     };
 
-    // 3 bits remaining
+    // 4 bits remaining
 
     bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
     void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 
@@ -731,14 +737,16 @@ protected:
 
     void setHasCustomCallbacks() { setFlag(true, HasCustomCallbacksFlag); }
 
-    void setTreeScope(TreeScope*);
-    Document* documentInternal() const;
-
 private:
     friend class TreeShared<Node, ContainerNode>;
 
     void removedLastRef();
 
+    // These API should be only used for a tree scope migration.
+    // setTreeScope() returns NodeRareData to save extra nodeRareData() invocations on the caller site.
+    NodeRareData* setTreeScope(TreeScope*);
+    void setDocument(Document*);
+
     enum EditableLevel { Editable, RichlyEditable };
     bool rendererIsEditable(EditableLevel) const;
     bool isEditableToAccessibility(EditableLevel) const;
@@ -781,7 +789,7 @@ private:
 #endif
 
     mutable uint32_t m_nodeFlags;
-    TreeScope* m_treeScope;
+    Document* m_document;
     Node* m_previous;
     Node* m_next;
     RenderObject* m_renderer;
diff --git a/Source/WebCore/dom/NodeFilter.h b/Source/WebCore/dom/NodeFilter.h
index d6e47fbc3..e7e906ab2 100644
--- a/Source/WebCore/dom/NodeFilter.h
+++ b/Source/WebCore/dom/NodeFilter.h
@@ -84,7 +84,7 @@ namespace WebCore {
         void setCondition(PassRefPtr<NodeFilterCondition> condition) { ASSERT(!m_condition); m_condition = condition; }
 
     private:
-        NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
+        explicit NodeFilter(PassRefPtr<NodeFilterCondition> condition) : m_condition(condition) { }
         NodeFilter() {}
 
         RefPtr<NodeFilterCondition> m_condition;
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index b84a4b09f..0bdc3e8ac 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -184,7 +184,8 @@ class NodeRareData {
     WTF_MAKE_NONCOPYABLE(NodeRareData); WTF_MAKE_FAST_ALLOCATED;
 public:    
     NodeRareData()
-        : m_childNodeList(0)
+        : m_treeScope(0)
+        , m_childNodeList(0)
         , m_tabIndex(0)
         , m_tabIndexWasSetExplicitly(false)
         , m_isFocused(false)
@@ -212,6 +213,9 @@ public:
         return rareDataMap().get(node);
     }
 
+    TreeScope* treeScope() const { return m_treeScope; }
+    void setTreeScope(TreeScope* treeScope) { m_treeScope = treeScope; }
+    
     void clearNodeLists() { m_nodeLists.clear(); }
     void setNodeLists(PassOwnPtr<NodeListsNodeData> lists) { m_nodeLists = lists; }
     NodeListsNodeData* nodeLists() const { return m_nodeLists.get(); }
@@ -345,6 +349,7 @@ protected:
 
 private:
 
+    TreeScope* m_treeScope;
     OwnPtr<NodeListsNodeData> m_nodeLists;
     ChildNodeList* m_childNodeList;
     OwnPtr<EventTargetData> m_eventTargetData;
diff --git a/Source/WebCore/dom/NodeWithIndex.h b/Source/WebCore/dom/NodeWithIndex.h
index 9ad65663b..077b64047 100644
--- a/Source/WebCore/dom/NodeWithIndex.h
+++ b/Source/WebCore/dom/NodeWithIndex.h
@@ -34,7 +34,7 @@ namespace WebCore {
 // only want to walk the child list to figure out the index once.
 class NodeWithIndex {
 public:
-    NodeWithIndex(Node* node)
+    explicit NodeWithIndex(Node* node)
         : m_node(node)
         , m_haveIndex(false)
     {
diff --git a/Source/WebCore/dom/PropertyNodeList.cpp b/Source/WebCore/dom/PropertyNodeList.cpp
new file mode 100644
index 000000000..3d3c042ba
--- /dev/null
+++ b/Source/WebCore/dom/PropertyNodeList.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MICRODATA)
+#include "PropertyNodeList.h"
+
+#include "DOMSettableTokenList.h"
+#include "DOMStringList.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "NodeRareData.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+PropertyNodeList::PropertyNodeList(Node* rootNode, const String& name)
+    : DynamicSubtreeNodeList(rootNode, PropertyNodeListType, InvalidateOnItemAttrChange, NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
+    , m_name(name)
+{
+}
+
+PropertyNodeList::~PropertyNodeList()
+{
+    ownerNode()->nodeLists()->removeCacheWithName(this, DynamicNodeList::PropertyNodeListType, m_name);
+}
+
+bool PropertyNodeList::elementIsPropertyOfRefElement(const Node* testElement, const Node *refElement) const
+{
+    for (const ContainerNode* node = testElement->parentNode(); node; node = node->parentNode()) {
+        if (node->isHTMLElement() && toHTMLElement(node)->fastHasAttribute(itemscopeAttr) && node != ownerNode())
+            return false;
+
+        if (node == refElement)
+            return true;
+    }
+    return false;
+}
+
+void PropertyNodeList::updateRefElements() const
+{
+    if (isItemRefElementsCacheValid())
+        return;
+
+    m_itemRefElementsCache.clear();
+    setItemRefElementsCacheValid();
+    toHTMLElement(ownerNode())->getItemRefElements(m_itemRefElementsCache);
+}
+
+bool PropertyNodeList::nodeMatches(Element* testElement) const
+{
+    if (!testElement->isHTMLElement() || !testElement->fastHasAttribute(itempropAttr))
+        return false;
+
+    for (unsigned i = 0; i < m_itemRefElementsCache.size(); ++i) {
+        if (testElement == m_itemRefElementsCache[i] || elementIsPropertyOfRefElement(testElement, m_itemRefElementsCache[i])) {
+            if (testElement->itemProp()->tokens().contains(m_name))
+                return true;
+        }
+    }
+
+    return false;
+}
+
+PropertyValueArray PropertyNodeList::getValues() const
+{
+    PropertyValueArray propertyValue;
+
+    for (unsigned offset = 0; Node* node = item(offset); ++offset)
+        propertyValue.append(toHTMLElement(node)->itemValue());
+
+    return propertyValue;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MICRODATA)
diff --git a/Source/WebCore/dom/PropertyNodeList.h b/Source/WebCore/dom/PropertyNodeList.h
new file mode 100644
index 000000000..fa96a4148
--- /dev/null
+++ b/Source/WebCore/dom/PropertyNodeList.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PropertyNodeList_h
+#define PropertyNodeList_h
+
+#if ENABLE(MICRODATA)
+#include "DynamicNodeList.h"
+#include "MicroDataItemValue.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+typedef Vector<RefPtr<MicroDataItemValue> > PropertyValueArray;
+
+class PropertyNodeList : public DynamicSubtreeNodeList {
+public:
+    static PassRefPtr<PropertyNodeList> create(Node* rootNode, const String& name)
+    {
+        return adoptRef(new PropertyNodeList(rootNode, name));
+    }
+
+    ~PropertyNodeList();
+
+    PropertyValueArray getValues() const;
+    void updateRefElements() const;
+
+private:
+    explicit PropertyNodeList(Node* rootNode, const String& name);
+
+    virtual bool nodeMatches(Element*) const OVERRIDE;
+
+    bool elementIsPropertyOfRefElement(const Node*, const Node*) const;
+
+    String m_name;
+    mutable Vector<HTMLElement*> m_itemRefElementsCache;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MICRODATA)
+
+#endif // StaticNodeList_h
diff --git a/Source/WebCore/dom/PropertyNodeList.idl b/Source/WebCore/dom/PropertyNodeList.idl
new file mode 100644
index 000000000..97f5637b3
--- /dev/null
+++ b/Source/WebCore/dom/PropertyNodeList.idl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        Conditional=MICRODATA,
+        IndexedGetter,
+        JSGenerateToJSObject
+    ] PropertyNodeList : NodeList {
+
+        sequence<MicroDataItemValue> getValues();
+        Node item(in unsigned long index);
+
+        readonly attribute unsigned long length;
+    };
+}
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index d736ce53d..3a9fb48d8 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -1582,7 +1582,7 @@ Node* Range::pastLastNode() const
     return m_end.container()->traverseNextSibling();
 }
 
-IntRect Range::boundingBox()
+IntRect Range::boundingBox() const
 {
     IntRect result;
     Vector<IntRect> rects;
@@ -1593,7 +1593,7 @@ IntRect Range::boundingBox()
     return result;
 }
 
-void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed)
+void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed) const
 {
     Node* startContainer = m_start.container();
     Node* endContainer = m_end.container();
diff --git a/Source/WebCore/dom/Range.h b/Source/WebCore/dom/Range.h
index 8f0e98b47..b84bd6145 100644
--- a/Source/WebCore/dom/Range.h
+++ b/Source/WebCore/dom/Range.h
@@ -112,7 +112,7 @@ public:
 
     ShadowRoot* shadowRoot() const;
 
-    IntRect boundingBox();
+    IntRect boundingBox() const;
     
     enum RangeInFixedPosition {
         NotFixedPosition,
@@ -121,7 +121,7 @@ public:
     };
     
     // Not transform-friendly
-    void textRects(Vector<IntRect>&, bool useSelectionHeight = false, RangeInFixedPosition* = 0);
+    void textRects(Vector<IntRect>&, bool useSelectionHeight = false, RangeInFixedPosition* = 0) const;
     // Transform-friendly
     void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false, RangeInFixedPosition* = 0) const;
     void getBorderAndTextQuads(Vector<FloatQuad>&) const;
@@ -149,7 +149,7 @@ public:
 #endif
 
 private:
-    Range(PassRefPtr<Document>);
+    explicit Range(PassRefPtr<Document>);
     Range(PassRefPtr<Document>, PassRefPtr<Node> startContainer, int startOffset, PassRefPtr<Node> endContainer, int endOffset);
 
     void setDocument(Document*);
diff --git a/Source/WebCore/dom/RangeException.h b/Source/WebCore/dom/RangeException.h
index ea642d6b7..45f8c9375 100644
--- a/Source/WebCore/dom/RangeException.h
+++ b/Source/WebCore/dom/RangeException.h
@@ -47,7 +47,7 @@ public:
     static bool initializeDescription(ExceptionCode, ExceptionCodeDescription*);
 
 private:
-    RangeException(const ExceptionCodeDescription& description)
+    explicit RangeException(const ExceptionCodeDescription& description)
         : ExceptionBase(description)
     {
     }
diff --git a/Source/WebCore/dom/RawDataDocumentParser.h b/Source/WebCore/dom/RawDataDocumentParser.h
index 36bc6b38e..0500439ef 100644
--- a/Source/WebCore/dom/RawDataDocumentParser.h
+++ b/Source/WebCore/dom/RawDataDocumentParser.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class RawDataDocumentParser : public DocumentParser {
 protected:
-    RawDataDocumentParser(Document* document)
+    explicit RawDataDocumentParser(Document* document)
         : DocumentParser(document)
     {
     }
diff --git a/Source/WebCore/dom/ScriptRunner.h b/Source/WebCore/dom/ScriptRunner.h
index fe9718600..7be50f7c2 100644
--- a/Source/WebCore/dom/ScriptRunner.h
+++ b/Source/WebCore/dom/ScriptRunner.h
@@ -55,7 +55,7 @@ public:
     void notifyScriptReady(ScriptElement*, ExecutionType);
 
 private:
-    ScriptRunner(Document*);
+    explicit ScriptRunner(Document*);
 
     void timerFired(Timer<ScriptRunner>*);
 
diff --git a/Source/WebCore/dom/SelectorQuery.h b/Source/WebCore/dom/SelectorQuery.h
index 0bc7e9800..865a431f8 100644
--- a/Source/WebCore/dom/SelectorQuery.h
+++ b/Source/WebCore/dom/SelectorQuery.h
@@ -64,7 +64,7 @@ class SelectorQuery {
     WTF_MAKE_NONCOPYABLE(SelectorQuery);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    SelectorQuery(const CSSSelectorList&);
+    explicit SelectorQuery(const CSSSelectorList&);
     bool matches(Element*) const;
     PassRefPtr<NodeList> queryAll(Node* rootNode) const;
     PassRefPtr<Element> queryFirst(Node* rootNode) const;
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index b586687c1..67bb8618e 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -46,7 +46,7 @@ namespace WebCore {
 
 ShadowRoot::ShadowRoot(Document* document)
     : DocumentFragment(document, CreateShadowRoot)
-    , TreeScope(this, document)
+    , TreeScope(this)
     , m_prev(0)
     , m_next(0)
     , m_applyAuthorStyles(false)
@@ -55,9 +55,11 @@ ShadowRoot::ShadowRoot(Document* document)
 {
     ASSERT(document);
     
+    // Assume document as parent scope.
+    setParentTreeScope(document);
     // Shadow tree scopes have the scope pointer point to themselves.
     // This way, direct children will receive the correct scope pointer.
-    setTreeScope(this);
+    ensureRareData()->setTreeScope(this);
 }
 
 ShadowRoot::~ShadowRoot()
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 9c9fcd006..d9b425c60 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -94,7 +94,7 @@ public:
 #endif
 
 private:
-    ShadowRoot(Document*);
+    explicit ShadowRoot(Document*);
     virtual ~ShadowRoot();
     virtual String nodeName() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
diff --git a/Source/WebCore/dom/SpaceSplitString.h b/Source/WebCore/dom/SpaceSplitString.h
index 6c5037ddb..fced3ce13 100644
--- a/Source/WebCore/dom/SpaceSplitString.h
+++ b/Source/WebCore/dom/SpaceSplitString.h
@@ -54,8 +54,8 @@ namespace WebCore {
         const AtomicString& operator[](size_t i) { ASSERT(i < size()); return m_vector[i]; }
 
     private:
-        SpaceSplitStringData(const AtomicString&);
-        SpaceSplitStringData(const SpaceSplitStringData&);
+        explicit SpaceSplitStringData(const AtomicString&);
+        explicit SpaceSplitStringData(const SpaceSplitStringData&);
 
         void createVector(const String&);
 
diff --git a/Source/WebCore/dom/StaticHashSetNodeList.h b/Source/WebCore/dom/StaticHashSetNodeList.h
index e60bf4452..cb1093fad 100644
--- a/Source/WebCore/dom/StaticHashSetNodeList.h
+++ b/Source/WebCore/dom/StaticHashSetNodeList.h
@@ -60,7 +60,7 @@ public:
     virtual Node* itemWithName(const AtomicString&) const;
 
 private:
-    StaticHashSetNodeList(ListHashSet<RefPtr<Node> >& nodes);
+    explicit StaticHashSetNodeList(ListHashSet<RefPtr<Node> >& nodes);
 
     ListHashSet<RefPtr<Node> > m_nodes;
 };
diff --git a/Source/WebCore/dom/StaticNodeList.h b/Source/WebCore/dom/StaticNodeList.h
index 60fca1930..7d3fbf5b0 100644
--- a/Source/WebCore/dom/StaticNodeList.h
+++ b/Source/WebCore/dom/StaticNodeList.h
@@ -51,7 +51,7 @@ namespace WebCore {
         virtual Node* itemWithName(const AtomicString&) const;
 
     private:
-        StaticNodeList(Vector<RefPtr<Node> >& nodes)
+        explicit StaticNodeList(Vector<RefPtr<Node> >& nodes)
         {
             m_nodes.swap(nodes);
         }
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index a6733516d..d1265d93f 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -172,7 +172,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
         ensureAttributeData()->setClass(newClassString, shouldFoldCase);
         if (DOMTokenList* classList = optionalClassList())
             static_cast<ClassList*>(classList)->reset(newClassString);
-    } else
+    } else if (attributeData())
         attributeData()->clearClass();
     setNeedsStyleRecalc();
 }
diff --git a/Source/WebCore/dom/TransformSource.h b/Source/WebCore/dom/TransformSource.h
index 63dc78ae4..b1ad291ab 100644
--- a/Source/WebCore/dom/TransformSource.h
+++ b/Source/WebCore/dom/TransformSource.h
@@ -36,7 +36,7 @@ namespace WebCore {
     class TransformSource {
         WTF_MAKE_NONCOPYABLE(TransformSource); WTF_MAKE_FAST_ALLOCATED;
     public:
-        TransformSource(const PlatformTransformSource& source);
+        explicit TransformSource(const PlatformTransformSource&);
         ~TransformSource();
 
         PlatformTransformSource platformSource() const { return m_source; }
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index 032edf126..d3774aedb 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -52,22 +52,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-TreeScope::TreeScope(ContainerNode* rootNode, Document* rootDocument)
+TreeScope::TreeScope(ContainerNode* rootNode)
     : m_rootNode(rootNode)
-    , m_rootDocument(rootDocument)
-    , m_parentTreeScope(rootNode == rootDocument ? 0 : rootDocument)
+    , m_parentTreeScope(0)
     , m_idTargetObserverRegistry(IdTargetObserverRegistry::create())
 {
     ASSERT(rootNode);
 }
 
-TreeScope::TreeScope()
-    : m_rootNode(0)
-    , m_rootDocument(0)
-    , m_parentTreeScope(0)
-{
-}
-
 TreeScope::~TreeScope()
 {
     if (m_selection) {
@@ -90,7 +82,6 @@ void TreeScope::setParentTreeScope(TreeScope* newParentScope)
     ASSERT(newParentScope);
 
     m_parentTreeScope = newParentScope;
-    m_rootDocument = newParentScope->rootDocument();
 }
 
 Element* TreeScope::getElementById(const AtomicString& elementId) const
@@ -257,17 +248,12 @@ Node* TreeScope::focusedNode()
     return 0;
 }
 
-bool TreeScope::isDocumentScope() const
-{
-    return this == m_rootDocument;
-}
-
 static void listTreeScopes(Node* node, Vector<TreeScope*, 5>& treeScopes)
 {
     while (true) {
         treeScopes.append(node->treeScope());
-        Node* ancestor = node->shadowAncestorNode();
-        if (node == ancestor)
+        Element* ancestor = node->shadowHost();
+        if (!ancestor)
             break;
         node = ancestor;
     }
@@ -295,11 +281,5 @@ TreeScope* commonTreeScope(Node* nodeA, Node* nodeB)
     return treeScopesA[indexA] == treeScopesB[indexB] ? treeScopesA[indexA] : 0;
 }
 
-TreeScope* TreeScope::nullInstance()
-{
-    DEFINE_STATIC_LOCAL(TreeScope, instance, ());
-    return &instance;
-}
-
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
index f933c6f25..d9758b028 100644
--- a/Source/WebCore/dom/TreeScope.h
+++ b/Source/WebCore/dom/TreeScope.h
@@ -34,7 +34,6 @@ namespace WebCore {
 
 class ContainerNode;
 class DOMSelection;
-class Document;
 class Element;
 class HTMLMapElement;
 class IdTargetObserverRegistry;
@@ -79,23 +78,17 @@ public:
     void adoptIfNeeded(Node*);
 
     ContainerNode* rootNode() const { return m_rootNode; }
-    Document* rootDocument() const { return m_rootDocument; }
-    bool isDocumentScope() const;
-    IdTargetObserverRegistry& idTargetObserverRegistry() const { return *m_idTargetObserverRegistry.get(); }
 
-    static TreeScope* nullInstance();
+    IdTargetObserverRegistry& idTargetObserverRegistry() const { return *m_idTargetObserverRegistry.get(); }
 
 protected:
-    TreeScope(ContainerNode*, Document*);
+    explicit TreeScope(ContainerNode*);
     virtual ~TreeScope();
 
     void destroyTreeScopeData();
 
 private:
-    TreeScope();
-
     ContainerNode* m_rootNode;
-    Document* m_rootDocument;
     TreeScope* m_parentTreeScope;
 
     DocumentOrderedMap m_elementsById;
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index 1dfb5cef5..3601e0859 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -49,9 +49,7 @@ void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
         oldDocument->incDOMTreeVersion();
 
     for (Node* node = root; node; node = node->traverseNextNode(root)) {
-        node->setTreeScope(m_newScope);
-        if (node->hasRareData()) {
-            NodeRareData* rareData = node->rareData();
+        if (NodeRareData* rareData = node->setTreeScope(newDocument == m_newScope ? 0 : m_newScope)) {
             if (rareData->nodeLists())
                 rareData->nodeLists()->adoptTreeScope(oldDocument, newDocument);
             if (node->isElementNode())
@@ -98,6 +96,8 @@ inline void TreeScopeAdopter::moveNodeToNewDocument(Node* node, Document* oldDoc
     if (oldDocument)
         oldDocument->moveNodeIteratorsToNewDocument(node, newDocument);
 
+    node->setDocument(newDocument);
+
 #ifndef NDEBUG
     didMoveToNewDocumentWasCalled = false;
     oldDocumentDidMoveToNewDocumentWasCalledWith = oldDocument;
diff --git a/Source/WebCore/dom/WebKitNamedFlowCollection.h b/Source/WebCore/dom/WebKitNamedFlowCollection.h
index d952e8ed2..67878a71a 100644
--- a/Source/WebCore/dom/WebKitNamedFlowCollection.h
+++ b/Source/WebCore/dom/WebKitNamedFlowCollection.h
@@ -56,7 +56,7 @@ public:
     Document* document() const { return m_document; }
 
 private:
-    WebKitNamedFlowCollection(Document*);
+    explicit WebKitNamedFlowCollection(Document*);
 
     Document* m_document;
 
diff --git a/Source/WebCore/editing/AlternativeTextController.h b/Source/WebCore/editing/AlternativeTextController.h
index f6e6484d4..19334d690 100644
--- a/Source/WebCore/editing/AlternativeTextController.h
+++ b/Source/WebCore/editing/AlternativeTextController.h
@@ -94,7 +94,7 @@ class AlternativeTextController {
     WTF_MAKE_NONCOPYABLE(AlternativeTextController);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    AlternativeTextController(Frame*) UNLESS_ENABLED({ })
+    explicit AlternativeTextController(Frame*) UNLESS_ENABLED({ })
     ~AlternativeTextController() UNLESS_ENABLED({ })
 
     void startAlternativeTextUITimer(AlternativeTextType) UNLESS_ENABLED({ })
diff --git a/Source/WebCore/editing/BreakBlockquoteCommand.h b/Source/WebCore/editing/BreakBlockquoteCommand.h
index 885e5d6c8..6ebac549b 100644
--- a/Source/WebCore/editing/BreakBlockquoteCommand.h
+++ b/Source/WebCore/editing/BreakBlockquoteCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    BreakBlockquoteCommand(Document*);
+    explicit BreakBlockquoteCommand(Document*);
     virtual void doApply();
 };
 
diff --git a/Source/WebCore/editing/DeleteButton.h b/Source/WebCore/editing/DeleteButton.h
index af6c1f405..d50d75f6c 100644
--- a/Source/WebCore/editing/DeleteButton.h
+++ b/Source/WebCore/editing/DeleteButton.h
@@ -35,7 +35,7 @@ public:
     static PassRefPtr<DeleteButton> create(Document*);
 
 private:
-    DeleteButton(Document*);
+    explicit DeleteButton(Document*);
 
     virtual void defaultEventHandler(Event*);
 };
diff --git a/Source/WebCore/editing/DeleteButtonController.h b/Source/WebCore/editing/DeleteButtonController.h
index a7f7d1f35..f914fef64 100644
--- a/Source/WebCore/editing/DeleteButtonController.h
+++ b/Source/WebCore/editing/DeleteButtonController.h
@@ -39,7 +39,7 @@ class VisibleSelection;
 class DeleteButtonController {
     WTF_MAKE_NONCOPYABLE(DeleteButtonController); WTF_MAKE_FAST_ALLOCATED;
 public:
-    DeleteButtonController(Frame*);
+    explicit DeleteButtonController(Frame*);
 
     static const char* const containerElementIdentifier;
 
diff --git a/Source/WebCore/editing/EditCommand.h b/Source/WebCore/editing/EditCommand.h
index 142012b7c..048d82539 100644
--- a/Source/WebCore/editing/EditCommand.h
+++ b/Source/WebCore/editing/EditCommand.h
@@ -58,7 +58,7 @@ public:
     virtual void doApply() = 0;
 
 protected:
-    EditCommand(Document*);
+    explicit EditCommand(Document*);
     EditCommand(Document*, const VisibleSelection&, const VisibleSelection&);
 
     Document* document() const { return m_document.get(); }
@@ -83,7 +83,7 @@ public:
 #endif
 
 protected:
-    SimpleEditCommand(Document* document) : EditCommand(document) { }
+    explicit SimpleEditCommand(Document* document) : EditCommand(document) { }
 
 #ifndef NDEBUG
     void addNodeAndDescendants(Node*, HashSet<Node*>&);
diff --git a/Source/WebCore/editing/EditingBehavior.h b/Source/WebCore/editing/EditingBehavior.h
index bbf68f503..941430fa2 100644
--- a/Source/WebCore/editing/EditingBehavior.h
+++ b/Source/WebCore/editing/EditingBehavior.h
@@ -28,7 +28,7 @@ namespace WebCore {
 class EditingBehavior {
 
 public:
-    EditingBehavior(EditingBehaviorType type)
+    explicit EditingBehavior(EditingBehaviorType type)
         : m_type(type)
     {
     }
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 177c2a007..00e9d574a 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -150,8 +150,8 @@ private:
     EditingStyle();
     EditingStyle(Node*, PropertiesToInclude);
     EditingStyle(const Position&, PropertiesToInclude);
-    EditingStyle(const StylePropertySet*);
-    EditingStyle(const CSSStyleDeclaration*);
+    explicit EditingStyle(const StylePropertySet*);
+    explicit EditingStyle(const CSSStyleDeclaration*);
     EditingStyle(CSSPropertyID, const String& value);
     void init(Node*, PropertiesToInclude);
     void removeTextFillAndStrokeColorsIfNeeded(RenderStyle*);
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index c55555599..bdd382954 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -86,7 +86,7 @@ enum EditorParagraphSeparator { EditorParagraphSeparatorIsDiv, EditorParagraphSe
 
 class Editor : public FrameDestructionObserver {
 public:
-    Editor(Frame*);
+    explicit Editor(Frame*);
     ~Editor();
 
     EditorClient* client() const;
diff --git a/Source/WebCore/editing/FrameSelection.h b/Source/WebCore/editing/FrameSelection.h
index 11b6e4614..4a5819448 100644
--- a/Source/WebCore/editing/FrameSelection.h
+++ b/Source/WebCore/editing/FrameSelection.h
@@ -131,7 +131,7 @@ public:
         return static_cast<EUserTriggered>(options & UserTriggered);
     }
 
-    FrameSelection(Frame* = 0);
+    explicit FrameSelection(Frame* = 0);
 
     Element* rootEditableElement() const { return m_selection.rootEditableElement(); }
     Element* rootEditableElementOrDocumentElement() const;
diff --git a/Source/WebCore/editing/InsertLineBreakCommand.h b/Source/WebCore/editing/InsertLineBreakCommand.h
index 9e73add2d..f83fe0de7 100644
--- a/Source/WebCore/editing/InsertLineBreakCommand.h
+++ b/Source/WebCore/editing/InsertLineBreakCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    InsertLineBreakCommand(Document*);
+    explicit InsertLineBreakCommand(Document*);
 
     virtual void doApply();
 
diff --git a/Source/WebCore/editing/ModifySelectionListLevel.h b/Source/WebCore/editing/ModifySelectionListLevel.h
index feefa91b2..d486eae3d 100644
--- a/Source/WebCore/editing/ModifySelectionListLevel.h
+++ b/Source/WebCore/editing/ModifySelectionListLevel.h
@@ -35,7 +35,7 @@ namespace WebCore {
 // It is not used on its own.
 class ModifySelectionListLevelCommand : public CompositeEditCommand {
 protected:
-    ModifySelectionListLevelCommand(Document*);
+    explicit ModifySelectionListLevelCommand(Document*);
     
     void appendSiblingNodeRange(Node* startNode, Node* endNode, Element* newParent);
     void insertSiblingNodeRangeBefore(Node* startNode, Node* endNode, Node* refNode);
@@ -82,7 +82,7 @@ private:
         return adoptRef(new DecreaseSelectionListLevelCommand(document));
     }
 
-    DecreaseSelectionListLevelCommand(Document*);
+    explicit DecreaseSelectionListLevelCommand(Document*);
 
     virtual void doApply();
 };
diff --git a/Source/WebCore/editing/MoveSelectionCommand.cpp b/Source/WebCore/editing/MoveSelectionCommand.cpp
index 5bf545413..5a2143c63 100644
--- a/Source/WebCore/editing/MoveSelectionCommand.cpp
+++ b/Source/WebCore/editing/MoveSelectionCommand.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "MoveSelectionCommand.h"
 
-#include "Document.h"
 #include "DocumentFragment.h"
 #include "ReplaceSelectionCommand.h"
 
diff --git a/Source/WebCore/editing/RemoveFormatCommand.h b/Source/WebCore/editing/RemoveFormatCommand.h
index daca2dbdc..cd446a819 100644
--- a/Source/WebCore/editing/RemoveFormatCommand.h
+++ b/Source/WebCore/editing/RemoveFormatCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    RemoveFormatCommand(Document*);
+    explicit RemoveFormatCommand(Document*);
 
     virtual void doApply();
     virtual EditAction editingAction() const { return EditActionUnspecified; }
diff --git a/Source/WebCore/editing/RemoveNodeCommand.cpp b/Source/WebCore/editing/RemoveNodeCommand.cpp
index 8be207061..19657ac0f 100644
--- a/Source/WebCore/editing/RemoveNodeCommand.cpp
+++ b/Source/WebCore/editing/RemoveNodeCommand.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "RemoveNodeCommand.h"
 
-#include "Document.h"
 #include "Node.h"
 #include <wtf/Assertions.h>
 
diff --git a/Source/WebCore/editing/RemoveNodeCommand.h b/Source/WebCore/editing/RemoveNodeCommand.h
index 3eac0880d..fafb7ab3e 100644
--- a/Source/WebCore/editing/RemoveNodeCommand.h
+++ b/Source/WebCore/editing/RemoveNodeCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    RemoveNodeCommand(PassRefPtr<Node>);
+    explicit RemoveNodeCommand(PassRefPtr<Node>);
 
     virtual void doApply() OVERRIDE;
     virtual void doUnapply() OVERRIDE;
diff --git a/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp b/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
index 281fdbdf3..1452f8803 100644
--- a/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
+++ b/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "RemoveNodePreservingChildrenCommand.h"
 
-#include "Document.h"
 #include "Node.h"
 #include <wtf/Assertions.h>
 
diff --git a/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h b/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h
index d2b635f63..ba3c8200b 100644
--- a/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h
+++ b/Source/WebCore/editing/RemoveNodePreservingChildrenCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    RemoveNodePreservingChildrenCommand(PassRefPtr<Node>);
+    explicit RemoveNodePreservingChildrenCommand(PassRefPtr<Node>);
 
     virtual void doApply();
 
diff --git a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.h b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.h
index 0f1bf70aa..b05422a54 100644
--- a/Source/WebCore/editing/ReplaceNodeWithSpanCommand.h
+++ b/Source/WebCore/editing/ReplaceNodeWithSpanCommand.h
@@ -48,7 +48,7 @@ public:
     HTMLElement* spanElement() { return m_spanElement.get(); }
 
 private:
-    ReplaceNodeWithSpanCommand(PassRefPtr<HTMLElement>);
+    explicit ReplaceNodeWithSpanCommand(PassRefPtr<HTMLElement>);
 
     virtual void doApply() OVERRIDE;
     virtual void doUnapply() OVERRIDE;
diff --git a/Source/WebCore/editing/TextInsertionBaseCommand.h b/Source/WebCore/editing/TextInsertionBaseCommand.h
index 9dff6dc4e..2a33d2341 100644
--- a/Source/WebCore/editing/TextInsertionBaseCommand.h
+++ b/Source/WebCore/editing/TextInsertionBaseCommand.h
@@ -39,7 +39,7 @@ public:
     virtual ~TextInsertionBaseCommand() { };
 
 protected:
-    TextInsertionBaseCommand(Document*);
+    explicit TextInsertionBaseCommand(Document*);
     static void applyTextInsertionCommand(Frame*, PassRefPtr<TextInsertionBaseCommand>, const VisibleSelection& selectionForInsertion, const VisibleSelection& endingSelection);
 };
 
diff --git a/Source/WebCore/editing/UndoManager.h b/Source/WebCore/editing/UndoManager.h
index 5b6246806..56638cdfc 100644
--- a/Source/WebCore/editing/UndoManager.h
+++ b/Source/WebCore/editing/UndoManager.h
@@ -53,7 +53,7 @@ public:
     void clearRedo();
 
 private:
-    UndoManager(Node* host);
+    explicit UndoManager(Node* host);
     Node* m_undoScopeHost;
 };
     
diff --git a/Source/WebCore/editing/UnlinkCommand.h b/Source/WebCore/editing/UnlinkCommand.h
index f3d560fb4..8647ee8df 100644
--- a/Source/WebCore/editing/UnlinkCommand.h
+++ b/Source/WebCore/editing/UnlinkCommand.h
@@ -38,7 +38,7 @@ public:
     }
 
 private:
-    UnlinkCommand(Document*);
+    explicit UnlinkCommand(Document*);
 
     virtual void doApply();
     virtual EditAction editingAction() const { return EditActionUnlink; }
diff --git a/Source/WebCore/editing/WrapContentsInDummySpanCommand.h b/Source/WebCore/editing/WrapContentsInDummySpanCommand.h
index eccf0ec8c..f4d6bef69 100644
--- a/Source/WebCore/editing/WrapContentsInDummySpanCommand.h
+++ b/Source/WebCore/editing/WrapContentsInDummySpanCommand.h
@@ -40,7 +40,7 @@ public:
     }
 
 private:
-    WrapContentsInDummySpanCommand(PassRefPtr<Element>);
+    explicit WrapContentsInDummySpanCommand(PassRefPtr<Element>);
 
     virtual void doApply() OVERRIDE;
     virtual void doUnapply() OVERRIDE;
diff --git a/Source/WebCore/history/BackForwardListImpl.h b/Source/WebCore/history/BackForwardListImpl.h
index 0e5c26c93..167912af5 100644
--- a/Source/WebCore/history/BackForwardListImpl.h
+++ b/Source/WebCore/history/BackForwardListImpl.h
@@ -76,7 +76,7 @@ public:
     HistoryItemVector& entries();
 
 private:
-    BackForwardListImpl(Page*);
+    explicit BackForwardListImpl(Page*);
 
     virtual bool isActive() { return enabled() && capacity(); }
 
diff --git a/Source/WebCore/history/CachedFrame.h b/Source/WebCore/history/CachedFrame.h
index 02f866a12..a16f89323 100644
--- a/Source/WebCore/history/CachedFrame.h
+++ b/Source/WebCore/history/CachedFrame.h
@@ -94,7 +94,7 @@ public:
     int descendantFrameCount() const;
 
 private:
-    CachedFrame(Frame*);
+    explicit CachedFrame(Frame*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/history/HistoryItem.h b/Source/WebCore/history/HistoryItem.h
index 2ccf94eaf..ffe64fb43 100644
--- a/Source/WebCore/history/HistoryItem.h
+++ b/Source/WebCore/history/HistoryItem.h
@@ -223,7 +223,7 @@ private:
     HistoryItem(const String& urlString, const String& title, const String& alternateTitle, double lastVisited);
     HistoryItem(const KURL& url, const String& frameName, const String& parent, const String& title);
 
-    HistoryItem(const HistoryItem&);
+    explicit HistoryItem(const HistoryItem&);
 
     void padDailyCountsForNewVisit(double time);
     void collapseDailyVisitsToWeekly();
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 57953ac98..91e18a3fb 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -32,6 +32,7 @@
 
 #if ENABLE(MICRODATA)
 #include "HTMLPropertiesCollection.h"
+#include "PropertyNodeList.h"
 #endif
 
 #include <utility>
@@ -288,7 +289,7 @@ Node* DynamicNodeListCacheBase::itemBeforeOrAfter(Node* previous) const
     if (LIKELY(!!previous)) // Without this LIKELY, length() and item() can be 10% slower.
         current = nextNode<forward>(rootNode(), previous, shouldOnlyIncludeDirectChildren());
     else
-        current = firstNode(forward, rootNode(), previous);
+        current = firstNode(forward, rootNode(), shouldOnlyIncludeDirectChildren());
 
     if (type() == NodeListCollectionType && shouldOnlyIncludeDirectChildren()) // ChildNodeList
         return current;
@@ -368,6 +369,8 @@ Node* DynamicNodeListCacheBase::itemCommon(unsigned offset) const
 #if ENABLE(MICRODATA)
     if (type() == ItemProperties)
         static_cast<const HTMLPropertiesCollection*>(this)->updateRefElements();
+    if (type() == NodeListCollectionType && rootType() == NodeListIsRootedAtDocumentIfOwnerHasItemrefAttr)
+        static_cast<const PropertyNodeList*>(this)->updateRefElements();
 #endif
 
     if (isLengthCacheValid() && !overridesItemAfter() && isLastItemCloserThanLastOrCachedItem(offset)) {
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index c5b5073dc..8633f3fd4 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -31,6 +31,7 @@
 #include "CSSValueKeywords.h"
 #include "CSSValuePool.h"
 #include "ChildListMutationScope.h"
+#include "DOMSettableTokenList.h"
 #include "DocumentFragment.h"
 #include "Event.h"
 #include "EventListener.h"
@@ -993,6 +994,39 @@ PassRefPtr<HTMLPropertiesCollection> HTMLElement::properties()
 {
     return static_cast<HTMLPropertiesCollection*>(ensureCachedHTMLCollection(ItemProperties).get());
 }
+
+void HTMLElement::getItemRefElements(Vector<HTMLElement*>& itemRefElements)
+{
+    if (!fastHasAttribute(itemscopeAttr))
+        return;
+
+    if (!fastHasAttribute(itemrefAttr)) {
+        itemRefElements.append(this);
+        return;
+    }
+
+    DOMSettableTokenList* itemRefs = itemRef();
+    RefPtr<DOMSettableTokenList> processedItemRef = DOMSettableTokenList::create();
+    Node* rootNode = treeScope()->rootNode();
+
+    for (Node* current = rootNode->firstChild(); current; current = current->traverseNextNode(rootNode)) {
+        if (!current->isHTMLElement())
+            continue;
+        HTMLElement* element = toHTMLElement(current);
+
+        if (element == this) {
+            itemRefElements.append(element);
+            continue;
+        }
+
+        const AtomicString& id = element->getIdAttribute();
+        if (!processedItemRef->tokens().contains(id) && itemRefs->tokens().contains(id)) {
+            processedItemRef->setValue(id);
+            if (!element->isDescendantOf(this))
+                itemRefElements.append(element);
+        }
+    }
+}
 #endif
 
 void HTMLElement::addHTMLLengthToStyle(StylePropertySet* style, CSSPropertyID propertyID, const String& value)
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index a5fce0c05..51fb096d4 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -98,6 +98,7 @@ public:
     void setItemValue(const String&, ExceptionCode&);
     PassRefPtr<MicroDataItemValue> itemValue() const;
     PassRefPtr<HTMLPropertiesCollection> properties();
+    void getItemRefElements(Vector<HTMLElement*>&);
 #endif
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index f16271bcd..909ef7610 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -2557,6 +2557,11 @@ void HTMLMediaElement::webkitAddKey(const String& keySystem, PassRefPtr<Uint8Arr
         return;
     }
 
+    if (!key) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
     if (!key->length()) {
         ec = TYPE_MISMATCH_ERR;
         return;
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.cpp b/Source/WebCore/html/HTMLPropertiesCollection.cpp
index d86bf6c65..b67c4c16a 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.cpp
+++ b/Source/WebCore/html/HTMLPropertiesCollection.cpp
@@ -39,7 +39,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "Node.h"
-#include "StaticNodeList.h"
+#include "PropertyNodeList.h"
 
 namespace WebCore {
 
@@ -52,8 +52,6 @@ PassRefPtr<HTMLPropertiesCollection> HTMLPropertiesCollection::create(Node* item
 
 HTMLPropertiesCollection::HTMLPropertiesCollection(Node* itemNode)
     : HTMLCollection(itemNode, ItemProperties, OverridesItemAfter)
-    , m_hasPropertyNameCache(false)
-    , m_hasItemRefElements(false)
 {
 }
 
@@ -63,43 +61,12 @@ HTMLPropertiesCollection::~HTMLPropertiesCollection()
 
 void HTMLPropertiesCollection::updateRefElements() const
 {
-    if (m_hasItemRefElements)
+    if (isItemRefElementsCacheValid())
         return;
 
-    HTMLElement* baseElement = toHTMLElement(base());
-
     m_itemRefElements.clear();
-    m_hasItemRefElements = true;
-
-    if (!baseElement->fastHasAttribute(itemscopeAttr))
-        return;
-
-    if (!baseElement->fastHasAttribute(itemrefAttr)) {
-        m_itemRefElements.append(baseElement);
-        return;
-    }
-
-    DOMSettableTokenList* itemRef = baseElement->itemRef();
-    RefPtr<DOMSettableTokenList> processedItemRef = DOMSettableTokenList::create();
-    Node* rootNode = baseElement->treeScope()->rootNode();
-
-    for (Node* current = rootNode->firstChild(); current; current = current->traverseNextNode(rootNode)) {
-        if (!current->isHTMLElement())
-            continue;
-        HTMLElement* element = toHTMLElement(current);
-
-        if (element == baseElement) {
-            m_itemRefElements.append(element);
-            continue;
-        }
-
-        const AtomicString& id = element->getIdAttribute();
-        if (!processedItemRef->tokens().contains(id) && itemRef->tokens().contains(id)) {
-            processedItemRef->setValue(id);
-            if (!element->isDescendantOf(baseElement))
-                m_itemRefElements.append(element);
-        }
-    }
+    setItemRefElementsCacheValid();
+    toHTMLElement(base())->getItemRefElements(m_itemRefElements);
 }
 
 static Node* nextNodeWithProperty(Node* base, Node* node)
@@ -142,7 +109,7 @@ HTMLElement* HTMLPropertiesCollection::virtualItemAfter(HTMLElement* base, Eleme
 
 void HTMLPropertiesCollection::updateNameCache() const
 {
-    if (m_hasPropertyNameCache)
+    if (hasNameCache())
         return;
 
     updateRefElements();
@@ -156,7 +123,7 @@ void HTMLPropertiesCollection::updateNameCache() const
         }
     }
 
-    m_hasPropertyNameCache = true;
+    setHasNameCache();
 }
 
 PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
@@ -167,28 +134,16 @@ PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
     return m_propertyNames;
 }
 
-PassRefPtr<NodeList> HTMLPropertiesCollection::namedItem(const String& name) const
+PassRefPtr<PropertyNodeList> HTMLPropertiesCollection::namedItem(const String& name) const
 {
-    updateNameCache();
-
-    Vector<RefPtr<Node> > namedItems;
-    Vector<Element*>* propertyResults = m_propertyCache.get(AtomicString(name).impl());
-    for (unsigned i = 0; propertyResults && i < propertyResults->size(); ++i)
-        namedItems.append(propertyResults->at(i));
-
-    // FIXME: HTML5 specifies that this should return PropertyNodeList.
-    return namedItems.isEmpty() ? 0 : StaticNodeList::adopt(namedItems);
+    return base()->propertyNodeList(name);
 }
 
 bool HTMLPropertiesCollection::hasNamedItem(const AtomicString& name) const
 {
     updateNameCache();
-
-    if (Vector<Element*>* propertyCache = m_propertyCache.get(name.impl())) {
-        if (!propertyCache->isEmpty())
-            return true;
-    }
-
+    if (m_propertyNames)
+        return m_propertyNames->contains(name);
     return false;
 }
 
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.h b/Source/WebCore/html/HTMLPropertiesCollection.h
index 29a84ed71..ac3d3e238 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.h
+++ b/Source/WebCore/html/HTMLPropertiesCollection.h
@@ -39,6 +39,7 @@
 namespace WebCore {
 
 class DOMStringList;
+class PropertyNodeList;
 
 class HTMLPropertiesCollection : public HTMLCollection {
 public:
@@ -48,16 +49,13 @@ public:
     void updateRefElements() const;
 
     PassRefPtr<DOMStringList> names() const;
-    virtual PassRefPtr<NodeList> namedItem(const String&) const OVERRIDE;
+    virtual PassRefPtr<PropertyNodeList> namedItem(const String&) const OVERRIDE;
     virtual bool hasNamedItem(const AtomicString&) const OVERRIDE;
 
     void invalidateCache() const
     {
         m_itemRefElements.clear();
         m_propertyNames.clear();
-        m_propertyCache.clear();
-        m_hasPropertyNameCache = false;
-        m_hasItemRefElements = false;
     }
 
 private:
@@ -77,19 +75,10 @@ private:
 
         if (!m_propertyNames->contains(propertyName))
             m_propertyNames->append(propertyName);
-
-        Vector<Element*>* propertyResults = m_propertyCache.get(propertyName.impl());
-        if (!propertyResults || !propertyResults->contains(element))
-            append(m_propertyCache, propertyName, element);
     }
 
     mutable Vector<HTMLElement*> m_itemRefElements;
     mutable RefPtr<DOMStringList> m_propertyNames;
-    mutable NodeCacheMap m_propertyCache;
-
-    // FIXME: Move these variables to DynamicNodeListCacheBase for better bit packing.
-    mutable bool m_hasPropertyNameCache : 1;
-    mutable bool m_hasItemRefElements : 1;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.idl b/Source/WebCore/html/HTMLPropertiesCollection.idl
index d2c8e3127..760f53acf 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.idl
+++ b/Source/WebCore/html/HTMLPropertiesCollection.idl
@@ -40,8 +40,6 @@ module html {
         Node item(in unsigned long index);
 
         readonly attribute DOMStringList names;
-
-        // FIXME: HTML5 specifies that this should return PropertyNodeList.
-        NodeList namedItem(in DOMString name);
+        PropertyNodeList namedItem(in DOMString name);
     };
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index daf126cfb..74ff5e6d7 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -108,7 +108,7 @@ static bool isClickableControl(Node* node)
     Element* element = toElement(node);
     if (element->isFormControlElement())
         return true;
-    Element* host = toElement(element->shadowAncestorNode());
+    Element* host = element->shadowHost();
     return host && host->isFormControlElement();
 }
 
diff --git a/Source/WebCore/html/MediaController.cpp b/Source/WebCore/html/MediaController.cpp
index bba6f0310..39fd09d4c 100644
--- a/Source/WebCore/html/MediaController.cpp
+++ b/Source/WebCore/html/MediaController.cpp
@@ -47,10 +47,12 @@ MediaController::MediaController(ScriptExecutionContext* context)
     : m_paused(false)
     , m_defaultPlaybackRate(1)
     , m_volume(1)
+    , m_position(MediaPlayer::invalidTime())
     , m_muted(false)
     , m_readyState(HAVE_NOTHING)
     , m_playbackState(WAITING)
     , m_asyncEventTimer(this, &MediaController::asyncEventTimerFired)
+    , m_clearPositionTimer(this, &MediaController::clearPositionTimerFired)
     , m_closedCaptionsVisible(false)
     , m_clock(Clock::create())
     , m_scriptExecutionContext(context)
@@ -143,8 +145,13 @@ float MediaController::currentTime() const
     if (m_mediaElements.isEmpty())
         return 0;
 
-    // Some clocks may return times outside the range of [0..duration].
-    return max(0.0f, min(duration(), m_clock->currentTime()));
+    if (m_position == MediaPlayer::invalidTime()) {
+        // Some clocks may return times outside the range of [0..duration].
+        m_position = max(0.0f, min(duration(), m_clock->currentTime()));
+        m_clearPositionTimer.startOneShot(0);
+    }
+
+    return m_position;
 }
 
 void MediaController::setCurrentTime(float time, ExceptionCode& code)
@@ -493,6 +500,11 @@ void MediaController::asyncEventTimerFired(Timer<MediaController>*)
         dispatchEvent(pendingEvents[index].release(), ec);
 }
 
+void MediaController::clearPositionTimerFired(Timer<MediaController>*)
+{
+    m_position = MediaPlayer::invalidTime();
+}
+
 bool MediaController::hasAudio() const
 {
     for (size_t index = 0; index < m_mediaElements.size(); ++index) {
diff --git a/Source/WebCore/html/MediaController.h b/Source/WebCore/html/MediaController.h
index 686cd0938..d32b71279 100644
--- a/Source/WebCore/html/MediaController.h
+++ b/Source/WebCore/html/MediaController.h
@@ -123,6 +123,7 @@ private:
     void bringElementUpToSpeed(HTMLMediaElement*);
     void scheduleEvent(const AtomicString& eventName);
     void asyncEventTimerFired(Timer<MediaController>*);
+    void clearPositionTimerFired(Timer<MediaController>*);
     bool hasEnded() const;
 
     // EventTarget
@@ -140,11 +141,13 @@ private:
     bool m_paused;
     float m_defaultPlaybackRate;
     float m_volume;
+    mutable float m_position;
     bool m_muted;
     ReadyState m_readyState;
     PlaybackState m_playbackState;
     Vector<RefPtr<Event> > m_pendingEvents;
     Timer<MediaController> m_asyncEventTimer;
+    mutable Timer<MediaController> m_clearPositionTimer;
     String m_mediaGroup;
     bool m_closedCaptionsVisible;
     PassRefPtr<Clock> m_clock;
diff --git a/Source/WebCore/html/MicroDataItemValue.idl b/Source/WebCore/html/MicroDataItemValue.idl
new file mode 100644
index 000000000..5522b4fff
--- /dev/null
+++ b/Source/WebCore/html/MicroDataItemValue.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2012 Motorola Mobility, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation and/or
+ * other materials provided with the distribution.
+ *
+ * Neither the name of Motorola Mobility, Inc. nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=MICRODATA,
+        CustomToJSObject,
+        OmitConstructor
+    ] MicroDataItemValue {
+    };
+}
+
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 4dad74906..76f6be085 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -1334,7 +1334,7 @@ void WebGLRenderingContext::copyTexImage2D(GC3Denum target, GC3Dint level, GC3De
 {
     if (isContextLost())
         return;
-    if (!validateTexFuncParameters("copyTexImage2D", target, level, internalformat, width, height, border, internalformat, GraphicsContext3D::UNSIGNED_BYTE))
+    if (!validateTexFuncParameters("copyTexImage2D", NotTexSubImage2D, target, level, internalformat, width, height, border, internalformat, GraphicsContext3D::UNSIGNED_BYTE))
         return;
     if (!validateSettableTexFormat("copyTexImage2D", internalformat))
         return;
@@ -3503,7 +3503,7 @@ void WebGLRenderingContext::texImage2DBase(GC3Denum target, GC3Dint level, GC3De
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    if (!validateTexFuncParameters("texImage2D", target, level, internalformat, width, height, border, format, type))
+    if (!validateTexFuncParameters("texImage2D", NotTexSubImage2D, target, level, internalformat, width, height, border, format, type))
         return;
     WebGLTexture* tex = validateTextureBinding("texImage2D", target, true);
     if (!tex)
@@ -3748,7 +3748,7 @@ void WebGLRenderingContext::texSubImage2DBase(GC3Denum target, GC3Dint level, GC
     ec = 0;
     if (isContextLost())
         return;
-    if (!validateTexFuncParameters("texSubImage2D", target, level, format, width, height, 0, format, type))
+    if (!validateTexFuncParameters("texSubImage2D", TexSubImage2D, target, level, format, width, height, 0, format, type))
         return;
     if (!validateSize("texSubImage2D", xoffset, yoffset))
         return;
@@ -4855,6 +4855,7 @@ bool WebGLRenderingContext::validateTexFuncLevel(const char* functionName, GC3De
 }
 
 bool WebGLRenderingContext::validateTexFuncParameters(const char* functionName,
+                                                      TexFuncValidationFunctionType functionType,
                                                       GC3Denum target, GC3Dint level,
                                                       GC3Denum internalformat,
                                                       GC3Dsizei width, GC3Dsizei height, GC3Dint border,
@@ -4884,8 +4885,14 @@ bool WebGLRenderingContext::validateTexFuncParameters(const char* functionName,
     case GraphicsContext3D::TEXTURE_CUBE_MAP_NEGATIVE_Y:
     case GraphicsContext3D::TEXTURE_CUBE_MAP_POSITIVE_Z:
     case GraphicsContext3D::TEXTURE_CUBE_MAP_NEGATIVE_Z:
-        if (width != height || width > m_maxCubeMapTextureSize) {
-            synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "width != height or width or height out of range for cube map");
+        if (functionType != TexSubImage2D && width != height) {
+          synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "width != height for cube map");
+          return false;
+        }
+        // No need to check height here. For texImage width == height.
+        // For texSubImage that will be checked when checking yoffset + height is in range.
+        if (width > m_maxCubeMapTextureSize) {
+            synthesizeGLError(GraphicsContext3D::INVALID_VALUE, functionName, "width or height out of range for cube map");
             return false;
         }
         break;
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index e4c3f74cd..7270ec15f 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -582,9 +582,15 @@ public:
     // Generates GL error and returns false if level is invalid.
     bool validateTexFuncLevel(const char* functionName, GC3Denum target, GC3Dint level);
 
+    enum TexFuncValidationFunctionType {
+        NotTexSubImage2D,
+        TexSubImage2D,
+    };
+
     // Helper function to check input parameters for functions {copy}Tex{Sub}Image.
     // Generates GL error and returns false if parameters are invalid.
     bool validateTexFuncParameters(const char* functionName,
+                                   TexFuncValidationFunctionType,
                                    GC3Denum target, GC3Dint level,
                                    GC3Denum internalformat,
                                    GC3Dsizei width, GC3Dsizei height, GC3Dint border,
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index 9454f5fd9..cc8bc29d2 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -39,6 +39,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "HTMLScriptElement.h"
+#include "HTMLStackItem.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
@@ -192,33 +193,33 @@ void HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded()
         m_document->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
-void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken* token)
 {
     RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     attachLater(m_attachmentRoot, element);
-    m_openElements.pushHTMLHtmlElement(element);
+    m_openElements.pushHTMLHtmlElement(HTMLStackItem::create(element, token));
 
     executeQueuedTasks();
     element->insertedByParser();
     dispatchDocumentElementAvailableIfNeeded();
 }
 
-void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken& token, Element* element)
+void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken* token, Element* element)
 {
-    if (token.attributes().isEmpty())
+    if (token->attributes().isEmpty())
         return;
 
     ElementAttributeData* elementAttributeData = element->ensureAttributeData();
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        const Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        const Attribute& tokenAttribute = token->attributes().at(i);
         if (!elementAttributeData->getAttributeItem(tokenAttribute.name()))
             element->setAttribute(tokenAttribute.name(), tokenAttribute.value());
     }
 }
 
-void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken* token)
 {
     // Fragments do not have a root HTML element, so any additional HTML elements
     // encountered during fragment parsing should be ignored.
@@ -228,16 +229,16 @@ void HTMLConstructionSite::insertHTMLHtmlStartTagInBody(AtomicHTMLToken& token)
     mergeAttributesFromTokenIntoElement(token, m_openElements.htmlElement());
 }
 
-void HTMLConstructionSite::insertHTMLBodyStartTagInBody(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLBodyStartTagInBody(AtomicHTMLToken* token)
 {
     mergeAttributesFromTokenIntoElement(token, m_openElements.bodyElement());
 }
 
-void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertDoctype(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::DOCTYPE);
+    ASSERT(token->type() == HTMLTokenTypes::DOCTYPE);
 
-    RefPtr<DocumentType> doctype = DocumentType::create(m_document, token.name(), String::adopt(token.publicIdentifier()), String::adopt(token.systemIdentifier()));
+    RefPtr<DocumentType> doctype = DocumentType::create(m_document, token->name(), String::adopt(token->publicIdentifier()), String::adopt(token->systemIdentifier()));
     attachLater(m_attachmentRoot, doctype.release());
 
     // DOCTYPE nodes are only processed when parsing fragments w/o contextElements, which
@@ -249,7 +250,7 @@ void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
     if (m_isParsingFragment)
         return;
 
-    if (token.forceQuirks())
+    if (token->forceQuirks())
         m_document->setCompatibilityMode(Document::QuirksMode);
     else {
         // We need to actually add the Doctype node to the DOM.
@@ -258,61 +259,61 @@ void HTMLConstructionSite::insertDoctype(AtomicHTMLToken& token)
     }
 }
 
-void HTMLConstructionSite::insertComment(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertComment(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
-    attachLater(currentNode(), Comment::create(currentNode()->document(), token.comment()));
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
+    attachLater(currentNode(), Comment::create(currentNode()->document(), token->comment()));
 }
 
-void HTMLConstructionSite::insertCommentOnDocument(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertCommentOnDocument(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
-    attachLater(m_attachmentRoot, Comment::create(m_document, token.comment()));
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
+    attachLater(m_attachmentRoot, Comment::create(m_document, token->comment()));
 }
 
-void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertCommentOnHTMLHtmlElement(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
     ContainerNode* parent = m_openElements.rootNode();
-    attachLater(parent, Comment::create(parent->document(), token.comment()));
+    attachLater(parent, Comment::create(parent->document(), token->comment()));
 }
 
-void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken* token)
 {
     ASSERT(!shouldFosterParent());
     m_head = createHTMLElement(token);
     attachLater(currentNode(), m_head);
-    m_openElements.pushHTMLHeadElement(m_head);
+    m_openElements.pushHTMLHeadElement(HTMLStackItem::create(m_head, token));
 }
 
-void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLBodyElement(AtomicHTMLToken* token)
 {
     ASSERT(!shouldFosterParent());
     RefPtr<Element> body = createHTMLElement(token);
     attachLater(currentNode(), body);
-    m_openElements.pushHTMLBodyElement(body.release());
+    m_openElements.pushHTMLBodyElement(HTMLStackItem::create(body.release(), token));
 }
 
-void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken& token, bool isDemoted)
+void HTMLConstructionSite::insertHTMLFormElement(AtomicHTMLToken* token, bool isDemoted)
 {
     RefPtr<Element> element = createHTMLElement(token);
     ASSERT(element->hasTagName(formTag));
     m_form = static_pointer_cast<HTMLFormElement>(element.release());
     m_form->setDemoted(isDemoted);
     attachLater(currentNode(), m_form);
-    m_openElements.push(m_form);
+    m_openElements.push(HTMLStackItem::create(m_form, token));
 }
 
-void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertHTMLElement(AtomicHTMLToken* token)
 {
     RefPtr<Element> element = createHTMLElement(token);
     attachLater(currentNode(), element);
-    m_openElements.push(element.release());
+    m_openElements.push(HTMLStackItem::create(element.release(), token));
 }
 
-void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     // Normally HTMLElementStack is responsible for calling finishParsingChildren,
     // but self-closing elements are never in the element stack so the stack
     // doesn't get a chance to tell them that we're done parsing their children.
@@ -321,16 +322,16 @@ void HTMLConstructionSite::insertSelfClosingHTMLElement(AtomicHTMLToken& token)
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#acknowledge-self-closing-flag
 }
 
-void HTMLConstructionSite::insertFormattingElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertFormattingElement(AtomicHTMLToken* token)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#the-stack-of-open-elements
     // Possible active formatting elements include:
     // a, b, big, code, em, font, i, nobr, s, small, strike, strong, tt, and u.
     insertHTMLElement(token);
-    m_activeFormattingElements.append(currentElement());
+    m_activeFormattingElements.append(currentElementRecord()->stackItem());
 }
 
-void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
+void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken* token)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#already-started
     // http://html5.org/specs/dom-parsing.html#dom-range-createcontextualfragment
@@ -341,20 +342,20 @@ void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
     const bool alreadyStarted = m_isParsingFragment && parserInserted;
     RefPtr<HTMLScriptElement> element = HTMLScriptElement::create(scriptTag, currentNode()->document(), parserInserted, alreadyStarted);
     if (m_fragmentScriptingPermission != DisallowScriptingContent)
-        element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+        element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     attachLater(currentNode(), element);
-    m_openElements.push(element.release());
+    m_openElements.push(HTMLStackItem::create(element.release(), token));
 }
 
-void HTMLConstructionSite::insertForeignElement(AtomicHTMLToken& token, const AtomicString& namespaceURI)
+void HTMLConstructionSite::insertForeignElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     notImplemented(); // parseError when xmlns or xmlns:xlink are wrong.
 
     RefPtr<Element> element = createElement(token, namespaceURI);
-    attachLater(currentNode(), element, token.selfClosing());
-    if (!token.selfClosing())
-        m_openElements.push(element.release());
+    attachLater(currentNode(), element, token->selfClosing());
+    if (!token->selfClosing())
+        m_openElements.push(HTMLStackItem::create(element.release(), token, namespaceURI));
 }
 
 void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMode whitespaceMode)
@@ -398,48 +399,34 @@ void HTMLConstructionSite::insertTextNode(const String& characters, WhitespaceMo
     }
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken& token, const AtomicString& namespaceURI)
+PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
-    QualifiedName tagName(nullAtom, token.name(), namespaceURI);
+    QualifiedName tagName(nullAtom, token->name(), namespaceURI);
     RefPtr<Element> element = currentNode()->document()->createElement(tagName, true);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     return element.release();
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken& token)
+PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken* token)
 {
-    QualifiedName tagName(nullAtom, token.name(), xhtmlNamespaceURI);
+    QualifiedName tagName(nullAtom, token->name(), xhtmlNamespaceURI);
     // FIXME: This can't use HTMLConstructionSite::createElement because we
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
     RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, currentNode()->document(), form(), true);
-    element->parserSetAttributes(token.attributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token->attributes(), m_fragmentScriptingPermission);
     ASSERT(element->isHTMLElement());
     return element.release();
 }
 
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromElementRecord(HTMLElementStack::ElementRecord* record)
+PassRefPtr<HTMLStackItem> HTMLConstructionSite::createElementFromSavedToken(HTMLStackItem* item)
 {
-    return createHTMLElementFromSavedElement(record->element());
-}
-
-PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromSavedElement(Element* element)
-{
-    // FIXME: This method is wrong.  We should be using the original token.
-    // Using an Element* causes us to fail examples like this:
-    // <b id="1"><p><script>document.getElementById("1").id = "2"</script></p>TEXT</b>
-    // When reconstructTheActiveFormattingElements calls this method to open
-    // a second <b> tag to wrap TEXT, it will have id "2", even though the HTML5
-    // spec implies it should be "1".  Minefield matches the HTML5 spec here.
-
-    ASSERT(element->isHTMLElement()); // otherwise localName() might be wrong.
-
-    Vector<Attribute> clonedAttributes;
-    if (ElementAttributeData* attributeData = element->updatedAttributeData())
-        clonedAttributes = attributeData->clonedAttributeVector();
-
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, element->localName(), clonedAttributes);
-    return createHTMLElement(fakeToken);
+    RefPtr<Element> element;
+    if (item->namespaceURI() == HTMLNames::xhtmlNamespaceURI)
+        element = createHTMLElement(item->token());
+    else
+        element = createElement(item->token(), item->namespaceURI());
+    return HTMLStackItem::create(element.release(), item->token(), item->namespaceURI());
 }
 
 bool HTMLConstructionSite::indexOfFirstUnopenFormattingElement(unsigned& firstUnopenElementIndex) const
@@ -469,10 +456,10 @@ void HTMLConstructionSite::reconstructTheActiveFormattingElements()
     ASSERT(unopenEntryIndex < m_activeFormattingElements.size());
     for (; unopenEntryIndex < m_activeFormattingElements.size(); ++unopenEntryIndex) {
         HTMLFormattingElementList::Entry& unopenedEntry = m_activeFormattingElements.at(unopenEntryIndex);
-        RefPtr<Element> reconstructed = createHTMLElementFromSavedElement(unopenedEntry.element());
-        attachLater(currentNode(), reconstructed);
-        m_openElements.push(reconstructed.release());
-        unopenedEntry.replaceElement(currentElement());
+        RefPtr<HTMLStackItem> reconstructed = createElementFromSavedToken(unopenedEntry.stackItem().get());
+        attachLater(currentNode(), reconstructed->node());
+        m_openElements.push(reconstructed);
+        unopenedEntry.replaceElement(reconstructed.release());
     }
 }
 
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.h b/Source/WebCore/html/parser/HTMLConstructionSite.h
index 367c0fe26..a43668b1a 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.h
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.h
@@ -87,26 +87,26 @@ public:
     void detach();
     void executeQueuedTasks();
 
-    void insertDoctype(AtomicHTMLToken&);
-    void insertComment(AtomicHTMLToken&);
-    void insertCommentOnDocument(AtomicHTMLToken&);
-    void insertCommentOnHTMLHtmlElement(AtomicHTMLToken&);
-    void insertHTMLElement(AtomicHTMLToken&);
-    void insertSelfClosingHTMLElement(AtomicHTMLToken&);
-    void insertFormattingElement(AtomicHTMLToken&);
-    void insertHTMLHeadElement(AtomicHTMLToken&);
-    void insertHTMLBodyElement(AtomicHTMLToken&);
-    void insertHTMLFormElement(AtomicHTMLToken&, bool isDemoted = false);
-    void insertScriptElement(AtomicHTMLToken&);
+    void insertDoctype(AtomicHTMLToken*);
+    void insertComment(AtomicHTMLToken*);
+    void insertCommentOnDocument(AtomicHTMLToken*);
+    void insertCommentOnHTMLHtmlElement(AtomicHTMLToken*);
+    void insertHTMLElement(AtomicHTMLToken*);
+    void insertSelfClosingHTMLElement(AtomicHTMLToken*);
+    void insertFormattingElement(AtomicHTMLToken*);
+    void insertHTMLHeadElement(AtomicHTMLToken*);
+    void insertHTMLBodyElement(AtomicHTMLToken*);
+    void insertHTMLFormElement(AtomicHTMLToken*, bool isDemoted = false);
+    void insertScriptElement(AtomicHTMLToken*);
     void insertTextNode(const String&, WhitespaceMode = WhitespaceUnknown);
-    void insertForeignElement(AtomicHTMLToken&, const AtomicString& namespaceURI);
+    void insertForeignElement(AtomicHTMLToken*, const AtomicString& namespaceURI);
 
-    void insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken&);
-    void insertHTMLHtmlStartTagInBody(AtomicHTMLToken&);
-    void insertHTMLBodyStartTagInBody(AtomicHTMLToken&);
+    void insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken*);
+    void insertHTMLHtmlStartTagInBody(AtomicHTMLToken*);
+    void insertHTMLBodyStartTagInBody(AtomicHTMLToken*);
 
-    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken&);
-    PassRefPtr<Element> createHTMLElementFromElementRecord(HTMLElementStack::ElementRecord*);
+    PassRefPtr<Element> createHTMLElement(AtomicHTMLToken*);
+    PassRefPtr<HTMLStackItem> createElementFromSavedToken(HTMLStackItem*);
 
     bool shouldFosterParent() const;
     void fosterParent(PassRefPtr<Node>);
@@ -118,6 +118,7 @@ public:
     void generateImpliedEndTagsWithExclusion(const AtomicString& tagName);
 
     bool isEmpty() const { return !m_openElements.stackDepth(); }
+    HTMLElementStack::ElementRecord* currentElementRecord() const { return m_openElements.topRecord(); }
     Element* currentElement() const { return m_openElements.top(); }
     ContainerNode* currentNode() const { return m_openElements.topNode(); }
     Element* oneBelowTop() const { return m_openElements.oneBelowTop(); }
@@ -160,10 +161,9 @@ private:
 
     void findFosterSite(HTMLConstructionSiteTask&);
 
-    PassRefPtr<Element> createHTMLElementFromSavedElement(Element*);
-    PassRefPtr<Element> createElement(AtomicHTMLToken&, const AtomicString& namespaceURI);
+    PassRefPtr<Element> createElement(AtomicHTMLToken*, const AtomicString& namespaceURI);
 
-    void mergeAttributesFromTokenIntoElement(AtomicHTMLToken&, Element*);
+    void mergeAttributesFromTokenIntoElement(AtomicHTMLToken*, Element*);
     void dispatchDocumentElementAvailableIfNeeded();
 
     Document* m_document;
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index cd5d08a55..7acab9ae7 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -125,23 +125,23 @@ inline bool isSelectScopeMarker(ContainerNode* node)
 
 }
 
-HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<ContainerNode> node, PassOwnPtr<ElementRecord> next)
-    : m_node(node)
+HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<HTMLStackItem> item, PassOwnPtr<ElementRecord> next)
+    : m_item(item)
     , m_next(next)
 {
-    ASSERT(m_node);
+    ASSERT(m_item);
 }
 
 HTMLElementStack::ElementRecord::~ElementRecord()
 {
 }
 
-void HTMLElementStack::ElementRecord::replaceElement(PassRefPtr<Element> element)
+void HTMLElementStack::ElementRecord::replaceElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element);
-    ASSERT(!m_node || m_node->isElementNode());
+    ASSERT(item);
+    ASSERT(!m_item || m_item->node()->isElementNode());
     // FIXME: Should this call finishParsingChildren?
-    m_node = element;
+    m_item = item;
 }
 
 bool HTMLElementStack::ElementRecord::isAbove(ElementRecord* other) const
@@ -307,62 +307,62 @@ void HTMLElementStack::popUntilForeignContentScopeMarker()
         pop();
 }
     
-void HTMLElementStack::pushRootNode(PassRefPtr<ContainerNode> rootNode)
+void HTMLElementStack::pushRootNode(PassRefPtr<HTMLStackItem> rootItem)
 {
-    ASSERT(rootNode->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
-    pushRootNodeCommon(rootNode);
+    ASSERT(rootItem->node()->nodeType() == Node::DOCUMENT_FRAGMENT_NODE);
+    pushRootNodeCommon(rootItem);
 }
 
-void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::htmlTag));
-    pushRootNodeCommon(element);
+    ASSERT(item->element()->hasTagName(HTMLNames::htmlTag));
+    pushRootNodeCommon(item);
 }
     
-void HTMLElementStack::pushRootNodeCommon(PassRefPtr<ContainerNode> rootNode)
+void HTMLElementStack::pushRootNodeCommon(PassRefPtr<HTMLStackItem> rootItem)
 {
     ASSERT(!m_top);
     ASSERT(!m_rootNode);
-    m_rootNode = rootNode.get();
-    pushCommon(rootNode);
+    m_rootNode = rootItem->node();
+    pushCommon(rootItem);
 }
 
-void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::headTag));
+    ASSERT(item->element()->hasTagName(HTMLNames::headTag));
     ASSERT(!m_headElement);
-    m_headElement = element.get();
-    pushCommon(element);
+    m_headElement = item->element();
+    pushCommon(item);
 }
 
-void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<Element> element)
+void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(!m_bodyElement);
-    m_bodyElement = element.get();
-    pushCommon(element);
+    m_bodyElement = item->element();
+    pushCommon(item);
 }
 
-void HTMLElementStack::push(PassRefPtr<Element> element)
+void HTMLElementStack::push(PassRefPtr<HTMLStackItem> item)
 {
-    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!element->hasTagName(HTMLNames::headTag));
-    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
-    pushCommon(element);
+    pushCommon(item);
 }
 
-void HTMLElementStack::insertAbove(PassRefPtr<Element> element, ElementRecord* recordBelow)
+void HTMLElementStack::insertAbove(PassRefPtr<HTMLStackItem> item, ElementRecord* recordBelow)
 {
-    ASSERT(element);
+    ASSERT(item);
     ASSERT(recordBelow);
     ASSERT(m_top);
-    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
-    ASSERT(!element->hasTagName(HTMLNames::headTag));
-    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::headTag));
+    ASSERT(!item->element()->hasTagName(HTMLNames::bodyTag));
     ASSERT(m_rootNode);
     if (recordBelow == m_top) {
-        push(element);
+        push(item);
         return;
     }
 
@@ -371,7 +371,7 @@ void HTMLElementStack::insertAbove(PassRefPtr<Element> element, ElementRecord* r
             continue;
 
         m_stackDepth++;
-        recordAbove->setNext(adoptPtr(new ElementRecord(element, recordAbove->releaseNext())));
+        recordAbove->setNext(adoptPtr(new ElementRecord(item, recordAbove->releaseNext())));
         recordAbove->next()->element()->beginParsingChildren();
         return;
     }
@@ -567,12 +567,12 @@ ContainerNode* HTMLElementStack::rootNode() const
     return m_rootNode;
 }
 
-void HTMLElementStack::pushCommon(PassRefPtr<ContainerNode> node)
+void HTMLElementStack::pushCommon(PassRefPtr<HTMLStackItem> item)
 {
     ASSERT(m_rootNode);
 
     m_stackDepth++;
-    m_top = adoptPtr(new ElementRecord(node, m_top.release()));
+    m_top = adoptPtr(new ElementRecord(item, m_top.release()));
 }
 
 void HTMLElementStack::popCommon()
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index f7baa3644..6e3125130 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -29,6 +29,7 @@
 
 #include "Element.h"
 #include "HTMLNames.h"
+#include "HTMLStackItem.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -55,23 +56,23 @@ public:
     public:
         ~ElementRecord(); // Public for ~PassOwnPtr()
     
-        Element* element() const { return toElement(m_node.get()); }
-        ContainerNode* node() const { return m_node.get(); }
-        void replaceElement(PassRefPtr<Element>);
+        Element* element() const { return m_item->element(); }
+        ContainerNode* node() const { return m_item->node(); }
+        PassRefPtr<HTMLStackItem> stackItem() const { return m_item; }
+        void replaceElement(PassRefPtr<HTMLStackItem>);
 
         bool isAbove(ElementRecord*) const;
 
         ElementRecord* next() const { return m_next.get(); }
-
     private:
         friend class HTMLElementStack;
 
-        ElementRecord(PassRefPtr<ContainerNode>, PassOwnPtr<ElementRecord>);
+        ElementRecord(PassRefPtr<HTMLStackItem>, PassOwnPtr<ElementRecord>);
 
         PassOwnPtr<ElementRecord> releaseNext() { return m_next.release(); }
         void setNext(PassOwnPtr<ElementRecord> next) { m_next = next; }
 
-        RefPtr<ContainerNode> m_node;
+        RefPtr<HTMLStackItem> m_item;
         OwnPtr<ElementRecord> m_next;
     };
 
@@ -97,13 +98,13 @@ public:
     ElementRecord* find(Element*) const;
     ElementRecord* topmost(const AtomicString& tagName) const;
 
-    void insertAbove(PassRefPtr<Element>, ElementRecord*);
+    void insertAbove(PassRefPtr<HTMLStackItem>, ElementRecord*);
 
-    void push(PassRefPtr<Element>);
-    void pushRootNode(PassRefPtr<ContainerNode>);
-    void pushHTMLHtmlElement(PassRefPtr<Element>);
-    void pushHTMLHeadElement(PassRefPtr<Element>);
-    void pushHTMLBodyElement(PassRefPtr<Element>);
+    void push(PassRefPtr<HTMLStackItem>);
+    void pushRootNode(PassRefPtr<HTMLStackItem>);
+    void pushHTMLHtmlElement(PassRefPtr<HTMLStackItem>);
+    void pushHTMLHeadElement(PassRefPtr<HTMLStackItem>);
+    void pushHTMLBodyElement(PassRefPtr<HTMLStackItem>);
 
     void pop();
     void popUntil(const AtomicString& tagName);
@@ -156,8 +157,8 @@ public:
 #endif
 
 private:
-    void pushCommon(PassRefPtr<ContainerNode>);
-    void pushRootNodeCommon(PassRefPtr<ContainerNode>);
+    void pushCommon(PassRefPtr<HTMLStackItem>);
+    void pushRootNodeCommon(PassRefPtr<HTMLStackItem>);
     void popCommon();
     void removeNonTopCommon(Element*);
 
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
index 0145de0e6..b42cebd6b 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.cpp
@@ -87,25 +87,25 @@ HTMLFormattingElementList::Bookmark HTMLFormattingElementList::bookmarkFor(Eleme
     return Bookmark(&at(index));
 }
 
-void HTMLFormattingElementList::swapTo(Element* oldElement, Element* newElement, const Bookmark& bookmark)
+void HTMLFormattingElementList::swapTo(Element* oldElement, PassRefPtr<HTMLStackItem> newItem, const Bookmark& bookmark)
 {
     ASSERT(contains(oldElement));
-    ASSERT(!contains(newElement));
+    ASSERT(!contains(newItem->element()));
     if (!bookmark.hasBeenMoved()) {
         ASSERT(bookmark.mark()->element() == oldElement);
-        bookmark.mark()->replaceElement(newElement);
+        bookmark.mark()->replaceElement(newItem);
         return;
     }
     size_t index = bookmark.mark() - first();
     ASSERT(index < size());
-    m_entries.insert(index + 1, newElement);
+    m_entries.insert(index + 1, newItem);
     remove(oldElement);
 }
 
-void HTMLFormattingElementList::append(Element* element)
+void HTMLFormattingElementList::append(PassRefPtr<HTMLStackItem> item)
 {
-    ensureNoahsArkCondition(element);
-    m_entries.append(element);
+    ensureNoahsArkCondition(item->element());
+    m_entries.append(item);
 }
 
 void HTMLFormattingElementList::remove(Element* element)
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.h b/Source/WebCore/html/parser/HTMLFormattingElementList.h
index 79fe2ff37..9f3545d25 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.h
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.h
@@ -26,6 +26,7 @@
 #ifndef HTMLFormattingElementList_h
 #define HTMLFormattingElementList_h
 
+#include "HTMLStackItem.h"
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -47,35 +48,35 @@ public:
     class Entry {
     public:
         // Inline because they're hot and Vector<T> uses them.
-        explicit Entry(Element* element)
-            : m_element(element)
+        explicit Entry(PassRefPtr<HTMLStackItem> item)
+            : m_item(item)
         {
-            ASSERT(element);
         }
         enum MarkerEntryType { MarkerEntry };
         Entry(MarkerEntryType)
-            : m_element(0)
+            : m_item(0)
         {
         }
         ~Entry() {}
 
-        bool isMarker() const { return !m_element; }
+        bool isMarker() const { return !m_item; }
 
+        PassRefPtr<HTMLStackItem> stackItem() const { return m_item; }
         Element* element() const
         {
-            // The fact that !m_element == isMarker() is an implementation detail
+            // The fact that !m_item == isMarker() is an implementation detail
             // callers should check isMarker() before calling element().
-            ASSERT(m_element);
-            return m_element.get();
+            ASSERT(m_item);
+            return m_item->element();
         }
-        void replaceElement(PassRefPtr<Element> element) { m_element = element; }
+        void replaceElement(PassRefPtr<HTMLStackItem> item) { m_item = item; }
 
         // Needed for use with Vector.  These are super-hot and must be inline.
-        bool operator==(Element* element) const { return m_element == element; }
-        bool operator!=(Element* element) const { return m_element != element; }
+        bool operator==(Element* element) const { return !m_item ? !element : m_item->element() == element; }
+        bool operator!=(Element* element) const { return !m_item ? !!element : m_item->element() != element; }
 
     private:
-        RefPtr<Element> m_element;
+        RefPtr<HTMLStackItem> m_item;
     };
 
     class Bookmark {
@@ -107,11 +108,11 @@ public:
 
     Entry* find(Element*);
     bool contains(Element*);
-    void append(Element*);
+    void append(PassRefPtr<HTMLStackItem>);
     void remove(Element*);
 
     Bookmark bookmarkFor(Element*);
-    void swapTo(Element* oldElement, Element* newElement, const Bookmark&);
+    void swapTo(Element* oldElement, PassRefPtr<HTMLStackItem> newItem, const Bookmark&);
 
     void appendMarker();
     // clearToLastMarker also clears the marker (per the HTML5 spec).
diff --git a/Source/WebCore/html/parser/HTMLStackItem.h b/Source/WebCore/html/parser/HTMLStackItem.h
new file mode 100644
index 000000000..7dc760730
--- /dev/null
+++ b/Source/WebCore/html/parser/HTMLStackItem.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLStackItem_h
+#define HTMLStackItem_h
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLToken.h"
+
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class ContainerNode;
+
+class HTMLStackItem : public RefCounted<HTMLStackItem> {
+public:
+    // DocumentFragment case.
+    static PassRefPtr<HTMLStackItem> create(PassRefPtr<ContainerNode> node)
+    {
+        return adoptRef(new HTMLStackItem(node));
+    }
+
+    // Used by HTMLElementStack and HTMLFormattingElementList.
+    static PassRefPtr<HTMLStackItem> create(PassRefPtr<ContainerNode> node, PassRefPtr<AtomicHTMLToken> token, const AtomicString& namespaceURI = HTMLNames::xhtmlNamespaceURI)
+    {
+        return adoptRef(new HTMLStackItem(node, token, namespaceURI));
+    }
+
+    Element* element() const { return toElement(m_node.get()); }
+    ContainerNode* node() const { return m_node.get(); }
+
+    AtomicHTMLToken* token() { return m_token.get(); }
+    const AtomicString& namespaceURI() const { return m_namespaceURI; }
+
+private:
+    HTMLStackItem(PassRefPtr<ContainerNode> node)
+        : m_node(node)
+        , m_isDocumentFragmentNode(true)
+    {
+    }
+
+    HTMLStackItem(PassRefPtr<ContainerNode> node, PassRefPtr<AtomicHTMLToken> token, const AtomicString& namespaceURI = HTMLNames::xhtmlNamespaceURI)
+        : m_node(node)
+        , m_token(token)
+        , m_namespaceURI(namespaceURI)
+        , m_isDocumentFragmentNode(false)
+    {
+    }
+
+    RefPtr<ContainerNode> m_node;
+
+    RefPtr<AtomicHTMLToken> m_token;
+    AtomicString m_namespaceURI;
+    bool m_isDocumentFragmentNode;
+};
+
+} // namespace WebCore
+
+#endif // HTMLStackItem_h
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index 3a87e224d..3099c785c 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -27,6 +27,8 @@
 #define HTMLToken_h
 
 #include "MarkupTokenBase.h"
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -81,14 +83,17 @@ public:
     }
 };
 
-class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken> {
+class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken>, public RefCounted<AtomicHTMLToken> {
     WTF_MAKE_NONCOPYABLE(AtomicHTMLToken);
 public:
-    AtomicHTMLToken(HTMLToken& token) : AtomicMarkupTokenBase<HTMLToken>(&token) { }
+    static PassRefPtr<AtomicHTMLToken> create(HTMLToken& token)
+    {
+        return adoptRef(new AtomicHTMLToken(token));
+    }
 
-    AtomicHTMLToken(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
-        : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
+    static PassRefPtr<AtomicHTMLToken> create(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
     {
+        return adoptRef(new AtomicHTMLToken(type, name, attributes));
     }
 
     bool forceQuirks() const
@@ -96,6 +101,16 @@ public:
         ASSERT(m_type == HTMLTokenTypes::DOCTYPE);
         return m_doctypeData->m_forceQuirks;
     }
+private:
+    AtomicHTMLToken(HTMLToken& token)
+        : AtomicMarkupTokenBase<HTMLToken>(&token)
+    {
+    }
+
+    AtomicHTMLToken(HTMLTokenTypes::Type type, const AtomicString& name, const Vector<Attribute>& attributes = Vector<Attribute>())
+        : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
+    {
+    }
 };
 
 }
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 6a2b0e770..729388d58 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -40,6 +40,7 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "HTMLScriptElement.h"
+#include "HTMLStackItem.h"
 #include "HTMLToken.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
@@ -245,9 +246,9 @@ HTMLFormElement* closestFormAncestor(Element* element)
 class HTMLTreeBuilder::ExternalCharacterTokenBuffer {
     WTF_MAKE_NONCOPYABLE(ExternalCharacterTokenBuffer);
 public:
-    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken& token)
-        : m_current(token.characters().data())
-        , m_end(m_current + token.characters().size())
+    explicit ExternalCharacterTokenBuffer(AtomicHTMLToken* token)
+        : m_current(token->characters().data())
+        , m_end(m_current + token->characters().size())
     {
         ASSERT(!isEmpty());
     }
@@ -380,7 +381,7 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* f
         // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
         // For efficiency, we skip step 4.2 ("Let root be a new html element with no attributes")
         // and instead use the DocumentFragment as a root node.
-        m_tree.openElements()->pushRootNode(fragment);
+        m_tree.openElements()->pushRootNode(HTMLStackItem::create(fragment));
         resetInsertionModeAppropriately();
         m_tree.setForm(closestFormAncestor(contextElement));
     }
@@ -433,7 +434,7 @@ PassRefPtr<Element> HTMLTreeBuilder::takeScriptToProcess(TextPosition& scriptSta
 
 void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
 {
-    AtomicHTMLToken token(rawToken);
+    RefPtr<AtomicHTMLToken> token = AtomicHTMLToken::create(rawToken);
 
     // We clear the rawToken in case constructTreeFromAtomicToken
     // synchronously re-enters the parser. We don't clear the token immedately
@@ -448,7 +449,7 @@ void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
     if (rawToken.type() != HTMLTokenTypes::Character)
         rawToken.clear();
 
-    constructTreeFromAtomicToken(token);
+    constructTreeFromAtomicToken(token.get());
 
     if (!rawToken.isUninitialized()) {
         ASSERT(rawToken.type() == HTMLTokenTypes::Character);
@@ -456,7 +457,7 @@ void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
     }
 }
 
-void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken* token)
 {
     if (shouldProcessTokenInForeignContent(token))
         processTokenInForeignContent(token);
@@ -475,9 +476,9 @@ void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
     // We might be detached now.
 }
 
-void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processToken(AtomicHTMLToken* token)
 {
-    switch (token.type()) {
+    switch (token->type()) {
     case HTMLTokenTypes::Uninitialized:
         ASSERT_NOT_REACHED();
         break;
@@ -507,9 +508,9 @@ void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::DOCTYPE);
+    ASSERT(token->type() == HTMLTokenTypes::DOCTYPE);
     if (m_insertionMode == InitialMode) {
         m_tree.insertDoctype(token);
         setInsertionMode(BeforeHTMLMode);
@@ -526,15 +527,15 @@ void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
 void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, const Vector<Attribute>& attributes)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
-    processStartTag(fakeToken);
+    RefPtr<AtomicHTMLToken> fakeToken = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
+    processStartTag(fakeToken.get());
 }
 
 void HTMLTreeBuilder::processFakeEndTag(const QualifiedName& tagName)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
-    AtomicHTMLToken fakeToken(HTMLTokenTypes::EndTag, tagName.localName());
-    processEndTag(fakeToken);
+    RefPtr<AtomicHTMLToken> fakeToken = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, tagName.localName());
+    processEndTag(fakeToken.get());
 }
 
 void HTMLTreeBuilder::processFakeCharacters(const String& characters)
@@ -548,13 +549,13 @@ void HTMLTreeBuilder::processFakePEndTagIfPInButtonScope()
 {
     if (!m_tree.openElements()->inButtonScope(pTag.localName()))
         return;
-    AtomicHTMLToken endP(HTMLTokenTypes::EndTag, pTag.localName());
-    processEndTag(endP);
+    RefPtr<AtomicHTMLToken> endP = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, pTag.localName());
+    processEndTag(endP.get());
 }
 
-Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
+Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken* token)
 {
-    Vector<Attribute> attributes = token.attributes();
+    Vector<Attribute> attributes = token->attributes();
     for (int i = attributes.size() - 1; i >= 0; --i) {
         const QualifiedName& name = attributes.at(i).name();
         if (name.matches(nameAttr) || name.matches(actionAttr) || name.matches(promptAttr))
@@ -565,21 +566,21 @@ Vector<Attribute> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& to
     return attributes;
 }
 
-void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processIsindexStartTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    ASSERT(token.name() == isindexTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->name() == isindexTag);
     parseError(token);
     if (m_tree.form())
         return;
     notImplemented(); // Acknowledge self-closing flag
     processFakeStartTag(formTag);
-    Attribute* actionAttribute = token.getAttributeItem(actionAttr);
+    Attribute* actionAttribute = token->getAttributeItem(actionAttr);
     if (actionAttribute)
         m_tree.form()->setAttribute(actionAttr, actionAttribute->value());
     processFakeStartTag(hrTag);
     processFakeStartTag(labelTag);
-    Attribute* promptAttribute = token.getAttributeItem(promptAttr);
+    Attribute* promptAttribute = token->getAttributeItem(promptAttr);
     if (promptAttribute)
         processFakeCharacters(promptAttribute->value());
     else
@@ -607,7 +608,7 @@ bool isDdOrDt(const ContainerNode* element)
 }
 
 template <bool shouldClose(const ContainerNode*)>
-void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken* token)
 {
     m_framesetOk = false;
     HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
@@ -641,7 +642,7 @@ void mapLoweredLocalNameToName(PrefixedNameToQualifiedNameMap* map, QualifiedNam
     }
 }
 
-void adjustSVGTagNameCase(AtomicHTMLToken& token)
+void adjustSVGTagNameCase(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* caseMap = 0;
     if (!caseMap) {
@@ -651,14 +652,14 @@ void adjustSVGTagNameCase(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, svgTags, length);
     }
 
-    const QualifiedName& casedName = caseMap->get(token.name());
+    const QualifiedName& casedName = caseMap->get(token->name());
     if (casedName.localName().isNull())
         return;
-    token.setName(casedName.localName());
+    token->setName(casedName.localName());
 }
 
 template<QualifiedName** getAttrs(size_t* length)>
-void adjustAttributes(AtomicHTMLToken& token)
+void adjustAttributes(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* caseMap = 0;
     if (!caseMap) {
@@ -668,20 +669,20 @@ void adjustAttributes(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, attrs, length);
     }
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        Attribute& tokenAttribute = token->attributes().at(i);
         const QualifiedName& casedName = caseMap->get(tokenAttribute.localName());
         if (!casedName.localName().isNull())
             tokenAttribute.parserSetName(casedName);
     }
 }
 
-void adjustSVGAttributes(AtomicHTMLToken& token)
+void adjustSVGAttributes(AtomicHTMLToken* token)
 {
     adjustAttributes<SVGNames::getSVGAttrs>(token);
 }
 
-void adjustMathMLAttributes(AtomicHTMLToken& token)
+void adjustMathMLAttributes(AtomicHTMLToken* token)
 {
     adjustAttributes<MathMLNames::getMathMLAttrs>(token);
 }
@@ -697,7 +698,7 @@ void addNamesWithPrefix(PrefixedNameToQualifiedNameMap* map, const AtomicString&
     }
 }
 
-void adjustForeignAttributes(AtomicHTMLToken& token)
+void adjustForeignAttributes(AtomicHTMLToken* token)
 {
     static PrefixedNameToQualifiedNameMap* map = 0;
     if (!map) {
@@ -713,8 +714,8 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
         map->add("xmlns:xlink", QualifiedName("xmlns", "xlink", XMLNSNames::xmlnsNamespaceURI));
     }
 
-    for (unsigned i = 0; i < token.attributes().size(); ++i) {
-        Attribute& tokenAttribute = token.attributes().at(i);
+    for (unsigned i = 0; i < token->attributes().size(); ++i) {
+        Attribute& tokenAttribute = token->attributes().at(i);
         const QualifiedName& name = map->get(tokenAttribute.localName());
         if (!name.localName().isNull())
             tokenAttribute.parserSetName(name);
@@ -723,28 +724,28 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
 
 }
 
-void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == htmlTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == htmlTag) {
         processHtmlStartTagForInBody(token);
         return;
     }
-    if (token.name() == baseTag
-        || token.name() == basefontTag
-        || token.name() == bgsoundTag
-        || token.name() == commandTag
-        || token.name() == linkTag
-        || token.name() == metaTag
-        || token.name() == noframesTag
-        || token.name() == scriptTag
-        || token.name() == styleTag
-        || token.name() == titleTag) {
+    if (token->name() == baseTag
+        || token->name() == basefontTag
+        || token->name() == bgsoundTag
+        || token->name() == commandTag
+        || token->name() == linkTag
+        || token->name() == metaTag
+        || token->name() == noframesTag
+        || token->name() == scriptTag
+        || token->name() == styleTag
+        || token->name() == titleTag) {
         bool didProcess = processStartTagForInHead(token);
         ASSERT_UNUSED(didProcess, didProcess);
         return;
     }
-    if (token.name() == bodyTag) {
+    if (token->name() == bodyTag) {
         parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragment());
@@ -754,7 +755,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLBodyStartTagInBody(token);
         return;
     }
-    if (token.name() == framesetTag) {
+    if (token->name() == framesetTag) {
         parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragment());
@@ -772,33 +773,33 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(InFramesetMode);
         return;
     }
-    if (token.name() == addressTag
-        || token.name() == articleTag
-        || token.name() == asideTag
-        || token.name() == blockquoteTag
-        || token.name() == centerTag
-        || token.name() == detailsTag
-        || token.name() == dirTag
-        || token.name() == divTag
-        || token.name() == dlTag
-        || token.name() == fieldsetTag
-        || token.name() == figcaptionTag
-        || token.name() == figureTag
-        || token.name() == footerTag
-        || token.name() == headerTag
-        || token.name() == hgroupTag
-        || token.name() == menuTag
-        || token.name() == navTag
-        || token.name() == olTag
-        || token.name() == pTag
-        || token.name() == sectionTag
-        || token.name() == summaryTag
-        || token.name() == ulTag) {
+    if (token->name() == addressTag
+        || token->name() == articleTag
+        || token->name() == asideTag
+        || token->name() == blockquoteTag
+        || token->name() == centerTag
+        || token->name() == detailsTag
+        || token->name() == dirTag
+        || token->name() == divTag
+        || token->name() == dlTag
+        || token->name() == fieldsetTag
+        || token->name() == figcaptionTag
+        || token->name() == figureTag
+        || token->name() == footerTag
+        || token->name() == headerTag
+        || token->name() == hgroupTag
+        || token->name() == menuTag
+        || token->name() == navTag
+        || token->name() == olTag
+        || token->name() == pTag
+        || token->name() == sectionTag
+        || token->name() == summaryTag
+        || token->name() == ulTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (isNumberedHeaderTag(token.name())) {
+    if (isNumberedHeaderTag(token->name())) {
         processFakePEndTagIfPInButtonScope();
         if (isNumberedHeaderTag(m_tree.currentNode()->localName())) {
             parseError(token);
@@ -807,14 +808,14 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == preTag || token.name() == listingTag) {
+    if (token->name() == preTag || token->name() == listingTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         m_shouldSkipLeadingNewline = true;
         m_framesetOk = false;
         return;
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         if (m_tree.form()) {
             parseError(token);
             return;
@@ -823,21 +824,21 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLFormElement(token);
         return;
     }
-    if (token.name() == liTag) {
+    if (token->name() == liTag) {
         processCloseWhenNestedTag<isLi>(token);
         return;
     }
-    if (token.name() == ddTag || token.name() == dtTag) {
+    if (token->name() == ddTag || token->name() == dtTag) {
         processCloseWhenNestedTag<isDdOrDt>(token);
         return;
     }
-    if (token.name() == plaintextTag) {
+    if (token->name() == plaintextTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertHTMLElement(token);
         m_parser->tokenizer()->setState(HTMLTokenizerState::PLAINTEXTState);
         return;
     }
-    if (token.name() == buttonTag) {
+    if (token->name() == buttonTag) {
         if (m_tree.openElements()->inScope(buttonTag)) {
             parseError(token);
             processFakeEndTag(buttonTag);
@@ -849,7 +850,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_framesetOk = false;
         return;
     }
-    if (token.name() == aTag) {
+    if (token->name() == aTag) {
         Element* activeATag = m_tree.activeFormattingElements()->closestElementInScopeWithName(aTag.localName());
         if (activeATag) {
             parseError(token);
@@ -862,12 +863,12 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (isNonAnchorNonNobrFormattingTag(token.name())) {
+    if (isNonAnchorNonNobrFormattingTag(token->name())) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (token.name() == nobrTag) {
+    if (token->name() == nobrTag) {
         m_tree.reconstructTheActiveFormattingElements();
         if (m_tree.openElements()->inScope(nobrTag)) {
             parseError(token);
@@ -877,16 +878,16 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertFormattingElement(token);
         return;
     }
-    if (token.name() == appletTag
-        || token.name() == marqueeTag
-        || token.name() == objectTag) {
+    if (token->name() == appletTag
+        || token->name() == marqueeTag
+        || token->name() == objectTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         m_tree.activeFormattingElements()->appendMarker();
         m_framesetOk = false;
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         if (!m_document->inQuirksMode() && m_tree.openElements()->inButtonScope(pTag))
             processFakeEndTag(pTag);
         m_tree.insertHTMLElement(token);
@@ -894,48 +895,48 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(InTableMode);
         return;
     }
-    if (token.name() == imageTag) {
+    if (token->name() == imageTag) {
         parseError(token);
         // Apparently we're not supposed to ask.
-        token.setName(imgTag.localName());
+        token->setName(imgTag.localName());
         // Note the fall through to the imgTag handling below!
     }
-    if (token.name() == areaTag
-        || token.name() == brTag
-        || token.name() == embedTag
-        || token.name() == imgTag
-        || token.name() == keygenTag
-        || token.name() == wbrTag) {
+    if (token->name() == areaTag
+        || token->name() == brTag
+        || token->name() == embedTag
+        || token->name() == imgTag
+        || token->name() == keygenTag
+        || token->name() == wbrTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertSelfClosingHTMLElement(token);
         m_framesetOk = false;
         return;
     }
-    if (token.name() == inputTag) {
-        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
+    if (token->name() == inputTag) {
+        Attribute* typeAttribute = token->getAttributeItem(typeAttr);
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertSelfClosingHTMLElement(token);
         if (!typeAttribute || !equalIgnoringCase(typeAttribute->value(), "hidden"))
             m_framesetOk = false;
         return;
     }
-    if (token.name() == paramTag
-        || token.name() == sourceTag
-        || token.name() == trackTag) {
+    if (token->name() == paramTag
+        || token->name() == sourceTag
+        || token->name() == trackTag) {
         m_tree.insertSelfClosingHTMLElement(token);
         return;
     }
-    if (token.name() == hrTag) {
+    if (token->name() == hrTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.insertSelfClosingHTMLElement(token);
         m_framesetOk = false;
         return;
     }
-    if (token.name() == isindexTag) {
+    if (token->name() == isindexTag) {
         processIsindexStartTagForInBody(token);
         return;
     }
-    if (token.name() == textareaTag) {
+    if (token->name() == textareaTag) {
         m_tree.insertHTMLElement(token);
         m_shouldSkipLeadingNewline = true;
         m_parser->tokenizer()->setState(HTMLTokenizerState::RCDATAState);
@@ -944,27 +945,27 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         setInsertionMode(TextMode);
         return;
     }
-    if (token.name() == xmpTag) {
+    if (token->name() == xmpTag) {
         processFakePEndTagIfPInButtonScope();
         m_tree.reconstructTheActiveFormattingElements();
         m_framesetOk = false;
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == iframeTag) {
+    if (token->name() == iframeTag) {
         m_framesetOk = false;
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == noembedTag && pluginsEnabled(m_document->frame())) {
+    if (token->name() == noembedTag && pluginsEnabled(m_document->frame())) {
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == noscriptTag && scriptEnabled(m_document->frame())) {
+    if (token->name() == noscriptTag && scriptEnabled(m_document->frame())) {
         processGenericRawTextStartTag(token);
         return;
     }
-    if (token.name() == selectTag) {
+    if (token->name() == selectTag) {
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         m_framesetOk = false;
@@ -979,16 +980,16 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
             setInsertionMode(InSelectMode);
         return;
     }
-    if (token.name() == optgroupTag || token.name() == optionTag) {
+    if (token->name() == optgroupTag || token->name() == optionTag) {
         if (m_tree.currentNode()->hasTagName(optionTag)) {
-            AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-            processEndTag(endOption);
+            RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+            processEndTag(endOption.get());
         }
         m_tree.reconstructTheActiveFormattingElements();
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == rpTag || token.name() == rtTag) {
+    if (token->name() == rpTag || token->name() == rtTag) {
         if (m_tree.openElements()->inScope(rubyTag.localName())) {
             m_tree.generateImpliedEndTags();
             if (!m_tree.currentNode()->hasTagName(rubyTag))
@@ -997,26 +998,26 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         m_tree.insertHTMLElement(token);
         return;
     }
-    if (token.name() == MathMLNames::mathTag.localName()) {
+    if (token->name() == MathMLNames::mathTag.localName()) {
         m_tree.reconstructTheActiveFormattingElements();
         adjustMathMLAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, MathMLNames::mathmlNamespaceURI);
         return;
     }
-    if (token.name() == SVGNames::svgTag.localName()) {
+    if (token->name() == SVGNames::svgTag.localName()) {
         m_tree.reconstructTheActiveFormattingElements();
         adjustSVGAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, SVGNames::svgNamespaceURI);
         return;
     }
-    if (isCaptionColOrColgroupTag(token.name())
-        || token.name() == frameTag
-        || token.name() == headTag
-        || isTableBodyContextTag(token.name())
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (isCaptionColOrColgroupTag(token->name())
+        || token->name() == frameTag
+        || token->name() == headTag
+        || isTableBodyContextTag(token->name())
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
@@ -1050,42 +1051,42 @@ void HTMLTreeBuilder::closeTheCell()
     ASSERT(insertionMode() == InRowMode);
 }
 
-void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == captionTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == captionTag) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.activeFormattingElements()->appendMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InCaptionMode);
         return;
     }
-    if (token.name() == colgroupTag) {
+    if (token->name() == colgroupTag) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InColumnGroupMode);
         return;
     }
-    if (token.name() == colTag) {
+    if (token->name() == colTag) {
         processFakeStartTag(colgroupTag);
         ASSERT(InColumnGroupMode);
         processStartTag(token);
         return;
     }
-    if (isTableBodyContextTag(token.name())) {
+    if (isTableBodyContextTag(token->name())) {
         m_tree.openElements()->popUntilTableScopeMarker();
         m_tree.insertHTMLElement(token);
         setInsertionMode(InTableBodyMode);
         return;
     }
-    if (isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         processFakeStartTag(tbodyTag);
         ASSERT(insertionMode() == InTableBodyMode);
         processStartTag(token);
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         parseError(token);
         if (!processTableEndTagForInTable()) {
             ASSERT(isParsingFragment());
@@ -1094,12 +1095,12 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
         processStartTag(token);
         return;
     }
-    if (token.name() == styleTag || token.name() == scriptTag) {
+    if (token->name() == styleTag || token->name() == scriptTag) {
         processStartTagForInHead(token);
         return;
     }
-    if (token.name() == inputTag) {
-        Attribute* typeAttribute = token.getAttributeItem(typeAttr);
+    if (token->name() == inputTag) {
+        Attribute* typeAttribute = token->getAttributeItem(typeAttr);
         if (typeAttribute && equalIgnoringCase(typeAttribute->value(), "hidden")) {
             parseError(token);
             m_tree.insertSelfClosingHTMLElement(token);
@@ -1107,7 +1108,7 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
         }
         // Fall through to "anything else" case.
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         parseError(token);
         if (m_tree.form())
             return;
@@ -1120,9 +1121,9 @@ void HTMLTreeBuilder::processStartTagForInTable(AtomicHTMLToken& token)
     processStartTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -1130,7 +1131,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHTMLMode:
         ASSERT(insertionMode() == BeforeHTMLMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             m_tree.insertHTMLHtmlStartTagBeforeHTML(token);
             setInsertionMode(BeforeHeadMode);
             return;
@@ -1139,11 +1140,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHeadMode:
         ASSERT(insertionMode() == BeforeHeadMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             m_tree.insertHTMLHeadElement(token);
             setInsertionMode(InHeadMode);
             return;
@@ -1158,38 +1159,38 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         // Fall through.
     case AfterHeadMode:
         ASSERT(insertionMode() == AfterHeadMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == bodyTag) {
+        if (token->name() == bodyTag) {
             m_framesetOk = false;
             m_tree.insertHTMLBodyElement(token);
             setInsertionMode(InBodyMode);
             return;
         }
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             m_tree.insertHTMLElement(token);
             setInsertionMode(InFramesetMode);
             return;
         }
-        if (token.name() == baseTag
-            || token.name() == basefontTag
-            || token.name() == bgsoundTag
-            || token.name() == linkTag
-            || token.name() == metaTag
-            || token.name() == noframesTag
-            || token.name() == scriptTag
-            || token.name() == styleTag
-            || token.name() == titleTag) {
+        if (token->name() == baseTag
+            || token->name() == basefontTag
+            || token->name() == bgsoundTag
+            || token->name() == linkTag
+            || token->name() == metaTag
+            || token->name() == noframesTag
+            || token->name() == scriptTag
+            || token->name() == styleTag
+            || token->name() == titleTag) {
             parseError(token);
             ASSERT(m_tree.head());
-            m_tree.openElements()->pushHTMLHeadElement(m_tree.head());
+            m_tree.openElements()->pushHTMLHeadElement(HTMLStackItem::create(m_tree.head(), token));
             processStartTagForInHead(token);
             m_tree.openElements()->removeHTMLHeadElement(m_tree.head());
             return;
         }
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             parseError(token);
             return;
         }
@@ -1205,10 +1206,10 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InCaptionMode:
         ASSERT(insertionMode() == InCaptionMode);
-        if (isCaptionColOrColgroupTag(token.name())
-            || isTableBodyContextTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag) {
+        if (isCaptionColOrColgroupTag(token->name())
+            || isTableBodyContextTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag) {
             parseError(token);
             if (!processCaptionEndTagForInCaption()) {
                 ASSERT(isParsingFragment());
@@ -1221,11 +1222,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InColumnGroupMode:
         ASSERT(insertionMode() == InColumnGroupMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == colTag) {
+        if (token->name() == colTag) {
             m_tree.insertSelfClosingHTMLElement(token);
             return;
         }
@@ -1237,20 +1238,20 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InTableBodyMode:
         ASSERT(insertionMode() == InTableBodyMode);
-        if (token.name() == trTag) {
+        if (token->name() == trTag) {
             m_tree.openElements()->popUntilTableBodyScopeMarker(); // How is there ever anything to pop?
             m_tree.insertHTMLElement(token);
             setInsertionMode(InRowMode);
             return;
         }
-        if (isTableCellContextTag(token.name())) {
+        if (isTableCellContextTag(token->name())) {
             parseError(token);
             processFakeStartTag(trTag);
             ASSERT(insertionMode() == InRowMode);
             processStartTag(token);
             return;
         }
-        if (isCaptionColOrColgroupTag(token.name()) || isTableBodyContextTag(token.name())) {
+        if (isCaptionColOrColgroupTag(token->name()) || isTableBodyContextTag(token->name())) {
             // FIXME: This is slow.
             if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
                 ASSERT(isParsingFragment());
@@ -1267,16 +1268,16 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InRowMode:
         ASSERT(insertionMode() == InRowMode);
-        if (isTableCellContextTag(token.name())) {
+        if (isTableCellContextTag(token->name())) {
             m_tree.openElements()->popUntilTableRowScopeMarker();
             m_tree.insertHTMLElement(token);
             setInsertionMode(InCellMode);
             m_tree.activeFormattingElements()->appendMarker();
             return;
         }
-        if (token.name() == trTag
-            || isCaptionColOrColgroupTag(token.name())
-            || isTableBodyContextTag(token.name())) {
+        if (token->name() == trTag
+            || isCaptionColOrColgroupTag(token->name())
+            || isTableBodyContextTag(token->name())) {
             if (!processTrEndTagForInRow()) {
                 ASSERT(isParsingFragment());
                 return;
@@ -1289,10 +1290,10 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InCellMode:
         ASSERT(insertionMode() == InCellMode);
-        if (isCaptionColOrColgroupTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag
-            || isTableBodyContextTag(token.name())) {
+        if (isCaptionColOrColgroupTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag
+            || isTableBodyContextTag(token->name())) {
             // FIXME: This could be more efficient.
             if (!m_tree.openElements()->inTableScope(tdTag) && !m_tree.openElements()->inTableScope(thTag)) {
                 ASSERT(isParsingFragment());
@@ -1308,7 +1309,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     case AfterBodyMode:
     case AfterAfterBodyMode:
         ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
@@ -1317,21 +1318,21 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InHeadNoscriptMode:
         ASSERT(insertionMode() == InHeadNoscriptMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == basefontTag
-            || token.name() == bgsoundTag
-            || token.name() == linkTag
-            || token.name() == metaTag
-            || token.name() == noframesTag
-            || token.name() == styleTag) {
+        if (token->name() == basefontTag
+            || token->name() == bgsoundTag
+            || token->name() == linkTag
+            || token->name() == metaTag
+            || token->name() == noframesTag
+            || token->name() == styleTag) {
             bool didProcess = processStartTagForInHead(token);
             ASSERT_UNUSED(didProcess, didProcess);
             return;
         }
-        if (token.name() == htmlTag || token.name() == noscriptTag) {
+        if (token->name() == htmlTag || token->name() == noscriptTag) {
             parseError(token);
             return;
         }
@@ -1340,19 +1341,19 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InFramesetMode:
         ASSERT(insertionMode() == InFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == frameTag) {
+        if (token->name() == frameTag) {
             m_tree.insertSelfClosingHTMLElement(token);
             return;
         }
-        if (token.name() == noframesTag) {
+        if (token->name() == noframesTag) {
             processStartTagForInHead(token);
             return;
         }
@@ -1361,11 +1362,11 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     case AfterFramesetMode:
     case AfterAfterFramesetMode:
         ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == noframesTag) {
+        if (token->name() == noframesTag) {
             processStartTagForInHead(token);
             return;
         }
@@ -1373,64 +1374,64 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         break;
     case InSelectInTableMode:
         ASSERT(insertionMode() == InSelectInTableMode);
-        if (token.name() == captionTag
-            || token.name() == tableTag
-            || isTableBodyContextTag(token.name())
-            || token.name() == trTag
-            || isTableCellContextTag(token.name())) {
+        if (token->name() == captionTag
+            || token->name() == tableTag
+            || isTableBodyContextTag(token->name())
+            || token->name() == trTag
+            || isTableCellContextTag(token->name())) {
             parseError(token);
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             processStartTag(token);
             return;
         }
         // Fall through
     case InSelectMode:
         ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             processHtmlStartTagForInBody(token);
             return;
         }
-        if (token.name() == optionTag) {
+        if (token->name() == optionTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
-                AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-                processEndTag(endOption);
+                RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+                processEndTag(endOption.get());
             }
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == optgroupTag) {
+        if (token->name() == optgroupTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
-                AtomicHTMLToken endOption(HTMLTokenTypes::EndTag, optionTag.localName());
-                processEndTag(endOption);
+                RefPtr<AtomicHTMLToken> endOption = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optionTag.localName());
+                processEndTag(endOption.get());
             }
             if (m_tree.currentNode()->hasTagName(optgroupTag)) {
-                AtomicHTMLToken endOptgroup(HTMLTokenTypes::EndTag, optgroupTag.localName());
-                processEndTag(endOptgroup);
+                RefPtr<AtomicHTMLToken> endOptgroup = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, optgroupTag.localName());
+                processEndTag(endOptgroup.get());
             }
             m_tree.insertHTMLElement(token);
             return;
         }
-        if (token.name() == selectTag) {
+        if (token->name() == selectTag) {
             parseError(token);
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             return;
         }
-        if (token.name() == inputTag
-            || token.name() == keygenTag
-            || token.name() == textareaTag) {
+        if (token->name() == inputTag
+            || token->name() == keygenTag
+            || token->name() == textareaTag) {
             parseError(token);
             if (!m_tree.openElements()->inSelectScope(selectTag)) {
                 ASSERT(isParsingFragment());
                 return;
             }
-            AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-            processEndTag(endSelect);
+            RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+            processEndTag(endSelect.get());
             processStartTag(token);
             return;
         }
-        if (token.name() == scriptTag) {
+        if (token->name() == scriptTag) {
             bool didProcess = processStartTagForInHead(token);
             ASSERT_UNUSED(didProcess, didProcess);
             return;
@@ -1446,16 +1447,16 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processHtmlStartTagForInBody(AtomicHTMLToken* token)
 {
     parseError(token);
     m_tree.insertHTMLHtmlStartTagInBody(token);
 }
 
-bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    ASSERT(token.name() == bodyTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->name() == bodyTag);
     if (!m_tree.openElements()->inScope(bodyTag.localName())) {
         parseError(token);
         return false;
@@ -1465,15 +1466,15 @@ bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken& token)
     return true;
 }
 
-void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
     HTMLElementStack::ElementRecord* record = m_tree.openElements()->topRecord();
     while (1) {
         RefPtr<ContainerNode> node = record->node();
-        if (node->hasLocalName(token.name())) {
-            m_tree.generateImpliedEndTagsWithExclusion(token.name());
-            if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (node->hasLocalName(token->name())) {
+            m_tree.generateImpliedEndTagsWithExclusion(token->name());
+            if (!m_tree.currentNode()->hasLocalName(token->name()))
                 parseError(token);
             m_tree.openElements()->popUntilPopped(toElement(node.get()));
             return;
@@ -1502,7 +1503,7 @@ HTMLElementStack::ElementRecord* HTMLTreeBuilder::furthestBlockForFormattingElem
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody
-void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
+void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
 {
     // The adoption agency algorithm is N^2. We limit the number of iterations
     // to stop from hanging the whole browser. This limit is specified in the
@@ -1513,7 +1514,7 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
 
     for (int i = 0; i < outerIterationLimit; ++i) {
         // 1.
-        Element* formattingElement = m_tree.activeFormattingElements()->closestElementInScopeWithName(token.name());
+        Element* formattingElement = m_tree.activeFormattingElements()->closestElementInScopeWithName(token->name());
         if (!formattingElement || ((m_tree.openElements()->contains(formattingElement)) && !m_tree.openElements()->inScope(formattingElement))) {
             parseError(token);
             notImplemented(); // Check the stack of open elements for a more specific parse error.
@@ -1559,10 +1560,11 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
             if (node == formattingElementRecord)
                 break;
             // 6.5
-            RefPtr<Element> newElement = m_tree.createHTMLElementFromElementRecord(node);
+            RefPtr<HTMLStackItem> newItem = m_tree.createElementFromSavedToken(node->stackItem().get());
+
             HTMLFormattingElementList::Entry* nodeEntry = m_tree.activeFormattingElements()->find(node->element());
-            nodeEntry->replaceElement(newElement.get());
-            node->replaceElement(newElement.release());
+            nodeEntry->replaceElement(newItem);
+            node->replaceElement(newItem.release());
             // 6.4 -- Intentionally out of order to handle the case where node
             // was replaced in 6.5.
             // http://www.w3.org/Bugs/Public/show_bug.cgi?id=10096
@@ -1595,25 +1597,25 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
                 lastNode->element()->lazyAttach();
         }
         // 8
-        RefPtr<Element> newElement = m_tree.createHTMLElementFromElementRecord(formattingElementRecord);
+        RefPtr<HTMLStackItem> newItem = m_tree.createElementFromSavedToken(formattingElementRecord->stackItem().get());
         // 9
-        newElement->takeAllChildrenFrom(furthestBlock->element());
+        newItem->element()->takeAllChildrenFrom(furthestBlock->element());
         // 10
         Element* furthestBlockElement = furthestBlock->element();
         // FIXME: All this creation / parserAddChild / attach business should
         //        be in HTMLConstructionSite.  My guess is that steps 8--12
         //        should all be in some HTMLConstructionSite function.
-        furthestBlockElement->parserAddChild(newElement);
-        if (furthestBlockElement->attached() && !newElement->attached()) {
-            // Notice that newElement might already be attached if, for example, one of the reparented
+        furthestBlockElement->parserAddChild(newItem->element());
+        if (furthestBlockElement->attached() && !newItem->element()->attached()) {
+            // Notice that newItem->element() might already be attached if, for example, one of the reparented
             // children is a style element, which attaches itself automatically.
-            newElement->attach();
+            newItem->element()->attach();
         }
         // 11
-        m_tree.activeFormattingElements()->swapTo(formattingElement, newElement.get(), bookmark);
+        m_tree.activeFormattingElements()->swapTo(formattingElement, newItem, bookmark);
         // 12
         m_tree.openElements()->remove(formattingElement);
-        m_tree.openElements()->insertAbove(newElement, furthestBlock);
+        m_tree.openElements()->insertAbove(newItem, furthestBlock);
     }
 }
 
@@ -1669,11 +1671,11 @@ void HTMLTreeBuilder::resetInsertionModeAppropriately()
     }
 }
 
-void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
@@ -1682,7 +1684,7 @@ void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
         setInsertionMode(InTableMode);
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         // FIXME: This is slow.
         if (!m_tree.openElements()->inTableScope(tbodyTag.localName()) && !m_tree.openElements()->inTableScope(theadTag.localName()) && !m_tree.openElements()->inTableScope(tfootTag.localName())) {
             ASSERT(isParsingFragment());
@@ -1695,25 +1697,25 @@ void HTMLTreeBuilder::processEndTagForInTableBody(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
     processEndTagForInTable(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == trTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == trTag) {
         processTrEndTagForInRow();
         return;
     }
-    if (token.name() == tableTag) {
+    if (token->name() == tableTag) {
         if (!processTrEndTagForInRow()) {
             ASSERT(isParsingFragment());
             return;
@@ -1722,8 +1724,8 @@ void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    if (isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
@@ -1732,43 +1734,43 @@ void HTMLTreeBuilder::processEndTagForInRow(AtomicHTMLToken& token)
         processEndTag(token);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableCellContextTag(token.name())) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableCellContextTag(token->name())) {
         parseError(token);
         return;
     }
     processEndTagForInTable(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (isTableCellContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (isTableCellContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         m_tree.activeFormattingElements()->clearToLastMarker();
         setInsertionMode(InRowMode);
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag) {
         parseError(token);
         return;
     }
-    if (token.name() == tableTag
-        || token.name() == trTag
-        || isTableBodyContextTag(token.name())) {
-        if (!m_tree.openElements()->inTableScope(token.name())) {
-            ASSERT(isTableBodyContextTag(token.name()) || isParsingFragment());
+    if (token->name() == tableTag
+        || token->name() == trTag
+        || isTableBodyContextTag(token->name())) {
+        if (!m_tree.openElements()->inTableScope(token->name())) {
+            ASSERT(isTableBodyContextTag(token->name()) || isParsingFragment());
             parseError(token);
             return;
         }
@@ -1779,54 +1781,54 @@ void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
     processEndTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == bodyTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == bodyTag) {
         processBodyEndTagForInBody(token);
         return;
     }
-    if (token.name() == htmlTag) {
-        AtomicHTMLToken endBody(HTMLTokenTypes::EndTag, bodyTag.localName());
-        if (processBodyEndTagForInBody(endBody))
+    if (token->name() == htmlTag) {
+        RefPtr<AtomicHTMLToken> endBody = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, bodyTag.localName());
+        if (processBodyEndTagForInBody(endBody.get()))
             processEndTag(token);
         return;
     }
-    if (token.name() == addressTag
-        || token.name() == articleTag
-        || token.name() == asideTag
-        || token.name() == blockquoteTag
-        || token.name() == buttonTag
-        || token.name() == centerTag
-        || token.name() == detailsTag
-        || token.name() == dirTag
-        || token.name() == divTag
-        || token.name() == dlTag
-        || token.name() == fieldsetTag
-        || token.name() == figcaptionTag
-        || token.name() == figureTag
-        || token.name() == footerTag
-        || token.name() == headerTag
-        || token.name() == hgroupTag
-        || token.name() == listingTag
-        || token.name() == menuTag
-        || token.name() == navTag
-        || token.name() == olTag
-        || token.name() == preTag
-        || token.name() == sectionTag
-        || token.name() == summaryTag
-        || token.name() == ulTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == addressTag
+        || token->name() == articleTag
+        || token->name() == asideTag
+        || token->name() == blockquoteTag
+        || token->name() == buttonTag
+        || token->name() == centerTag
+        || token->name() == detailsTag
+        || token->name() == dirTag
+        || token->name() == divTag
+        || token->name() == dlTag
+        || token->name() == fieldsetTag
+        || token->name() == figcaptionTag
+        || token->name() == figureTag
+        || token->name() == footerTag
+        || token->name() == headerTag
+        || token->name() == hgroupTag
+        || token->name() == listingTag
+        || token->name() == menuTag
+        || token->name() == navTag
+        || token->name() == olTag
+        || token->name() == preTag
+        || token->name() == sectionTag
+        || token->name() == summaryTag
+        || token->name() == ulTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == formTag) {
+    if (token->name() == formTag) {
         RefPtr<Element> node = m_tree.takeForm();
         if (!node || !m_tree.openElements()->inScope(node.get())) {
             parseError(token);
@@ -1837,73 +1839,73 @@ void HTMLTreeBuilder::processEndTagForInBody(AtomicHTMLToken& token)
             parseError(token);
         m_tree.openElements()->remove(node.get());
     }
-    if (token.name() == pTag) {
-        if (!m_tree.openElements()->inButtonScope(token.name())) {
+    if (token->name() == pTag) {
+        if (!m_tree.openElements()->inButtonScope(token->name())) {
             parseError(token);
             processFakeStartTag(pTag);
-            ASSERT(m_tree.openElements()->inScope(token.name()));
+            ASSERT(m_tree.openElements()->inScope(token->name()));
             processEndTag(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == liTag) {
-        if (!m_tree.openElements()->inListItemScope(token.name())) {
+    if (token->name() == liTag) {
+        if (!m_tree.openElements()->inListItemScope(token->name())) {
             parseError(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (token.name() == ddTag
-        || token.name() == dtTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == ddTag
+        || token->name() == dtTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
-        m_tree.generateImpliedEndTagsWithExclusion(token.name());
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        m_tree.generateImpliedEndTagsWithExclusion(token->name());
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         return;
     }
-    if (isNumberedHeaderTag(token.name())) {
+    if (isNumberedHeaderTag(token->name())) {
         if (!m_tree.openElements()->hasNumberedHeaderElementInScope()) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
         m_tree.openElements()->popUntilNumberedHeaderElementPopped();
         return;
     }
-    if (isFormattingTag(token.name())) {
+    if (isFormattingTag(token->name())) {
         callTheAdoptionAgency(token);
         return;
     }
-    if (token.name() == appletTag
-        || token.name() == marqueeTag
-        || token.name() == objectTag) {
-        if (!m_tree.openElements()->inScope(token.name())) {
+    if (token->name() == appletTag
+        || token->name() == marqueeTag
+        || token->name() == objectTag) {
+        if (!m_tree.openElements()->inScope(token->name())) {
             parseError(token);
             return;
         }
         m_tree.generateImpliedEndTags();
-        if (!m_tree.currentNode()->hasLocalName(token.name()))
+        if (!m_tree.currentNode()->hasLocalName(token->name()))
             parseError(token);
-        m_tree.openElements()->popUntilPopped(token.name());
+        m_tree.openElements()->popUntilPopped(token->name());
         m_tree.activeFormattingElements()->clearToLastMarker();
         return;
     }
-    if (token.name() == brTag) {
+    if (token->name() == brTag) {
         parseError(token);
         processFakeStartTag(brTag);
         return;
@@ -1952,19 +1954,19 @@ bool HTMLTreeBuilder::processTableEndTagForInTable()
     return true;
 }
 
-void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
-    if (token.name() == tableTag) {
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
+    if (token->name() == tableTag) {
         processTableEndTagForInTable();
         return;
     }
-    if (token.name() == bodyTag
-        || isCaptionColOrColgroupTag(token.name())
-        || token.name() == htmlTag
-        || isTableBodyContextTag(token.name())
-        || isTableCellContextTag(token.name())
-        || token.name() == trTag) {
+    if (token->name() == bodyTag
+        || isCaptionColOrColgroupTag(token->name())
+        || token->name() == htmlTag
+        || isTableBodyContextTag(token->name())
+        || isTableCellContextTag(token->name())
+        || token->name() == trTag) {
         parseError(token);
         return;
     }
@@ -1974,9 +1976,9 @@ void HTMLTreeBuilder::processEndTagForInTable(AtomicHTMLToken& token)
     processEndTagForInBody(token);
 }
 
-void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndTag);
+    ASSERT(token->type() == HTMLTokenTypes::EndTag);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -1984,7 +1986,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHTMLMode:
         ASSERT(insertionMode() == BeforeHTMLMode);
-        if (token.name() != headTag && token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != headTag && token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -1992,7 +1994,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case BeforeHeadMode:
         ASSERT(insertionMode() == BeforeHeadMode);
-        if (token.name() != headTag && token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != headTag && token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2000,12 +2002,12 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case InHeadMode:
         ASSERT(insertionMode() == InHeadMode);
-        if (token.name() == headTag) {
+        if (token->name() == headTag) {
             m_tree.openElements()->popHTMLHeadElement();
             setInsertionMode(AfterHeadMode);
             return;
         }
-        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2013,7 +2015,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case AfterHeadMode:
         ASSERT(insertionMode() == AfterHeadMode);
-        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+        if (token->name() != bodyTag && token->name() != htmlTag && token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2029,11 +2031,11 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InCaptionMode:
         ASSERT(insertionMode() == InCaptionMode);
-        if (token.name() == captionTag) {
+        if (token->name() == captionTag) {
             processCaptionEndTagForInCaption();
             return;
         }
-        if (token.name() == tableTag) {
+        if (token->name() == tableTag) {
             parseError(token);
             if (!processCaptionEndTagForInCaption()) {
                 ASSERT(isParsingFragment());
@@ -2042,13 +2044,13 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             processEndTag(token);
             return;
         }
-        if (token.name() == bodyTag
-            || token.name() == colTag
-            || token.name() == colgroupTag
-            || token.name() == htmlTag
-            || isTableBodyContextTag(token.name())
-            || isTableCellContextTag(token.name())
-            || token.name() == trTag) {
+        if (token->name() == bodyTag
+            || token->name() == colTag
+            || token->name() == colgroupTag
+            || token->name() == htmlTag
+            || isTableBodyContextTag(token->name())
+            || isTableCellContextTag(token->name())
+            || token->name() == trTag) {
             parseError(token);
             return;
         }
@@ -2056,11 +2058,11 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InColumnGroupMode:
         ASSERT(insertionMode() == InColumnGroupMode);
-        if (token.name() == colgroupTag) {
+        if (token->name() == colgroupTag) {
             processColgroupEndTagForInColumnGroup();
             return;
         }
-        if (token.name() == colTag) {
+        if (token->name() == colTag) {
             parseError(token);
             return;
         }
@@ -2084,7 +2086,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case AfterBodyMode:
         ASSERT(insertionMode() == AfterBodyMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             if (isParsingFragment()) {
                 parseError(token);
                 return;
@@ -2101,14 +2103,14 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InHeadNoscriptMode:
         ASSERT(insertionMode() == InHeadNoscriptMode);
-        if (token.name() == noscriptTag) {
+        if (token->name() == noscriptTag) {
             ASSERT(m_tree.currentElement()->hasTagName(noscriptTag));
             m_tree.openElements()->pop();
             ASSERT(m_tree.currentElement()->hasTagName(headTag));
             setInsertionMode(InHeadMode);
             return;
         }
-        if (token.name() != brTag) {
+        if (token->name() != brTag) {
             parseError(token);
             return;
         }
@@ -2116,7 +2118,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         processToken(token);
         break;
     case TextMode:
-        if (token.name() == scriptTag) {
+        if (token->name() == scriptTag) {
             // Pause ourselves so that parsing stops until the script can be processed by the caller.
             ASSERT(m_tree.currentElement()->hasTagName(scriptTag));
             m_scriptToProcess = m_tree.currentElement();
@@ -2138,7 +2140,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InFramesetMode:
         ASSERT(insertionMode() == InFramesetMode);
-        if (token.name() == framesetTag) {
+        if (token->name() == framesetTag) {
             if (m_tree.currentNode() == m_tree.openElements()->rootNode()) {
                 parseError(token);
                 return;
@@ -2151,7 +2153,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case AfterFramesetMode:
         ASSERT(insertionMode() == AfterFramesetMode);
-        if (token.name() == htmlTag) {
+        if (token->name() == htmlTag) {
             setInsertionMode(AfterAfterFramesetMode);
             return;
         }
@@ -2162,15 +2164,15 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         break;
     case InSelectInTableMode:
         ASSERT(insertionMode() == InSelectInTableMode);
-        if (token.name() == captionTag
-            || token.name() == tableTag
-            || isTableBodyContextTag(token.name())
-            || token.name() == trTag
-            || isTableCellContextTag(token.name())) {
+        if (token->name() == captionTag
+            || token->name() == tableTag
+            || isTableBodyContextTag(token->name())
+            || token->name() == trTag
+            || isTableCellContextTag(token->name())) {
             parseError(token);
-            if (m_tree.openElements()->inTableScope(token.name())) {
-                AtomicHTMLToken endSelect(HTMLTokenTypes::EndTag, selectTag.localName());
-                processEndTag(endSelect);
+            if (m_tree.openElements()->inTableScope(token->name())) {
+                RefPtr<AtomicHTMLToken> endSelect = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, selectTag.localName());
+                processEndTag(endSelect.get());
                 processEndTag(token);
             }
             return;
@@ -2178,7 +2180,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
         // Fall through.
     case InSelectMode:
         ASSERT(insertionMode() == InSelectMode || insertionMode() == InSelectInTableMode);
-        if (token.name() == optgroupTag) {
+        if (token->name() == optgroupTag) {
             if (m_tree.currentNode()->hasTagName(optionTag) && m_tree.oneBelowTop() && m_tree.oneBelowTop()->hasTagName(optgroupTag))
                 processFakeEndTag(optionTag);
             if (m_tree.currentNode()->hasTagName(optgroupTag)) {
@@ -2188,7 +2190,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             parseError(token);
             return;
         }
-        if (token.name() == optionTag) {
+        if (token->name() == optionTag) {
             if (m_tree.currentNode()->hasTagName(optionTag)) {
                 m_tree.openElements()->pop();
                 return;
@@ -2196,8 +2198,8 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             parseError(token);
             return;
         }
-        if (token.name() == selectTag) {
-            if (!m_tree.openElements()->inSelectScope(token.name())) {
+        if (token->name() == selectTag) {
+            if (!m_tree.openElements()->inSelectScope(token->name())) {
                 ASSERT(isParsingFragment());
                 parseError(token);
                 return;
@@ -2214,9 +2216,9 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
     }
 }
 
-void HTMLTreeBuilder::processComment(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processComment(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Comment);
+    ASSERT(token->type() == HTMLTokenTypes::Comment);
     if (m_insertionMode == InitialMode
         || m_insertionMode == BeforeHTMLMode
         || m_insertionMode == AfterAfterBodyMode
@@ -2236,9 +2238,9 @@ void HTMLTreeBuilder::processComment(AtomicHTMLToken& token)
     m_tree.insertComment(token);
 }
 
-void HTMLTreeBuilder::processCharacter(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processCharacter(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::Character);
+    ASSERT(token->type() == HTMLTokenTypes::Character);
     ExternalCharacterTokenBuffer buffer(token);
     processCharacterBuffer(buffer);
 }
@@ -2419,9 +2421,9 @@ void HTMLTreeBuilder::processCharacterBufferForInBody(ExternalCharacterTokenBuff
         m_framesetOk = false;
 }
 
-void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::EndOfFile);
+    ASSERT(token->type() == HTMLTokenTypes::EndOfFile);
     switch (insertionMode()) {
     case InitialMode:
         ASSERT(insertionMode() == InitialMode);
@@ -2512,33 +2514,33 @@ void HTMLTreeBuilder::defaultForInitial()
 
 void HTMLTreeBuilder::defaultForBeforeHTML()
 {
-    AtomicHTMLToken startHTML(HTMLTokenTypes::StartTag, htmlTag.localName());
-    m_tree.insertHTMLHtmlStartTagBeforeHTML(startHTML);
+    RefPtr<AtomicHTMLToken> startHTML = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, htmlTag.localName());
+    m_tree.insertHTMLHtmlStartTagBeforeHTML(startHTML.get());
     setInsertionMode(BeforeHeadMode);
 }
 
 void HTMLTreeBuilder::defaultForBeforeHead()
 {
-    AtomicHTMLToken startHead(HTMLTokenTypes::StartTag, headTag.localName());
-    processStartTag(startHead);
+    RefPtr<AtomicHTMLToken> startHead = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, headTag.localName());
+    processStartTag(startHead.get());
 }
 
 void HTMLTreeBuilder::defaultForInHead()
 {
-    AtomicHTMLToken endHead(HTMLTokenTypes::EndTag, headTag.localName());
-    processEndTag(endHead);
+    RefPtr<AtomicHTMLToken> endHead = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, headTag.localName());
+    processEndTag(endHead.get());
 }
 
 void HTMLTreeBuilder::defaultForInHeadNoscript()
 {
-    AtomicHTMLToken endNoscript(HTMLTokenTypes::EndTag, noscriptTag.localName());
-    processEndTag(endNoscript);
+    RefPtr<AtomicHTMLToken> endNoscript = AtomicHTMLToken::create(HTMLTokenTypes::EndTag, noscriptTag.localName());
+    processEndTag(endNoscript.get());
 }
 
 void HTMLTreeBuilder::defaultForAfterHead()
 {
-    AtomicHTMLToken startBody(HTMLTokenTypes::StartTag, bodyTag.localName());
-    processStartTag(startBody);
+    RefPtr<AtomicHTMLToken> startBody = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, bodyTag.localName());
+    processStartTag(startBody.get());
     m_framesetOk = true;
 }
 
@@ -2559,28 +2561,28 @@ void HTMLTreeBuilder::defaultForInTableText()
     setInsertionMode(m_originalInsertionMode);
 }
 
-bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
-    if (token.name() == htmlTag) {
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
+    if (token->name() == htmlTag) {
         processHtmlStartTagForInBody(token);
         return true;
     }
-    if (token.name() == baseTag
-        || token.name() == basefontTag
-        || token.name() == bgsoundTag
-        || token.name() == commandTag
-        || token.name() == linkTag
-        || token.name() == metaTag) {
+    if (token->name() == baseTag
+        || token->name() == basefontTag
+        || token->name() == bgsoundTag
+        || token->name() == commandTag
+        || token->name() == linkTag
+        || token->name() == metaTag) {
         m_tree.insertSelfClosingHTMLElement(token);
         // Note: The custom processing for the <meta> tag is done in HTMLMetaElement::process().
         return true;
     }
-    if (token.name() == titleTag) {
+    if (token->name() == titleTag) {
         processGenericRCDATAStartTag(token);
         return true;
     }
-    if (token.name() == noscriptTag) {
+    if (token->name() == noscriptTag) {
         if (scriptEnabled(m_document->frame())) {
             processGenericRawTextStartTag(token);
             return true;
@@ -2589,44 +2591,44 @@ bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
         setInsertionMode(InHeadNoscriptMode);
         return true;
     }
-    if (token.name() == noframesTag || token.name() == styleTag) {
+    if (token->name() == noframesTag || token->name() == styleTag) {
         processGenericRawTextStartTag(token);
         return true;
     }
-    if (token.name() == scriptTag) {
+    if (token->name() == scriptTag) {
         processScriptStartTag(token);
-        if (m_usePreHTML5ParserQuirks && token.selfClosing())
+        if (m_usePreHTML5ParserQuirks && token->selfClosing())
             processFakeEndTag(scriptTag);
         return true;
     }
-    if (token.name() == headTag) {
+    if (token->name() == headTag) {
         parseError(token);
         return true;
     }
     return false;
 }
 
-void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processGenericRCDATAStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertHTMLElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::RCDATAState);
     m_originalInsertionMode = m_insertionMode;
     setInsertionMode(TextMode);
 }
 
-void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processGenericRawTextStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertHTMLElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::RAWTEXTState);
     m_originalInsertionMode = m_insertionMode;
     setInsertionMode(TextMode);
 }
 
-void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken* token)
 {
-    ASSERT(token.type() == HTMLTokenTypes::StartTag);
+    ASSERT(token->type() == HTMLTokenTypes::StartTag);
     m_tree.insertScriptElement(token);
     m_parser->tokenizer()->setState(HTMLTokenizerState::ScriptDataState);
     m_originalInsertionMode = m_insertionMode;
@@ -2639,7 +2641,7 @@ void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken& token)
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/tree-construction.html#tree-construction
-bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken* token)
 {
     if (m_tree.isEmpty())
         return false;
@@ -2647,31 +2649,31 @@ bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken& token)
     if (isInHTMLNamespace(node))
         return false;
     if (HTMLElementStack::isMathMLTextIntegrationPoint(node)) {
-        if (token.type() == HTMLTokenTypes::StartTag
-            && token.name() != MathMLNames::mglyphTag
-            && token.name() != MathMLNames::malignmarkTag)
+        if (token->type() == HTMLTokenTypes::StartTag
+            && token->name() != MathMLNames::mglyphTag
+            && token->name() != MathMLNames::malignmarkTag)
             return false;
-        if (token.type() == HTMLTokenTypes::Character)
+        if (token->type() == HTMLTokenTypes::Character)
             return false;
     }
     if (node->hasTagName(MathMLNames::annotation_xmlTag)
-        && token.type() == HTMLTokenTypes::StartTag
-        && token.name() == SVGNames::svgTag)
+        && token->type() == HTMLTokenTypes::StartTag
+        && token->name() == SVGNames::svgTag)
         return false;
     if (HTMLElementStack::isHTMLIntegrationPoint(node)) {
-        if (token.type() == HTMLTokenTypes::StartTag)
+        if (token->type() == HTMLTokenTypes::StartTag)
             return false;
-        if (token.type() == HTMLTokenTypes::Character)
+        if (token->type() == HTMLTokenTypes::Character)
             return false;
     }
-    if (token.type() == HTMLTokenTypes::EndOfFile)
+    if (token->type() == HTMLTokenTypes::EndOfFile)
         return false;
     return true;
 }
 
-void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken* token)
 {
-    switch (token.type()) {
+    switch (token->type()) {
     case HTMLTokenTypes::Uninitialized:
         ASSERT_NOT_REACHED();
         break;
@@ -2679,46 +2681,46 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         parseError(token);
         break;
     case HTMLTokenTypes::StartTag: {
-        if (token.name() == bTag
-            || token.name() == bigTag
-            || token.name() == blockquoteTag
-            || token.name() == bodyTag
-            || token.name() == brTag
-            || token.name() == centerTag
-            || token.name() == codeTag
-            || token.name() == ddTag
-            || token.name() == divTag
-            || token.name() == dlTag
-            || token.name() == dtTag
-            || token.name() == emTag
-            || token.name() == embedTag
-            || isNumberedHeaderTag(token.name())
-            || token.name() == headTag
-            || token.name() == hrTag
-            || token.name() == iTag
-            || token.name() == imgTag
-            || token.name() == liTag
-            || token.name() == listingTag
-            || token.name() == menuTag
-            || token.name() == metaTag
-            || token.name() == nobrTag
-            || token.name() == olTag
-            || token.name() == pTag
-            || token.name() == preTag
-            || token.name() == rubyTag
-            || token.name() == sTag
-            || token.name() == smallTag
-            || token.name() == spanTag
-            || token.name() == strongTag
-            || token.name() == strikeTag
-            || token.name() == subTag
-            || token.name() == supTag
-            || token.name() == tableTag
-            || token.name() == ttTag
-            || token.name() == uTag
-            || token.name() == ulTag
-            || token.name() == varTag
-            || (token.name() == fontTag && (token.getAttributeItem(colorAttr) || token.getAttributeItem(faceAttr) || token.getAttributeItem(sizeAttr)))) {
+        if (token->name() == bTag
+            || token->name() == bigTag
+            || token->name() == blockquoteTag
+            || token->name() == bodyTag
+            || token->name() == brTag
+            || token->name() == centerTag
+            || token->name() == codeTag
+            || token->name() == ddTag
+            || token->name() == divTag
+            || token->name() == dlTag
+            || token->name() == dtTag
+            || token->name() == emTag
+            || token->name() == embedTag
+            || isNumberedHeaderTag(token->name())
+            || token->name() == headTag
+            || token->name() == hrTag
+            || token->name() == iTag
+            || token->name() == imgTag
+            || token->name() == liTag
+            || token->name() == listingTag
+            || token->name() == menuTag
+            || token->name() == metaTag
+            || token->name() == nobrTag
+            || token->name() == olTag
+            || token->name() == pTag
+            || token->name() == preTag
+            || token->name() == rubyTag
+            || token->name() == sTag
+            || token->name() == smallTag
+            || token->name() == spanTag
+            || token->name() == strongTag
+            || token->name() == strikeTag
+            || token->name() == subTag
+            || token->name() == supTag
+            || token->name() == tableTag
+            || token->name() == ttTag
+            || token->name() == uTag
+            || token->name() == ulTag
+            || token->name() == varTag
+            || (token->name() == fontTag && (token->getAttributeItem(colorAttr) || token->getAttributeItem(faceAttr) || token->getAttributeItem(sizeAttr)))) {
             parseError(token);
             m_tree.openElements()->popUntilForeignContentScopeMarker();
             processStartTag(token);
@@ -2739,7 +2741,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         if (m_tree.currentNode()->namespaceURI() == SVGNames::svgNamespaceURI)
             adjustSVGTagNameCase(token);
 
-        if (token.name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
+        if (token->name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
             m_scriptToProcess = m_tree.currentElement();
             m_tree.openElements()->pop();
             return;
@@ -2747,10 +2749,10 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         if (!isInHTMLNamespace(m_tree.currentNode())) {
             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
             HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
-            if (!nodeRecord->node()->hasLocalName(token.name()))
+            if (!nodeRecord->node()->hasLocalName(token->name()))
                 parseError(token);
             while (1) {
-                if (nodeRecord->node()->hasLocalName(token.name())) {
+                if (nodeRecord->node()->hasLocalName(token->name())) {
                     m_tree.openElements()->popUntilPopped(nodeRecord->element());
                     return;
                 }
@@ -2768,7 +2770,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
         m_tree.insertComment(token);
         return;
     case HTMLTokenTypes::Character: {
-        String characters = String(token.characters().data(), token.characters().size());
+        String characters = String(token->characters().data(), token->characters().size());
         m_tree.insertTextNode(characters);
         if (m_framesetOk && !isAllWhitespaceOrReplacementCharacters(characters))
             m_framesetOk = false;
@@ -2790,7 +2792,7 @@ void HTMLTreeBuilder::finished()
     m_document->finishedParsing();
 }
 
-void HTMLTreeBuilder::parseError(AtomicHTMLToken&)
+void HTMLTreeBuilder::parseError(AtomicHTMLToken*)
 {
 }
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 192884e5b..3f2114c5a 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -72,7 +72,7 @@ public:
 
     // The token really should be passed as a const& since it's never modified.
     void constructTreeFromToken(HTMLToken&);
-    void constructTreeFromAtomicToken(AtomicHTMLToken&);
+    void constructTreeFromAtomicToken(AtomicHTMLToken*);
 
     bool hasParserBlockingScript() const { return !!m_scriptToProcess; }
     // Must be called to take the parser-blocking script before calling the parser again.
@@ -118,34 +118,34 @@ private:
     HTMLTreeBuilder(HTMLDocumentParser*, HTMLDocument*, bool reportErrors, bool usePreHTML5ParserQuirks, unsigned maximumDOMTreeDepth);
     HTMLTreeBuilder(HTMLDocumentParser*, DocumentFragment*, Element* contextElement, FragmentScriptingPermission, bool usePreHTML5ParserQuirks, unsigned maximumDOMTreeDepth);
 
-    void processToken(AtomicHTMLToken&);
-
-    void processDoctypeToken(AtomicHTMLToken&);
-    void processStartTag(AtomicHTMLToken&);
-    void processEndTag(AtomicHTMLToken&);
-    void processComment(AtomicHTMLToken&);
-    void processCharacter(AtomicHTMLToken&);
-    void processEndOfFile(AtomicHTMLToken&);
-
-    bool processStartTagForInHead(AtomicHTMLToken&);
-    void processStartTagForInBody(AtomicHTMLToken&);
-    void processStartTagForInTable(AtomicHTMLToken&);
-    void processEndTagForInBody(AtomicHTMLToken&);
-    void processEndTagForInTable(AtomicHTMLToken&);
-    void processEndTagForInTableBody(AtomicHTMLToken&);
-    void processEndTagForInRow(AtomicHTMLToken&);
-    void processEndTagForInCell(AtomicHTMLToken&);
-
-    void processIsindexStartTagForInBody(AtomicHTMLToken&);
-    void processHtmlStartTagForInBody(AtomicHTMLToken&);
-    bool processBodyEndTagForInBody(AtomicHTMLToken&);
+    void processToken(AtomicHTMLToken*);
+
+    void processDoctypeToken(AtomicHTMLToken*);
+    void processStartTag(AtomicHTMLToken*);
+    void processEndTag(AtomicHTMLToken*);
+    void processComment(AtomicHTMLToken*);
+    void processCharacter(AtomicHTMLToken*);
+    void processEndOfFile(AtomicHTMLToken*);
+
+    bool processStartTagForInHead(AtomicHTMLToken*);
+    void processStartTagForInBody(AtomicHTMLToken*);
+    void processStartTagForInTable(AtomicHTMLToken*);
+    void processEndTagForInBody(AtomicHTMLToken*);
+    void processEndTagForInTable(AtomicHTMLToken*);
+    void processEndTagForInTableBody(AtomicHTMLToken*);
+    void processEndTagForInRow(AtomicHTMLToken*);
+    void processEndTagForInCell(AtomicHTMLToken*);
+
+    void processIsindexStartTagForInBody(AtomicHTMLToken*);
+    void processHtmlStartTagForInBody(AtomicHTMLToken*);
+    bool processBodyEndTagForInBody(AtomicHTMLToken*);
     bool processTableEndTagForInTable();
     bool processCaptionEndTagForInCaption();
     bool processColgroupEndTagForInColumnGroup();
     bool processTrEndTagForInRow();
     // FIXME: This function should be inlined into its one call site or it
     // needs to assert which tokens it can be called with.
-    void processAnyOtherEndTagForInBody(AtomicHTMLToken&);
+    void processAnyOtherEndTagForInBody(AtomicHTMLToken*);
 
     void processCharacterBuffer(ExternalCharacterTokenBuffer&);
     inline void processCharacterBufferForInBody(ExternalCharacterTokenBuffer&);
@@ -155,9 +155,9 @@ private:
     void processFakeCharacters(const String&);
     void processFakePEndTagIfPInButtonScope();
 
-    void processGenericRCDATAStartTag(AtomicHTMLToken&);
-    void processGenericRawTextStartTag(AtomicHTMLToken&);
-    void processScriptStartTag(AtomicHTMLToken&);
+    void processGenericRCDATAStartTag(AtomicHTMLToken*);
+    void processGenericRawTextStartTag(AtomicHTMLToken*);
+    void processScriptStartTag(AtomicHTMLToken*);
 
     // Default processing for the different insertion modes.
     void defaultForInitial();
@@ -168,22 +168,22 @@ private:
     void defaultForAfterHead();
     void defaultForInTableText();
 
-    inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken&);
-    void processTokenInForeignContent(AtomicHTMLToken&);
+    inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken*);
+    void processTokenInForeignContent(AtomicHTMLToken*);
 
-    Vector<Attribute> attributesForIsindexInput(AtomicHTMLToken&);
+    Vector<Attribute> attributesForIsindexInput(AtomicHTMLToken*);
 
     HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
-    void callTheAdoptionAgency(AtomicHTMLToken&);
+    void callTheAdoptionAgency(AtomicHTMLToken*);
 
     void closeTheCell();
 
     template <bool shouldClose(const ContainerNode*)>
-    void processCloseWhenNestedTag(AtomicHTMLToken&);
+    void processCloseWhenNestedTag(AtomicHTMLToken*);
 
     bool m_framesetOk;
 
-    void parseError(AtomicHTMLToken&);
+    void parseError(AtomicHTMLToken*);
 
     InsertionMode insertionMode() const { return m_insertionMode; }
     void setInsertionMode(InsertionMode mode) { m_insertionMode = mode; }
diff --git a/Source/WebCore/html/parser/TextDocumentParser.cpp b/Source/WebCore/html/parser/TextDocumentParser.cpp
index 734edf09f..e38d0e0c4 100644
--- a/Source/WebCore/html/parser/TextDocumentParser.cpp
+++ b/Source/WebCore/html/parser/TextDocumentParser.cpp
@@ -62,9 +62,9 @@ void TextDocumentParser::insertFakePreElement()
 
     Vector<Attribute> attributes;
     attributes.append(Attribute(styleAttr, "word-wrap: break-word; white-space: pre-wrap;"));
-    AtomicHTMLToken fakePre(HTMLTokenTypes::StartTag, preTag.localName(), attributes);
+    RefPtr<AtomicHTMLToken> fakePre = AtomicHTMLToken::create(HTMLTokenTypes::StartTag, preTag.localName(), attributes);
 
-    treeBuilder()->constructTreeFromAtomicToken(fakePre);
+    treeBuilder()->constructTreeFromAtomicToken(fakePre.get());
     // Normally we would skip the first \n after a <pre> element, but we don't
     // want to skip the first \n for text documents!
     treeBuilder()->setShouldSkipLeadingNewline(false);
diff --git a/Source/WebCore/html/shadow/DetailsMarkerControl.cpp b/Source/WebCore/html/shadow/DetailsMarkerControl.cpp
index b3be3c45c..b109ef8eb 100644
--- a/Source/WebCore/html/shadow/DetailsMarkerControl.cpp
+++ b/Source/WebCore/html/shadow/DetailsMarkerControl.cpp
@@ -63,9 +63,9 @@ const AtomicString& DetailsMarkerControl::shadowPseudoId() const
 
 HTMLSummaryElement* DetailsMarkerControl::summaryElement()
 {
-    Node* node = this->shadowAncestorNode();
-    ASSERT(!node || toElement(node)->hasTagName(summaryTag));
-    return static_cast<HTMLSummaryElement*>(node);
+    Element* element = shadowHost();
+    ASSERT(!element || element->hasTagName(summaryTag));
+    return static_cast<HTMLSummaryElement*>(element);
 }
 
 }
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 74f6788a2..731449610 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -68,7 +68,11 @@ static const float cScanMaximumRate = 8;
 
 HTMLMediaElement* toParentMediaElement(Node* node)
 {
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!node)
+        return 0;
+    Node* mediaNode = node->shadowHost();
+    if (!mediaNode)
+        mediaNode = node;
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return 0;
 
diff --git a/Source/WebCore/html/shadow/MeterShadowElement.cpp b/Source/WebCore/html/shadow/MeterShadowElement.cpp
index 2d4d84481..3101bd124 100644
--- a/Source/WebCore/html/shadow/MeterShadowElement.cpp
+++ b/Source/WebCore/html/shadow/MeterShadowElement.cpp
@@ -50,9 +50,9 @@ MeterShadowElement::MeterShadowElement(Document* document)
 
 HTMLMeterElement* MeterShadowElement::meterElement() const
 {
-    Node* node = const_cast<MeterShadowElement*>(this)->shadowAncestorNode();
-    ASSERT(!node || meterTag == toElement(node)->tagQName());
-    return static_cast<HTMLMeterElement*>(node);
+    Element* element = shadowHost();
+    ASSERT(!element || element->hasTagName(meterTag));
+    return static_cast<HTMLMeterElement*>(element);
 }
 
 bool MeterShadowElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/shadow/ProgressShadowElement.cpp b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
index 780815212..800f22351 100644
--- a/Source/WebCore/html/shadow/ProgressShadowElement.cpp
+++ b/Source/WebCore/html/shadow/ProgressShadowElement.cpp
@@ -47,9 +47,9 @@ ProgressShadowElement::ProgressShadowElement(Document* document)
 
 HTMLProgressElement* ProgressShadowElement::progressElement() const
 {
-    Node* node = const_cast<ProgressShadowElement*>(this)->shadowAncestorNode();
-    ASSERT(!node || progressTag == toElement(node)->tagQName());
-    return static_cast<HTMLProgressElement*>(node);
+    Element* element = shadowHost();
+    ASSERT(!element || element->hasTagName(progressTag));
+    return static_cast<HTMLProgressElement*>(element);
 }
 
 bool ProgressShadowElement::rendererIsNeeded(const NodeRenderingContext& context)
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index bb5948690..cccad81ef 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -113,7 +113,7 @@ void RenderSliderThumb::layout()
 {
     // Do not cast node() to SliderThumbElement. This renderer is used for
     // TrackLimitElement too.
-    HTMLInputElement* input = node()->shadowAncestorNode()->toInputElement();
+    HTMLInputElement* input = node()->shadowHost()->toInputElement();
     bool isVertical = hasVerticalAppearance(input);
 
     double fraction = (sliderPosition(input) * 100).toDouble();
@@ -142,7 +142,7 @@ private:
 
 void RenderSliderContainer::layout()
 {
-    HTMLInputElement* input = node()->shadowAncestorNode()->toInputElement();
+    HTMLInputElement* input = node()->shadowHost()->toInputElement();
     bool isVertical = hasVerticalAppearance(input);
     style()->setBoxOrient(isVertical ? VERTICAL : HORIZONTAL);
     // Sets the concrete height if the height of the <input> is not fixed or a
@@ -343,8 +343,8 @@ void SliderThumbElement::detach()
 HTMLInputElement* SliderThumbElement::hostInput() const
 {
     // Only HTMLInputElement creates SliderThumbElement instances as its shadow nodes.
-    // So, shadowAncestorNode() must be an HTMLInputElement.
-    return shadowAncestorNode()->toInputElement();
+    // So, shadowHost() must be an HTMLInputElement.
+    return shadowHost()->toInputElement();
 }
 
 static const AtomicString& sliderThumbShadowPseudoId()
@@ -403,7 +403,7 @@ RenderObject* TrackLimiterElement::createRenderer(RenderArena* arena, RenderStyl
 
 const AtomicString& TrackLimiterElement::shadowPseudoId() const
 {
-    HTMLInputElement* input = shadowAncestorNode()->toInputElement();
+    HTMLInputElement* input = shadowHost()->toInputElement();
     if (!input)
         return sliderThumbShadowPseudoId();
 
@@ -453,7 +453,7 @@ const AtomicString& SliderContainerElement::shadowPseudoId() const
     DEFINE_STATIC_LOCAL(const AtomicString, mediaSliderContainer, ("-webkit-media-slider-container"));
     DEFINE_STATIC_LOCAL(const AtomicString, sliderContainer, ("-webkit-slider-container"));
 
-    HTMLInputElement* input = shadowAncestorNode()->toInputElement();
+    HTMLInputElement* input = shadowHost()->toInputElement();
     if (!input)
         return sliderContainer;
 
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index c04fb55f8..e3097bb5e 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -63,7 +63,7 @@ PassRefPtr<TextControlInnerElement> TextControlInnerElement::create(Document* do
 
 PassRefPtr<RenderStyle> TextControlInnerElement::customStyleForRenderer()
 {
-    RenderTextControlSingleLine* parentRenderer = toRenderTextControlSingleLine(shadowAncestorNode()->renderer());
+    RenderTextControlSingleLine* parentRenderer = toRenderTextControlSingleLine(shadowHost()->renderer());
     return parentRenderer->createInnerBlockStyle(parentRenderer->style());
 }
 
@@ -86,11 +86,13 @@ void TextControlInnerTextElement::defaultEventHandler(Event* event)
     // Then we would add one to the text field's inner div, and we wouldn't need this subclass.
     // Or possibly we could just use a normal event listener.
     if (event->isBeforeTextInsertedEvent() || event->type() == eventNames().webkitEditableContentChangedEvent) {
-        Node* shadowAncestor = shadowAncestorNode();
-        // A TextControlInnerTextElement can be its own shadow ancestor if its been detached, but kept alive by an EditCommand.
-        // In this case, an undo/redo can cause events to be sent to the TextControlInnerTextElement.  
-        // To prevent an infinite loop, we must check for this case before sending the event up the chain.
-        if (shadowAncestor && shadowAncestor != this)
+        Element* shadowAncestor = shadowHost();
+        // A TextControlInnerTextElement can have no host if its been detached,
+        // but kept alive by an EditCommand. In this case, an undo/redo can
+        // cause events to be sent to the TextControlInnerTextElement. To
+        // prevent an infinite loop, we must check for this case before sending
+        // the event up the chain.
+        if (shadowAncestor)
             shadowAncestor->defaultEventHandler(event);
     }
     if (!event->defaultHandled())
@@ -100,7 +102,7 @@ void TextControlInnerTextElement::defaultEventHandler(Event* event)
 RenderObject* TextControlInnerTextElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     bool multiLine = false;
-    Node* shadowAncestor = shadowAncestorNode();
+    Element* shadowAncestor = shadowHost();
     if (shadowAncestor && shadowAncestor->renderer()) {
         ASSERT(shadowAncestor->renderer()->isTextField() || shadowAncestor->renderer()->isTextArea());
         multiLine = shadowAncestor->renderer()->isTextArea();
@@ -110,7 +112,7 @@ RenderObject* TextControlInnerTextElement::createRenderer(RenderArena* arena, Re
 
 PassRefPtr<RenderStyle> TextControlInnerTextElement::customStyleForRenderer()
 {
-    RenderTextControl* parentRenderer = toRenderTextControl(shadowAncestorNode()->renderer());
+    RenderTextControl* parentRenderer = toRenderTextControl(shadowHost()->renderer());
     return parentRenderer->createInnerTextStyle(parentRenderer->style());
 }
 
@@ -131,7 +133,7 @@ const AtomicString& SearchFieldResultsButtonElement::shadowPseudoId() const
     DEFINE_STATIC_LOCAL(AtomicString, resultsId, ("-webkit-search-results-button"));
     DEFINE_STATIC_LOCAL(AtomicString, resultsDecorationId, ("-webkit-search-results-decoration"));
     DEFINE_STATIC_LOCAL(AtomicString, decorationId, ("-webkit-search-decoration"));
-    Node* host = shadowAncestorNode();
+    Element* host = shadowHost();
     if (!host)
         return resultsId;
     if (HTMLInputElement* input = host->toInputElement()) {
@@ -147,7 +149,7 @@ const AtomicString& SearchFieldResultsButtonElement::shadowPseudoId() const
 void SearchFieldResultsButtonElement::defaultEventHandler(Event* event)
 {
     // On mousedown, bring up a menu, if needed
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         input->focus();
         input->select();
@@ -195,7 +197,7 @@ void SearchFieldCancelButtonElement::detach()
 void SearchFieldCancelButtonElement::defaultEventHandler(Event* event)
 {
     // If the element is visible, on mouseup, clear the value, and set selection
-    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
     if (input->disabled() || input->isReadOnlyFormControl()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
@@ -276,7 +278,7 @@ void SpinButtonElement::defaultEventHandler(Event* event)
         return;
     }
 
-    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
     if (input->disabled() || input->isReadOnlyFormControl()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
@@ -362,7 +364,7 @@ void SpinButtonElement::stopRepeatingTimer()
 
 void SpinButtonElement::step(int amount)
 {
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowAncestorNode());
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
     if (input->disabled() || input->isReadOnlyFormControl())
         return;
     // On Mac OS, NSStepper updates the value for the button under the mouse
@@ -427,7 +429,7 @@ void InputFieldSpeechButtonElement::defaultEventHandler(Event* event)
     // The call to focus() below dispatches a focus event, and an event handler in the page might
     // remove the input element from DOM. To make sure it remains valid until we finish our work
     // here, we take a temporary reference.
-    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
 
     if (input->disabled() || input->isReadOnlyFormControl()) {
         if (!event->defaultHandled())
@@ -481,7 +483,7 @@ void InputFieldSpeechButtonElement::setState(SpeechInputState state)
 {
     if (m_state != state) {
         m_state = state;
-        shadowAncestorNode()->renderer()->repaint();
+        shadowHost()->renderer()->repaint();
     }
 }
 
@@ -507,7 +509,7 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const SpeechInputR
     // The call to setValue() below dispatches an event, and an event handler in the page might
     // remove the input element from DOM. To make sure it remains valid until we finish our work
     // here, we take a temporary reference.
-    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowAncestorNode()));
+    RefPtr<HTMLInputElement> input(static_cast<HTMLInputElement*>(shadowHost()));
     if (input->disabled() || input->isReadOnlyFormControl())
         return;
 
@@ -560,7 +562,7 @@ void InputFieldSpeechButtonElement::startSpeechInput()
     if (m_state != Idle)
         return;
 
-    RefPtr<HTMLInputElement> input = static_cast<HTMLInputElement*>(shadowAncestorNode());
+    RefPtr<HTMLInputElement> input = static_cast<HTMLInputElement*>(shadowHost());
     AtomicString language = input->computeInheritedLanguage();
     String grammar = input->getAttribute(webkitgrammarAttr);
     // FIXME: this should probably respect transforms
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.h b/Source/WebCore/html/shadow/TextControlInnerElements.h
index 6f1a9993a..33d5890a9 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.h
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.h
@@ -119,8 +119,8 @@ private:
     virtual const AtomicString& shadowPseudoId() const;
     virtual void detach();
     virtual bool isSpinButtonElement() const { return true; }
-    virtual bool isEnabledFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isEnabledFormControl(); }
-    virtual bool isReadOnlyFormControl() const { return static_cast<Element*>(shadowAncestorNode())->isReadOnlyFormControl(); }
+    virtual bool isEnabledFormControl() const { return shadowHost()->isEnabledFormControl(); }
+    virtual bool isReadOnlyFormControl() const { return shadowHost()->isReadOnlyFormControl(); }
     virtual void defaultEventHandler(Event*);
     void doStepAction(int);
     void startRepeatingTimer();
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index 46c99cf3d..10c785b2a 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -563,7 +563,8 @@ Node* InspectorOverlay::highlightedNode() const
 
 void InspectorOverlay::update()
 {
-    if (m_highlightData || !m_pausedInDebuggerMessage.isNull())
+    // FIXME(91926) Refactor highlightNode to pass highlight data along with the call.
+    if ((m_highlightData && (m_highlightData->rect || m_highlightData->node)) || !m_pausedInDebuggerMessage.isNull())
         m_client->highlight();
     else
         m_client->hideHighlight();
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 7176abb8c..e23172764 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -2128,6 +2128,17 @@
                     { "name": "totalTime", "type": "number", "description": "Total processing time for all selectors in the profile (in milliseconds.)" },
                     { "name": "data", "type": "array", "items": { "$ref": "SelectorProfileEntry" }, "description": "CSS selector profile entries." }
                 ]
+            },
+            {
+                "id": "NamedFlow",
+                "type": "object",
+                "properties": [
+                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "name", "type": "string", "description": "Named Flow identifier." },
+                    { "name": "overset", "type": "boolean", "description": "The \"overset\" attribute of a Named Flow." }
+                ],
+                "description": "This object represents a Named Flow.",
+                "hidden": true
             }
         ],
         "commands": [
@@ -2277,13 +2288,25 @@
             {
                 "name": "getNamedFlowCollection",
                 "parameters": [
-                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id for which to get the Named Flow Collection."}
+                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id for which to get the Named Flow Collection." }
                 ],
                 "returns": [
                     { "name": "namedFlows", "type": "array", "items": { "type": "string" }, "description": "An array containing the Named Flows in the document." }
                 ],
                 "description": "Returns the Named Flows from the document.",
                 "hidden": true
+            },
+            {
+                "name": "getFlowByName",
+                "parameters": [
+                    { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                    { "name": "name", "type": "string", "description": "Named Flow identifier." }
+                ],
+                "returns": [
+                    { "name": "namedFlow", "$ref": "NamedFlow", "description": "A Named Flow." }
+                ],
+                "description": "Returns the Named Flow identified by the given name",
+                "hidden": true
             }
         ],
         "events": [
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index b2ec10cdc..e075f3171 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -51,6 +51,7 @@
 #include "StyleResolver.h"
 #include "StyleRule.h"
 #include "StyleSheetList.h"
+#include "WebKitNamedFlow.h"
 #include "WebKitNamedFlowCollection.h"
 
 #include <wtf/CurrentTime.h>
@@ -803,6 +804,24 @@ void InspectorCSSAgent::getNamedFlowCollection(ErrorString* errorString, int nod
     result = namedFlows.release();
 }
 
+void InspectorCSSAgent::getFlowByName(ErrorString* errorString, int nodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result)
+{
+    Document* document = m_domAgent->assertDocument(errorString, nodeId);
+    if (!document)
+        return;
+
+    WebKitNamedFlow* namedFlow = document->namedFlows()->flowByName(flowName);
+    if (!namedFlow) {
+        *errorString = "No target CSS Named Flow found";
+        return;
+    }
+
+    result = TypeBuilder::CSS::NamedFlow::create()
+        .setNodeId(nodeId)
+        .setName(flowName)
+        .setOverset(namedFlow->overset());
+}
+
 void InspectorCSSAgent::startSelectorProfiler(ErrorString*)
 {
     m_currentSelectorProfile = adoptPtr(new SelectorProfile());
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 9ceaf3b24..6355e5081 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -111,6 +111,7 @@ public:
     virtual void addRule(ErrorString*, int contextNodeId, const String& selector, RefPtr<TypeBuilder::CSS::CSSRule>& result);
     virtual void getSupportedCSSProperties(ErrorString*, RefPtr<TypeBuilder::Array<String> >& result);
     virtual void getNamedFlowCollection(ErrorString*, int nodeId, RefPtr<TypeBuilder::Array<String> >& result);
+    virtual void getFlowByName(ErrorString*, int nodeId, const String& flowName, RefPtr<TypeBuilder::CSS::NamedFlow>& result);
 
     virtual void startSelectorProfiler(ErrorString*);
     virtual void stopSelectorProfiler(ErrorString*, RefPtr<TypeBuilder::CSS::SelectorProfile>&);
diff --git a/Source/WebCore/inspector/PageConsoleAgent.cpp b/Source/WebCore/inspector/PageConsoleAgent.cpp
index b0d527541..f55dda58f 100644
--- a/Source/WebCore/inspector/PageConsoleAgent.cpp
+++ b/Source/WebCore/inspector/PageConsoleAgent.cpp
@@ -35,7 +35,6 @@
 #include "PageConsoleAgent.h"
 
 #include "DOMWindow.h"
-#include "Document.h"
 #include "InjectedScriptHost.h"
 #include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 4102d94cb..4c76e3f02 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -166,7 +166,7 @@ WebInspector.CSSStyleModel.prototype = {
     getNamedFlowCollectionAsync: function(nodeId, userCallback)
     {
         /**
-         * @param {function(?WebInspector.CSSStyleDeclaration, ?WebInspector.CSSStyleDeclaration)} userCallback
+         * @param {function(?Array.<string>)} userCallback
          * @param {?Protocol.Error} error
          * @param {?Array.<string>=} namedFlowPayload
          */
@@ -178,7 +178,30 @@ WebInspector.CSSStyleModel.prototype = {
                 userCallback(namedFlowPayload);
         }
 
-        CSSAgent.getNamedFlowCollection(nodeId, callback.bind(null, userCallback));
+        CSSAgent.getNamedFlowCollection(nodeId, callback.bind(this, userCallback));
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} nodeId
+     * @param {string} flowName
+     * @param {function(?WebInspector.NamedFlow)} userCallback
+     */
+    getFlowByNameAsync: function(nodeId, flowName, userCallback)
+    {
+        /**
+         * @param {function(?WebInspector.NamedFlow)} userCallback
+         * @param {?Protocol.Error} error
+         * @param {?CSSAgent.NamedFlow=} namedFlowPayload
+         */
+        function callback(userCallback, error, namedFlowPayload)
+        {
+            if (error || !namedFlowPayload)
+                userCallback(null);
+            else
+                userCallback(WebInspector.NamedFlow.parsePayload(namedFlowPayload));
+        }
+
+        CSSAgent.getFlowByName(nodeId, flowName, callback.bind(this, userCallback));
     },
 
     /**
@@ -1219,6 +1242,26 @@ WebInspector.CSSDispatcher.prototype = {
 }
 
 /**
+ * @constructor
+ * @param {CSSAgent.NamedFlow} payload
+ */
+WebInspector.NamedFlow = function(payload)
+{
+    this.nodeId = payload.nodeId;
+    this.name = payload.name;
+    this.overset = payload.overset;
+}
+
+/**
+ * @param {CSSAgent.NamedFlow} payload
+ * @return {WebInspector.NamedFlow}
+ */
+WebInspector.NamedFlow.parsePayload = function(payload)
+{
+    return new WebInspector.NamedFlow(payload);
+}
+
+/**
  * @type {WebInspector.CSSStyleModel}
  */
 WebInspector.cssModel = null;
diff --git a/Source/WebCore/inspector/front-end/DataGrid.js b/Source/WebCore/inspector/front-end/DataGrid.js
index cf66cb657..09790f5e2 100644
--- a/Source/WebCore/inspector/front-end/DataGrid.js
+++ b/Source/WebCore/inspector/front-end/DataGrid.js
@@ -653,7 +653,7 @@ WebInspector.DataGrid.prototype = {
                 resizer = document.createElement("div");
                 resizer.addStyleClass("data-grid-resizer");
                 // This resizer is associated with the column to its right.
-                resizer.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+                WebInspector.installDragHandle(resizer, this._startResizerDragging.bind(this), this._resizerDragging.bind(this), this._endResizerDragging.bind(this), "col-resize");
                 this.element.appendChild(resizer);
                 this.resizers[i] = resizer;
             }
@@ -933,13 +933,13 @@ WebInspector.DataGrid.prototype = {
         this._resizeMethod = method;
     },
 
+    /**
+     * @return {boolean}
+     */
     _startResizerDragging: function(event)
     {
         this._currentResizer = event.target;
-        if (!this._currentResizer.rightNeighboringColumnID)
-            return;
-        WebInspector.elementDragStart(this._currentResizer, this._resizerDragging.bind(this),
-            this._endResizerDragging.bind(this), event, "col-resize");
+        return !!this._currentResizer.rightNeighboringColumnID
     },
 
     _resizerDragging: function(event)
@@ -993,7 +993,6 @@ WebInspector.DataGrid.prototype = {
 
     _endResizerDragging: function(event)
     {
-        WebInspector.elementDragEnd(event);
         this._currentResizer = null;
         this.dispatchEventToListeners("width changed");
     },
diff --git a/Source/WebCore/inspector/front-end/Drawer.js b/Source/WebCore/inspector/front-end/Drawer.js
index e75857c2d..2a56fca38 100644
--- a/Source/WebCore/inspector/front-end/Drawer.js
+++ b/Source/WebCore/inspector/front-end/Drawer.js
@@ -37,14 +37,15 @@ WebInspector.Drawer = function()
     this._mainElement = document.getElementById("main");
     this._toolbarElement = document.getElementById("toolbar");
     this._mainStatusBar = document.getElementById("main-status-bar");
-    this._mainStatusBar.addEventListener("mousedown", this._startStatusBarDragging.bind(this), true);
+    WebInspector.installDragHandle(this._mainStatusBar, this._startStatusBarDragging.bind(this), this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), "row-resize");
+
     this._counters = document.getElementById("counters");
 
     this._drawerContentsElement = document.createElement("div");
     this._drawerContentsElement.id = "drawer-contents";
     this._drawerContentsElement.className = "drawer-contents";
     this.element.appendChild(this._drawerContentsElement);
-    
+
     this._drawerStatusBar = document.createElement("div");
     this._drawerStatusBar.id = "drawer-status-bar";
     this._drawerStatusBar.className = "status-bar";
@@ -238,20 +239,20 @@ WebInspector.Drawer.prototype = {
             return 250;
         default:
             return 0;
-        }        
+        }
     },
 
+    /**
+     * @return {boolean}
+     */
     _startStatusBarDragging: function(event)
     {
         if (!this.visible || event.target !== this._mainStatusBar)
-            return;
+            return false;
 
         this._view.storeScrollPositions();
-        WebInspector.elementDragStart(this._mainStatusBar, this._statusBarDragging.bind(this), this._endStatusBarDragging.bind(this), event, "row-resize");
-
         this._statusBarDragOffset = event.pageY - this.element.totalOffsetTop();
-
-        event.consume();
+        return true;
     },
 
     _statusBarDragging: function(event)
@@ -270,8 +271,6 @@ WebInspector.Drawer.prototype = {
 
     _endStatusBarDragging: function(event)
     {
-        WebInspector.elementDragEnd(event);
-
         this._savedHeight = this.element.offsetHeight;
         delete this._statusBarDragOffset;
 
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index 5a2fe54fb..a1183b7e7 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -81,7 +81,7 @@ WebInspector.HeapSnapshotView = function(parent, profile)
 
     this.retainmentViewHeader = document.createElement("div");
     this.retainmentViewHeader.addStyleClass("retainers-view-header");
-    this.retainmentViewHeader.addEventListener("mousedown", this._startRetainersHeaderDragging.bind(this), true);
+    WebInspector.installDragHandle(this.retainmentViewHeader, this._startRetainersHeaderDragging.bind(this), this._retainersHeaderDragging.bind(this), this._endRetainersHeaderDragging.bind(this), "row-resize");
     var retainingPathsTitleDiv = document.createElement("div");
     retainingPathsTitleDiv.className = "title";
     var retainingPathsTitle = document.createElement("span");
@@ -635,14 +635,16 @@ WebInspector.HeapSnapshotView.prototype = {
             this.helpPopover.show(this._helpPopoverContentElement, this.helpButton.element);
     },
 
+    /**
+     * @return {boolean}
+     */
     _startRetainersHeaderDragging: function(event)
     {
         if (!this.isShowing())
-            return;
+            return false;
 
-        WebInspector.elementDragStart(this.retainmentViewHeader, this._retainersHeaderDragging.bind(this), this._endRetainersHeaderDragging.bind(this), event, "row-resize");
         this._previousDragPosition = event.pageY;
-        event.consume();
+        return true;
     },
 
     _retainersHeaderDragging: function(event)
@@ -656,7 +658,6 @@ WebInspector.HeapSnapshotView.prototype = {
 
     _endRetainersHeaderDragging: function(event)
     {
-        WebInspector.elementDragEnd(event);
         delete this._previousDragPosition;
         event.consume();
     },
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index a82a56168..2efc1dadf 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -137,11 +137,8 @@ WebInspector.NetworkLogView.prototype = {
 
     _createTable: function()
     {
-        var columns;
-        if (Preferences.displayInitiator)
-            columns = {name: {}, method: {}, status: {}, type: {}, initiator: {}, size: {}, time: {}, timeline: {}};
-        else
-            columns = {name: {}, method: {}, status: {}, type: {}, size: {}, time: {}, timeline: {}};
+        var columns = {name: {}, method: {}, status: {}, type: {}, initiator: {}, size: {}, time: {}, timeline: {}};
+
         columns.name.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Name"), WebInspector.UIString("Path"));
         columns.name.sortable = true;
         columns.name.width = "20%";
@@ -159,11 +156,9 @@ WebInspector.NetworkLogView.prototype = {
         columns.type.sortable = true;
         columns.type.width = "6%";
 
-        if (Preferences.displayInitiator) {
-            columns.initiator.title = WebInspector.UIString("Initiator");
-            columns.initiator.sortable = true;
-            columns.initiator.width = "10%";
-        }
+        columns.initiator.title = WebInspector.UIString("Initiator");
+        columns.initiator.sortable = true;
+        columns.initiator.width = "10%";
 
         columns.size.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Size"), WebInspector.UIString("Content"));
         columns.size.sortable = true;
@@ -177,10 +172,7 @@ WebInspector.NetworkLogView.prototype = {
 
         columns.timeline.title = "";
         columns.timeline.sortable = false;
-        if (Preferences.displayInitiator)
-            columns.timeline.width = "40%";
-        else
-            columns.timeline.width = "50%";
+        columns.timeline.width = "40%";
         columns.timeline.sort = "ascending";
 
         this._dataGrid = new WebInspector.DataGrid(columns);
@@ -841,8 +833,7 @@ WebInspector.NetworkLogView.prototype = {
         this._dataGrid.showColumn("method");
         this._dataGrid.showColumn("status");
         this._dataGrid.showColumn("type");
-        if (Preferences.displayInitiator)
-            this._dataGrid.showColumn("initiator");
+        this._dataGrid.showColumn("initiator");
         this._dataGrid.showColumn("size");
         this._dataGrid.showColumn("time");
         this._dataGrid.showColumn("timeline");
@@ -852,14 +843,10 @@ WebInspector.NetworkLogView.prototype = {
         widths.method = 6;
         widths.status = 6;
         widths.type = 6;
-        if (Preferences.displayInitiator)
-            widths.initiator = 10;
+        widths.initiator = 10;
         widths.size = 6;
         widths.time = 6;
-        if (Preferences.displayInitiator)
-            widths.timeline = 40;
-        else
-            widths.timeline = 50;
+        widths.timeline = 40;
 
         this._dataGrid.applyColumnWidthsMap(widths);
     },
@@ -872,8 +859,7 @@ WebInspector.NetworkLogView.prototype = {
         this._dataGrid.hideColumn("method");
         this._dataGrid.hideColumn("status");
         this._dataGrid.hideColumn("type");
-        if (Preferences.displayInitiator)
-            this._dataGrid.hideColumn("initiator");
+        this._dataGrid.hideColumn("initiator");
         this._dataGrid.hideColumn("size");
         this._dataGrid.hideColumn("time");
         this._dataGrid.hideColumn("timeline");
@@ -1726,8 +1712,7 @@ WebInspector.NetworkDataGridNode.prototype = {
         this._methodCell = this._createDivInTD("method");
         this._statusCell = this._createDivInTD("status");
         this._typeCell = this._createDivInTD("type");
-        if (Preferences.displayInitiator)
-            this._initiatorCell = this._createDivInTD("initiator");
+        this._initiatorCell = this._createDivInTD("initiator");
         this._sizeCell = this._createDivInTD("size");
         this._timeCell = this._createDivInTD("time");
         this._createTimelineCell();
@@ -1820,8 +1805,7 @@ WebInspector.NetworkDataGridNode.prototype = {
 
         this._refreshStatusCell();
         this._refreshTypeCell();
-        if (Preferences.displayInitiator)
-            this._refreshInitiatorCell();
+        this._refreshInitiatorCell();
         this._refreshSizeCell();
         this._refreshTimeCell();
 
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 963d1f0ea..fc6938a41 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -45,8 +45,7 @@ var Preferences = {
     applicationTitle: "Web Inspector - %s",
     showHeapSnapshotObjectsHiddenProperties: false,
     showDockToRight: false,
-    exposeFileSystemInspection: false,
-    displayInitiator: false
+    exposeFileSystemInspection: false
 }
 
 var Capabilities = {
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
index 5dbee94a9..6a9f56f91 100644
--- a/Source/WebCore/inspector/front-end/SidebarOverlay.js
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -134,12 +134,13 @@ WebInspector.SidebarOverlay.prototype = {
 
     /**
      * @param {Event} event
+     * @return {boolean}
      */
     _startResizerDragging: function(event)
     {
         var width = this._width;
         this._dragOffset = width - event.pageX;
-        WebInspector.elementDragStart(this._resizerElement, this._resizerDragging.bind(this), this._endResizerDragging.bind(this), event, "ew-resize");
+        return true;
     },
 
     /**
@@ -158,7 +159,6 @@ WebInspector.SidebarOverlay.prototype = {
     _endResizerDragging: function(event)
     {
         delete this._dragOffset;
-        WebInspector.elementDragEnd(event);
     },
 
     /**
@@ -166,7 +166,7 @@ WebInspector.SidebarOverlay.prototype = {
      */
     _installResizer: function(resizerElement)
     {
-        resizerElement.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+        WebInspector.installDragHandle(resizerElement, this._startResizerDragging.bind(this), this._resizerDragging.bind(this), this._endResizerDragging.bind(this), "ew-resize");
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index efd5787e3..2afff1b85 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -185,7 +185,7 @@ WebInspector.Spectrum.rgbaToHSVA = function(r, g, b, a)
     return [h, s, v, a];
 };
 
-//FIXME: migrate to WebInspector.elementDragStart
+//FIXME: migrate to WebInspector.installDragHandle
 /**
  * @param {Function=} onmove
  * @param {Function=} onstart
diff --git a/Source/WebCore/inspector/front-end/SplitView.js b/Source/WebCore/inspector/front-end/SplitView.js
index 98666e536..142c7e3b4 100644
--- a/Source/WebCore/inspector/front-end/SplitView.js
+++ b/Source/WebCore/inspector/front-end/SplitView.js
@@ -353,16 +353,16 @@ WebInspector.SplitView.prototype = {
 
     /**
      * @param {Event} event
+     * @return {boolean}
      */
     _startResizerDragging: function(event)
     {
         if (!this._resizable)
-            return;
+            return false;
 
         var leftWidth = this.hasLeftSidebar ? this._sidebarWidth : this._totalWidth - this._sidebarWidth;
         this._dragOffset = leftWidth - event.pageX;
-
-        WebInspector.elementDragStart(this.sidebarResizerElement, this._resizerDragging.bind(this), this._endResizerDragging.bind(this), event, "ew-resize");
+        return true;
     },
 
     /**
@@ -384,7 +384,6 @@ WebInspector.SplitView.prototype = {
     _endResizerDragging: function(event)
     {
         delete this._dragOffset;
-        WebInspector.elementDragEnd(event);
     },
 
     /**
@@ -392,7 +391,7 @@ WebInspector.SplitView.prototype = {
      */
     installResizer: function(resizerElement)
     {
-        resizerElement.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
+        WebInspector.installDragHandle(resizerElement, this._startResizerDragging.bind(this), this._resizerDragging.bind(this), this._endResizerDragging.bind(this), "ew-resize");
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index 0ee44eb5a..3a9d9d9a6 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -617,7 +617,7 @@ WebInspector.TabbedPaneTab.prototype = {
         this.tabElement.style.width = width + "px";
         this._width = width;
     },
-    
+
     /**
      * @param {boolean} measuring
      */
@@ -626,7 +626,7 @@ WebInspector.TabbedPaneTab.prototype = {
         var tabElement = document.createElement("div");
         tabElement.addStyleClass("tabbed-pane-header-tab");
         tabElement.tabIndex = -1;
-        
+
         var titleElement = tabElement.createChild("span", "tabbed-pane-header-tab-title");
         titleElement.textContent = this.title;
         titleElement.title = this.tooltip || "";
@@ -646,10 +646,10 @@ WebInspector.TabbedPaneTab.prototype = {
             tabElement.addEventListener("mousedown", this._tabMouseDown.bind(this), false);
             if (this._closeable) {
                 tabElement.addEventListener("contextmenu", this._tabContextMenu.bind(this), false);
-                tabElement.addEventListener("mousemove", this._tabMouseMove.bind(this), false);
+                WebInspector.installDragHandle(tabElement, this._startTabDragging.bind(this), this._tabDragging.bind(this), this._endTabDragging.bind(this), "pointer");
             }
         }
-        
+
         return tabElement;
     },
 
@@ -678,7 +678,6 @@ WebInspector.TabbedPaneTab.prototype = {
         if (event.target.hasStyleClass("tabbed-pane-header-tab-close-button") || event.button === 1)
             return;
         this._tabbedPane.selectTab(this.id, true);
-        this._dragStartX = event.pageX;
     },
 
     _tabContextMenu: function(event)
@@ -705,14 +704,16 @@ WebInspector.TabbedPaneTab.prototype = {
         contextMenu.show(event);
     },
 
-    _tabMouseMove: function(event)
+    /**
+     * @param {Event} event
+     * @return {boolean}
+     */
+    _startTabDragging: function(event)
     {
-        if (isNaN(this._dragStartX))
-            return;
-        if (event.which !== 1)
-            return;
-        this._tabbedPane.selectTab(this.id, true);
-        WebInspector.elementDragStart(this._tabElement, this._tabDragging.bind(this), this._endTabDragging.bind(this), event, "pointer");
+        if (event.target.hasStyleClass("tabbed-pane-header-tab-close-button"))
+            return false;
+        this._dragStartX = event.pageX;
+        return true;
     },
 
     /**
@@ -766,6 +767,5 @@ WebInspector.TabbedPaneTab.prototype = {
         this._tabElement.style.removeProperty("position");
         this._tabElement.style.removeProperty("left");
         delete this._dragStartX;
-        WebInspector.elementDragEnd(event);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 0a28c3b9e..48d99602c 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -88,7 +88,7 @@ WebInspector.TimelineOverviewPane = function(model)
     this._heapGraph.element.id = "timeline-overview-memory";
     this._overviewGrid.element.insertBefore(this._heapGraph.element, this._overviewGrid.itemsGraphsElement);
 
-    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewContainer);
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewContainer, this._overviewGrid.dividersLabelBarElement);
     this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
 
     var separatorElement = document.createElement("div");
@@ -217,6 +217,9 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._overviewGrid.addEventDividers(dividers);
     },
 
+    /**
+     * @param {number} width
+     */
     sidebarResized: function(width)
     {
         this._overviewContainer.style.left = width + "px";
@@ -362,15 +365,19 @@ WebInspector.TimelineOverviewPane.prototype.__proto__ = WebInspector.View.protot
  * @constructor
  * @extends {WebInspector.Object}
  * @param {Element} parentElement
+ * @param {Element} dividersLabelBarElement
  */
-WebInspector.TimelineOverviewWindow = function(parentElement)
+WebInspector.TimelineOverviewWindow = function(parentElement, dividersLabelBarElement)
 {
     this._parentElement = parentElement;
+    this._dividersLabelBarElement = dividersLabelBarElement;
+
+    WebInspector.installDragHandle(this._parentElement, this._startWindowSelectorDragging.bind(this), this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), "ew-resize");
+    WebInspector.installDragHandle(this._dividersLabelBarElement, this._startWindowDragging.bind(this), this._windowDragging.bind(this), this._endWindowDragging.bind(this), "ew-resize");
 
     this.windowLeft = 0.0;
     this.windowRight = 1.0;
 
-    this._parentElement.addEventListener("mousedown", this._dragWindow.bind(this), true);
     this._parentElement.addEventListener("mousewheel", this._onMouseWheel.bind(this), true);
     this._parentElement.addEventListener("dblclick", this._resizeWindowMaximum.bind(this), true);
 
@@ -390,11 +397,13 @@ WebInspector.TimelineOverviewWindow = function(parentElement)
     this._leftResizeElement.className = "timeline-window-resizer";
     this._leftResizeElement.style.left = 0;
     parentElement.appendChild(this._leftResizeElement);
+    WebInspector.installDragHandle(this._leftResizeElement, null, this._leftResizeElementDragging.bind(this), null, "ew-resize");
 
     this._rightResizeElement = document.createElement("div");
     this._rightResizeElement.className = "timeline-window-resizer timeline-window-resizer-right";
     this._rightResizeElement.style.right = 0;
     parentElement.appendChild(this._rightResizeElement);
+    WebInspector.installDragHandle(this._rightResizeElement, null, this._rightResizeElementDragging.bind(this), null, "ew-resize");
 }
 
 WebInspector.TimelineOverviewWindow.Events = {
@@ -415,53 +424,49 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this._rightResizeElement.style.left = "100%";
     },
 
-    _resizeWindow: function(resizeElement, event)
+    /**
+     * @param {Event} event
+     */
+    _leftResizeElementDragging: function(event)
     {
-        WebInspector.elementDragStart(resizeElement, this._windowResizeDragging.bind(this, resizeElement), this._endWindowDragging.bind(this), event, "ew-resize");
+      this._resizeWindowLeft(event.pageX - this._parentElement.offsetLeft);
+      event.preventDefault();
     },
 
-    _windowResizeDragging: function(resizeElement, event)
+    /**
+     * @param {Event} event
+     */
+    _rightResizeElementDragging: function(event)
     {
-        if (resizeElement === this._leftResizeElement)
-            this._resizeWindowLeft(event.pageX - this._parentElement.offsetLeft);
-        else
-            this._resizeWindowRight(event.pageX - this._parentElement.offsetLeft);
-        event.preventDefault();
+      this._resizeWindowRight(event.pageX - this._parentElement.offsetLeft);
+      event.preventDefault();
     },
 
-    _dragWindow: function(event)
+    /**
+     * @param {Event} event
+     * @return {boolean}
+     */
+    _startWindowSelectorDragging: function(event)
     {
-        // Only drag upon left button. Right will likely cause a context menu.
-        if (event.button)
-            return;
-        var node = event.target;
-        while (node) {
-            if (node.hasStyleClass("resources-dividers-label-bar")) {
-                WebInspector.elementDragStart(this._overviewWindowElement, this._windowDragging.bind(this, event.pageX,
-                    this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset, this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset), this._endWindowDragging.bind(this), event, "ew-resize");
-                break;
-            } else if (node === this._parentElement) {
-                var position = event.pageX - this._parentElement.offsetLeft;
-                this._overviewWindowSelector = new WebInspector.TimelineOverviewPane.WindowSelector(this._parentElement, position);
-                WebInspector.elementDragStart(null, this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), event, "ew-resize");
-                break;
-            } else if (node === this._leftResizeElement || node === this._rightResizeElement) {
-                this._resizeWindow(node, event);
-                break;
-            }
-            node = node.parentNode;
-        }
+        var position = event.pageX - this._parentElement.offsetLeft;
+        this._overviewWindowSelector = new WebInspector.TimelineOverviewPane.WindowSelector(this._parentElement, position);
+        return true;
     },
 
+    /**
+     * @param {Event} event
+     */
     _windowSelectorDragging: function(event)
     {
         this._overviewWindowSelector._updatePosition(event.pageX - this._parentElement.offsetLeft);
         event.preventDefault();
     },
 
+    /**
+     * @param {Event} event
+     */
     _endWindowSelectorDragging: function(event)
     {
-        WebInspector.elementDragEnd(event);
         var window = this._overviewWindowSelector._close(event.pageX - this._parentElement.offsetLeft);
         delete this._overviewWindowSelector;
         if (window.end === window.start) { // Click, not drag.
@@ -477,12 +482,45 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this._setWindowPosition(window.start, window.end);
     },
 
-    _windowDragging: function(startX, windowLeft, windowRight, event)
+    /**
+     * @param {Event} event
+     * @return {boolean}
+     */
+    _startWindowDragging: function(event)
+    {
+        var windowLeft = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
+        this._dragOffset = windowLeft - event.pageX;
+        return true;
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _windowDragging: function(event)
+    {
+        var windowLeft = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
+        var start = this._dragOffset + event.pageX;
+        this._moveWindow(start);
+        event.preventDefault();
+    },
+
+    /**
+     * @param {Event} event
+     */
+    _endWindowDragging: function(event)
+    {
+        delete this._dragOffset;
+    },
+
+    /**
+     * @param {number} start
+     */
+    _moveWindow: function(start)
     {
-        var delta = event.pageX - startX;
-        var start = windowLeft + delta;
-        var end = windowRight + delta;
+        var windowLeft = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
+        var windowRight = this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
         var windowSize = windowRight - windowLeft;
+        var end = start + windowSize;
 
         if (start < 0) {
             start = 0;
@@ -494,10 +532,11 @@ WebInspector.TimelineOverviewWindow.prototype = {
             start = end - windowSize;
         }
         this._setWindowPosition(start, end);
-
-        event.preventDefault();
     },
 
+    /**
+     * @param {number} start
+     */
     _resizeWindowLeft: function(start)
     {
         // Glue to edge.
@@ -508,6 +547,9 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this._setWindowPosition(start, null);
     },
 
+    /**
+     * @param {number} end
+     */
     _resizeWindowRight: function(end)
     {
         // Glue to edge.
@@ -533,6 +575,10 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this._setWindowPosition(left * clientWidth, right * clientWidth);
     },
 
+    /**
+     * @param {?number} start
+     * @param {?number} end
+     */
     _setWindowPosition: function(start, end)
     {
         var clientWidth = this._parentElement.clientWidth;
@@ -552,11 +598,9 @@ WebInspector.TimelineOverviewWindow.prototype = {
         this.dispatchEventToListeners(WebInspector.TimelineOverviewWindow.Events.WindowChanged);
     },
 
-    _endWindowDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
+    /**
+     * @param {Event} event
+     */
     _onMouseWheel: function(event)
     {
         const zoomFactor = 1.1;
@@ -567,10 +611,10 @@ WebInspector.TimelineOverviewWindow.prototype = {
             this._zoom(Math.pow(zoomFactor, -event.wheelDeltaY * mouseWheelZoomSpeed), referencePoint);
         }
         if (typeof event.wheelDeltaX === "number" && event.wheelDeltaX) {
-            this._windowDragging(event.pageX + Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor),
-                this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
-                this._rightResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset,
-                event);
+            var windowLeft = this._leftResizeElement.offsetLeft + WebInspector.TimelineOverviewPane.ResizerOffset;
+            var start = windowLeft - Math.round(event.wheelDeltaX * WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor);
+            this._moveWindow(start);
+            event.preventDefault();
         }
     },
 
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index baf6ab7e4..d7cc9cb3e 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -61,7 +61,7 @@ WebInspector.TimelinePanel = function()
 
     this._timelineMemorySplitter = this.element.createChild("div");
     this._timelineMemorySplitter.id = "timeline-memory-splitter";
-    this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
+    WebInspector.installDragHandle(this._timelineMemorySplitter, this._startSplitterDragging.bind(this), this._splitterDragging.bind(this), this._endSplitterDragging.bind(this), "ns-resize");
     this._timelineMemorySplitter.addStyleClass("hidden");
     this._memoryStatistics = new WebInspector.MemoryStatistics(this, this._model, this.splitView.preferredSidebarWidth());
     WebInspector.settings.memoryCounterGraphsHeight = WebInspector.settings.createSetting("memoryCounterGraphsHeight", 150);
@@ -149,11 +149,12 @@ WebInspector.TimelinePanel.rowHeight = 18;
 WebInspector.TimelinePanel.prototype = {
     /**
      * @param {Event} event
+     * @return {boolean}
      */
     _startSplitterDragging: function(event)
     {
         this._dragOffset = this._timelineMemorySplitter.offsetTop + 2 - event.pageY;
-        WebInspector.elementDragStart(this._timelineMemorySplitter, this._splitterDragging.bind(this), this._endSplitterDragging.bind(this), event, "ns-resize");
+        return true;
     },
 
     /**
@@ -172,7 +173,6 @@ WebInspector.TimelinePanel.prototype = {
     _endSplitterDragging: function(event)
     {
         delete this._dragOffset;
-        WebInspector.elementDragEnd(event);
         this._memoryStatistics.show();
         WebInspector.settings.memoryCounterGraphsHeight.set(this.splitView.element.offsetHeight);
     },
diff --git a/Source/WebCore/inspector/front-end/Toolbar.js b/Source/WebCore/inspector/front-end/Toolbar.js
index 6eb44725d..372ff67ac 100644
--- a/Source/WebCore/inspector/front-end/Toolbar.js
+++ b/Source/WebCore/inspector/front-end/Toolbar.js
@@ -35,7 +35,7 @@
 WebInspector.Toolbar = function()
 {
     this.element = document.getElementById("toolbar");
-    this.element.addEventListener("mousedown", this._toolbarDragStart.bind(this), true);
+    WebInspector.installDragHandle(this.element, this._toolbarDragStart.bind(this), this._toolbarDrag.bind(this), this._toolbarDragEnd.bind(this), (WebInspector.isCompactMode() ? "row-resize" : "default"));
 
     this._dropdownButton = document.getElementById("toolbar-dropdown-arrow");
     this._dropdownButton.addEventListener("click", this._toggleDropdown.bind(this), false);
@@ -65,28 +65,28 @@ WebInspector.Toolbar.prototype = {
         this.resize();
     },
 
+    /**
+     * @return {boolean}
+     */
     _toolbarDragStart: function(event)
     {
         if ((!WebInspector.isCompactMode() && WebInspector.platformFlavor() !== WebInspector.PlatformFlavor.MacLeopard && WebInspector.platformFlavor() !== WebInspector.PlatformFlavor.MacSnowLeopard) || WebInspector.port() == "qt")
-            return;
+            return false;
 
         var target = event.target;
         if (target.hasStyleClass("toolbar-item") && target.hasStyleClass("toggleable"))
-            return;
+            return false;
 
         if (target !== this.element && !target.hasStyleClass("toolbar-item"))
-            return;
+            return false;
 
         this.element.lastScreenX = event.screenX;
         this.element.lastScreenY = event.screenY;
-
-        WebInspector.elementDragStart(this.element, this._toolbarDrag.bind(this), this._toolbarDragEnd.bind(this), event, (WebInspector.isCompactMode() ? "row-resize" : "default"));
+        return true;
     },
 
     _toolbarDragEnd: function(event)
     {
-        WebInspector.elementDragEnd(event);
-
         delete this.element.lastScreenX;
         delete this.element.lastScreenY;
     },
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index c23ca652e..ce5b3dbdf 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -29,47 +29,75 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor)
+/**
+ * @param {Element} element
+ * @param {?function(Event): boolean} elementDragStart
+ * @param {function(Event)} elementDrag
+ * @param {?function(Event)} elementDragEnd
+ * @param {string} cursor
+ */
+WebInspector.installDragHandle = function(element, elementDragStart, elementDrag, elementDragEnd, cursor)
 {
-    if (WebInspector._elementDraggingEventListener || WebInspector._elementEndDraggingEventListener)
-        WebInspector.elementDragEnd(event);
+    element.addEventListener("mousedown", WebInspector._elementDragStart.bind(WebInspector, elementDragStart, elementDrag, elementDragEnd, cursor), false);
+}
 
-    if (element) {
-        // Install glass pane
-        if (WebInspector._elementDraggingGlassPane)
-            WebInspector._elementDraggingGlassPane.dispose();
+/**
+ * @param {?function(Event)} elementDragStart
+ * @param {function(Event)} elementDrag
+ * @param {?function(Event)} elementDragEnd
+ * @param {string} cursor
+ * @param {Event} event
+ */
+WebInspector._elementDragStart = function(elementDragStart, elementDrag, elementDragEnd, cursor, event)
+{
+    // Only drag upon left button. Right will likely cause a context menu.
+    if (event.button)
+        return;
 
-        WebInspector._elementDraggingGlassPane = new WebInspector.GlassPane();
-    }
+    if (WebInspector._elementDraggingEventListener)
+        return;
+
+    if (elementDragStart && !elementDragStart(event))
+        return;
 
-    WebInspector._elementDraggingEventListener = dividerDrag;
+    // Install glass pane
+    if (WebInspector._elementDraggingGlassPane)
+        WebInspector._elementDraggingGlassPane.dispose();
+
+    WebInspector._elementDraggingGlassPane = new WebInspector.GlassPane();
+
+    WebInspector._elementDraggingEventListener = elementDrag;
     WebInspector._elementEndDraggingEventListener = elementDragEnd;
 
     var targetDocument = event.target.ownerDocument;
-    targetDocument.addEventListener("mousemove", dividerDrag, true);
-    targetDocument.addEventListener("mouseup", elementDragEnd, true);
+    targetDocument.addEventListener("mousemove", WebInspector._elementDraggingEventListener, true);
+    targetDocument.addEventListener("mouseup", WebInspector._elementDragEnd, true);
 
     targetDocument.body.style.cursor = cursor;
 
     event.preventDefault();
 }
 
-WebInspector.elementDragEnd = function(event)
+WebInspector._elementDragEnd = function(event)
 {
     var targetDocument = event.target.ownerDocument;
     targetDocument.removeEventListener("mousemove", WebInspector._elementDraggingEventListener, true);
-    targetDocument.removeEventListener("mouseup", WebInspector._elementEndDraggingEventListener, true);
+    targetDocument.removeEventListener("mouseup", WebInspector._elementDragEnd, true);
 
     targetDocument.body.style.removeProperty("cursor");
 
     if (WebInspector._elementDraggingGlassPane)
         WebInspector._elementDraggingGlassPane.dispose();
 
+    var elementDragEnd = WebInspector._elementEndDraggingEventListener;
+
     delete WebInspector._elementDraggingGlassPane;
     delete WebInspector._elementDraggingEventListener;
     delete WebInspector._elementEndDraggingEventListener;
 
     event.preventDefault();
+    if (elementDragEnd)
+        elementDragEnd(event);
 }
 
 /**
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index ed80781a9..6ff542eae 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -84,6 +84,10 @@
     display: none;
 }
 
+#timeline-overview-grid .resources-dividers-label-bar {
+    pointer-events: auto;
+}
+
 .timeline-window-selector {
     position: absolute;
     top: 0;
diff --git a/Source/WebCore/loader/DocumentWriter.h b/Source/WebCore/loader/DocumentWriter.h
index 26178a48c..5883229a7 100644
--- a/Source/WebCore/loader/DocumentWriter.h
+++ b/Source/WebCore/loader/DocumentWriter.h
@@ -43,7 +43,7 @@ class TextResourceDecoder;
 class DocumentWriter {
     WTF_MAKE_NONCOPYABLE(DocumentWriter);
 public:
-    DocumentWriter(Frame*);
+    explicit DocumentWriter(Frame*);
 
     // This is only called by ScriptController::executeIfJavaScriptURL
     // and always contains the result of evaluating a javascript: url.
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index a17e9493c..a027997ff 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -199,7 +199,6 @@ public:
 #endif
     
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
-    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return false; }
 };
diff --git a/Source/WebCore/loader/FrameNetworkingContext.h b/Source/WebCore/loader/FrameNetworkingContext.h
index dff1144fd..49e7a9e33 100644
--- a/Source/WebCore/loader/FrameNetworkingContext.h
+++ b/Source/WebCore/loader/FrameNetworkingContext.h
@@ -33,7 +33,7 @@ public:
     }
 
 protected:
-    FrameNetworkingContext(Frame* frame)
+    explicit FrameNetworkingContext(Frame* frame)
         : m_frame(frame)
     {
     }
diff --git a/Source/WebCore/loader/HistoryController.h b/Source/WebCore/loader/HistoryController.h
index 3b31e92ad..91b60a884 100644
--- a/Source/WebCore/loader/HistoryController.h
+++ b/Source/WebCore/loader/HistoryController.h
@@ -48,7 +48,7 @@ class HistoryController {
 public:
     enum HistoryUpdateType { UpdateAll, UpdateAllExceptBackForwardList };
 
-    HistoryController(Frame*);
+    explicit HistoryController(Frame*);
     ~HistoryController();
 
     void saveScrollPositionAndViewStateToItem(HistoryItem*);
diff --git a/Source/WebCore/loader/ImageLoader.h b/Source/WebCore/loader/ImageLoader.h
index 178807198..4f02c4154 100644
--- a/Source/WebCore/loader/ImageLoader.h
+++ b/Source/WebCore/loader/ImageLoader.h
@@ -43,7 +43,7 @@ typedef EventSender<ImageLoader> ImageEventSender;
 
 class ImageLoader : public CachedImageClient {
 public:
-    ImageLoader(ImageLoaderClient*);
+    explicit ImageLoader(ImageLoaderClient*);
     virtual ~ImageLoader();
 
     ImageLoaderClient* client() const { return m_client; }
diff --git a/Source/WebCore/loader/LinkLoader.h b/Source/WebCore/loader/LinkLoader.h
index 58b29a774..a1a63f03f 100644
--- a/Source/WebCore/loader/LinkLoader.h
+++ b/Source/WebCore/loader/LinkLoader.h
@@ -49,7 +49,7 @@ class PrerenderHandle;
 // The LinkLoader can load link rel types icon, dns-prefetch, subresource, prefetch and prerender.
 class LinkLoader : public CachedResourceClient {
 public:
-    LinkLoader(LinkLoaderClient*);
+    explicit LinkLoader(LinkLoaderClient*);
     virtual ~LinkLoader();
 
     // from CachedResourceClient
diff --git a/Source/WebCore/loader/MainResourceLoader.h b/Source/WebCore/loader/MainResourceLoader.h
index c3b822249..d526a2373 100644
--- a/Source/WebCore/loader/MainResourceLoader.h
+++ b/Source/WebCore/loader/MainResourceLoader.h
@@ -74,7 +74,7 @@ namespace WebCore {
         bool isLoadingMultipartContent() const { return m_loadingMultipartContent; }
 
     private:
-        MainResourceLoader(Frame*);
+        explicit MainResourceLoader(Frame*);
 
         virtual void willCancel(const ResourceError&) OVERRIDE;
         virtual void didCancel(const ResourceError&) OVERRIDE;
diff --git a/Source/WebCore/loader/NavigationAction.h b/Source/WebCore/loader/NavigationAction.h
index eeee88c30..c36b170ee 100644
--- a/Source/WebCore/loader/NavigationAction.h
+++ b/Source/WebCore/loader/NavigationAction.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class NavigationAction {
     public:
         NavigationAction();
-        NavigationAction(const ResourceRequest&);
+        explicit NavigationAction(const ResourceRequest&);
         NavigationAction(const ResourceRequest&, NavigationType);
         NavigationAction(const ResourceRequest&, FrameLoadType, bool isFormSubmission);
         NavigationAction(const ResourceRequest&, NavigationType, PassRefPtr<Event>);
diff --git a/Source/WebCore/loader/NavigationScheduler.h b/Source/WebCore/loader/NavigationScheduler.h
index f5516dc00..620a725ea 100644
--- a/Source/WebCore/loader/NavigationScheduler.h
+++ b/Source/WebCore/loader/NavigationScheduler.h
@@ -68,7 +68,7 @@ class NavigationScheduler {
     WTF_MAKE_NONCOPYABLE(NavigationScheduler);
 
 public:
-    NavigationScheduler(Frame*);
+    explicit NavigationScheduler(Frame*);
     ~NavigationScheduler();
 
     bool redirectScheduledDuringLoad();
diff --git a/Source/WebCore/loader/PolicyChecker.h b/Source/WebCore/loader/PolicyChecker.h
index 2627f03b1..b7176e1fa 100644
--- a/Source/WebCore/loader/PolicyChecker.h
+++ b/Source/WebCore/loader/PolicyChecker.h
@@ -48,7 +48,7 @@ class ResourceResponse;
 class PolicyChecker {
     WTF_MAKE_NONCOPYABLE(PolicyChecker);
 public:
-    PolicyChecker(Frame*);
+    explicit PolicyChecker(Frame*);
 
     void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
     void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
diff --git a/Source/WebCore/loader/SubframeLoader.h b/Source/WebCore/loader/SubframeLoader.h
index 312675505..7f65585b6 100644
--- a/Source/WebCore/loader/SubframeLoader.h
+++ b/Source/WebCore/loader/SubframeLoader.h
@@ -58,7 +58,7 @@ class Widget;
 class SubframeLoader {
     WTF_MAKE_NONCOPYABLE(SubframeLoader);
 public:
-    SubframeLoader(Frame*);
+    explicit SubframeLoader(Frame*);
 
     void clear();
 
diff --git a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
index b87d00e27..b1a1e2dff 100644
--- a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
+++ b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
@@ -116,7 +116,7 @@ public:
 #endif
 
 protected:
-    ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
+    explicit ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
         : m_client(client)
         , m_done(false)
     {
diff --git a/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp b/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
index 2dbe75e54..61732b115 100644
--- a/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
+++ b/Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp
@@ -43,6 +43,7 @@ namespace WebCore {
 CachedCSSStyleSheet::CachedCSSStyleSheet(const ResourceRequest& resourceRequest, const String& charset)
     : CachedResource(resourceRequest, CSSStyleSheet)
     , m_decoder(TextResourceDecoder::create("text/css", charset))
+    , m_decodedDataDeletionTimer(this, &CachedCSSStyleSheet::decodedDataDeletionTimerFired)
 {
     // Prefer text/css but accept any type (dell.com serves a stylesheet
     // as text/html; see <http://bugs.webkit.org/show_bug.cgi?id=11451>).
@@ -58,14 +59,17 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 void CachedCSSStyleSheet::didAddClient(CachedResourceClient* c)
 {
     ASSERT(c->resourceClientType() == CachedStyleSheetClient::expectedType());
+    if (m_decodedDataDeletionTimer.isActive())
+        m_decodedDataDeletionTimer.stop();
+
     if (!isLoading())
         static_cast<CachedStyleSheetClient*>(c)->setCSSStyleSheet(m_resourceRequest.url(), m_response.url(), m_decoder->encoding().name(), this);
 }
 
 void CachedCSSStyleSheet::allClientsRemoved()
 {
-    if (!MemoryCache::shouldMakeResourcePurgeableOnEviction() && isSafeToMakePurgeable())
-        makePurgeable(true);
+    if (double interval = memoryCache()->deadDecodedDataDeletionInterval())
+        m_decodedDataDeletionTimer.startOneShot(interval);
 }
 
 void CachedCSSStyleSheet::setEncoding(const String& chs)
@@ -163,6 +167,14 @@ void CachedCSSStyleSheet::destroyDecodedData()
     m_parsedStyleSheetCache.clear();
 
     setDecodedSize(0);
+
+    if (!MemoryCache::shouldMakeResourcePurgeableOnEviction() && isSafeToMakePurgeable())
+        makePurgeable(true);
+}
+
+void CachedCSSStyleSheet::decodedDataDeletionTimerFired(Timer<CachedCSSStyleSheet>*)
+{
+    destroyDecodedData();
 }
 
 PassRefPtr<StyleSheetContents> CachedCSSStyleSheet::restoreParsedStyleSheet(const CSSParserContext& context)
diff --git a/Source/WebCore/loader/cache/CachedCSSStyleSheet.h b/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
index b70f265dd..9f51f30aa 100644
--- a/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
+++ b/Source/WebCore/loader/cache/CachedCSSStyleSheet.h
@@ -27,6 +27,7 @@
 #define CachedCSSStyleSheet_h
 
 #include "CachedResource.h"
+#include "Timer.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -61,12 +62,14 @@ namespace WebCore {
         void saveParsedStyleSheet(PassRefPtr<StyleSheetContents>);
     
     private:
+        void decodedDataDeletionTimerFired(Timer<CachedCSSStyleSheet>*);
         bool canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const;
         virtual PurgePriority purgePriority() const { return PurgeLast; }
 
     protected:
         RefPtr<TextResourceDecoder> m_decoder;
         String m_decodedSheetText;
+        Timer<CachedCSSStyleSheet> m_decodedDataDeletionTimer;
 
         RefPtr<StyleSheetContents> m_parsedStyleSheetCache;
     };
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index da09dc831..dc52acca6 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -340,7 +340,6 @@ namespace WebCore {
         virtual bool shouldRunModalDialogDuringPageDismissal(const DialogType&, const String& dialogMessage, FrameLoader::PageDismissalType) const { UNUSED_PARAM(dialogMessage); return true; }
 
         virtual void numWheelEventHandlersChanged(unsigned) = 0;
-        virtual void numTouchEventHandlersChanged(unsigned) = 0;
         
         virtual bool isSVGImageChromeClient() const { return false; }
 
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 3f4749f27..27285766b 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -369,6 +369,7 @@ module window {
         attribute DocumentConstructor Document;
         attribute NodeConstructor Node;
         attribute NodeListConstructor NodeList;
+        attribute [Conditional=MICRODATA] PropertyNodeListConstructor PropertyNodeList;
         attribute NamedNodeMapConstructor NamedNodeMap;
         attribute CharacterDataConstructor CharacterData;
         attribute AttrConstructor Attr;
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 32c95b456..1d2d375c3 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -93,7 +93,7 @@ enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
 class EventHandler {
     WTF_MAKE_NONCOPYABLE(EventHandler);
 public:
-    EventHandler(Frame*);
+    explicit EventHandler(Frame*);
     ~EventHandler();
 
     void clear();
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 5ab6da37e..4f81b9c88 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -119,10 +119,15 @@ Element* FocusScope::owner() const
 FocusScope FocusScope::focusScopeOf(Node* node)
 {
     ASSERT(node);
-    TreeScope* scope = node->treeScope();
-    if (scope->rootNode()->isShadowRoot())
-        return FocusScope(toShadowRoot(scope->rootNode())->owner()->youngestShadowRoot());
-    return FocusScope(scope);
+    ComposedShadowTreeWalker walker(node, ComposedShadowTreeWalker::DoNotCrossUpperBoundary);
+    Node* root = node;
+    while (walker.get()) {
+        root = walker.get();
+        walker.parent();
+    }
+    // The result is not always a ShadowRoot nor a DocumentNode since
+    // a starting node is in an orphaned tree in composed shadow tree.
+    return FocusScope(root->treeScope());
 }
 
 FocusScope FocusScope::focusScopeOwnedByShadowHost(Node* node)
diff --git a/Source/WebCore/page/FocusController.h b/Source/WebCore/page/FocusController.h
index 89089e710..75223d60a 100644
--- a/Source/WebCore/page/FocusController.h
+++ b/Source/WebCore/page/FocusController.h
@@ -82,7 +82,7 @@ public:
     bool containingWindowIsVisible() const { return m_containingWindowIsVisible; }
 
 private:
-    FocusController(Page*);
+    explicit FocusController(Page*);
 
     bool advanceFocusDirectionally(FocusDirection, KeyboardEvent*);
     bool advanceFocusInDocumentOrder(FocusDirection, KeyboardEvent*, bool initialFocus);
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 5146e735f..569208fec 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -308,7 +308,10 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
 
     if (m_page && m_page->mainFrame() == this) {
         notifyChromeClientWheelEventHandlerCountChanged();
-        notifyChromeClientTouchEventHandlerCountChanged();
+#if ENABLE(TOUCH_EVENTS)
+        if (m_doc && m_doc->hasListenerType(Document::TOUCH_LISTENER))
+            m_page->chrome()->client()->needTouchEvents(true);
+#endif
     }
 
     // Suspend document if this frame was created in suspended state.
@@ -1038,20 +1041,6 @@ void Frame::notifyChromeClientWheelEventHandlerCountChanged() const
     m_page->chrome()->client()->numWheelEventHandlersChanged(count);
 }
 
-void Frame::notifyChromeClientTouchEventHandlerCountChanged() const
-{
-    // Ensure that this method is being called on the main frame of the page.
-    ASSERT(m_page && m_page->mainFrame() == this);
-
-    unsigned count = 0;
-    for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
-        if (frame->document())
-            count += frame->document()->touchEventHandlerCount();
-    }
-
-    m_page->chrome()->client()->numTouchEventHandlersChanged(count);
-}
-
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 struct ScopedFramePaintingState {
     ScopedFramePaintingState(Frame* frame, Node* node)
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 46bebd11d..00c04a358 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -199,7 +199,6 @@ namespace WebCore {
 
         // Should only be called on the main frame of a page.
         void notifyChromeClientWheelEventHandlerCountChanged() const;
-        void notifyChromeClientTouchEventHandlerCountChanged() const;
 
     // ========
 
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 08ceeffb9..c6b50b73e 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -347,7 +347,7 @@ protected:
     virtual bool isFlippedDocument() const;
 
 private:
-    FrameView(Frame*);
+    explicit FrameView(Frame*);
 
     void reset();
     void init();
diff --git a/Source/WebCore/page/MemoryInfo.h b/Source/WebCore/page/MemoryInfo.h
index 27a7344b8..79ce4172b 100644
--- a/Source/WebCore/page/MemoryInfo.h
+++ b/Source/WebCore/page/MemoryInfo.h
@@ -47,7 +47,7 @@ public:
     size_t jsHeapSizeLimit() const { return m_jsHeapSizeLimit; }
 
 private:
-    MemoryInfo(Frame*);
+    explicit MemoryInfo(Frame*);
 
     size_t m_totalJSHeapSize;
     size_t m_usedJSHeapSize;
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index e618036d2..d759fb86f 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -125,7 +125,7 @@ namespace WebCore {
             RefPtr<BackForwardList> backForwardClient;
         };
 
-        Page(PageClients&);
+        explicit Page(PageClients&);
         ~Page();
 
         ArenaSize renderTreeSize() const;
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index 1362d17e2..98c51dd59 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -46,7 +46,7 @@ namespace WebCore {
     class PageGroup : public Supplementable<PageGroup> {
         WTF_MAKE_NONCOPYABLE(PageGroup); WTF_MAKE_FAST_ALLOCATED;
     public:
-        PageGroup(const String& name);
+        explicit PageGroup(const String& name);
         ~PageGroup();
 
         static PassOwnPtr<PageGroup> create(Page*);
diff --git a/Source/WebCore/page/PrintContext.h b/Source/WebCore/page/PrintContext.h
index 873937ab6..2efd05d3f 100644
--- a/Source/WebCore/page/PrintContext.h
+++ b/Source/WebCore/page/PrintContext.h
@@ -35,7 +35,7 @@ class IntRect;
 
 class PrintContext {
 public:
-    PrintContext(Frame*);
+    explicit PrintContext(Frame*);
     ~PrintContext();
 
     Frame* frame() const { return m_frame; }
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 5be49dff1..747af7642 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -604,7 +604,7 @@ namespace WebCore {
         bool cookieEnabled() const { return m_cookieEnabled; }
 
     private:
-        Settings(Page*);
+        explicit Settings(Page*);
 
         void initializeDefaultFontFamilies();
 
diff --git a/Source/WebCore/page/SpeechInput.h b/Source/WebCore/page/SpeechInput.h
index 01148f3e5..38113a06d 100644
--- a/Source/WebCore/page/SpeechInput.h
+++ b/Source/WebCore/page/SpeechInput.h
@@ -77,7 +77,7 @@ public:
     virtual void setRecognitionResult(int, const SpeechInputResultArray&);
 
 private:
-    SpeechInput(SpeechInputClient*);
+    explicit SpeechInput(SpeechInputClient*);
 
     SpeechInputClient* m_client;
     HashMap<int, SpeechInputListener*> m_listeners;
diff --git a/Source/WebCore/page/SpeechInputResultList.h b/Source/WebCore/page/SpeechInputResultList.h
index b050630b1..8556aecf0 100644
--- a/Source/WebCore/page/SpeechInputResultList.h
+++ b/Source/WebCore/page/SpeechInputResultList.h
@@ -45,7 +45,7 @@ public:
     SpeechInputResult* item(unsigned index);
 
 private:
-    SpeechInputResultList(const SpeechInputResultArray& results);
+    explicit SpeechInputResultList(const SpeechInputResultArray& results);
 
     SpeechInputResultArray m_results;
 };
diff --git a/Source/WebCore/page/WebKitAnimation.h b/Source/WebCore/page/WebKitAnimation.h
index bef74382a..65e05efb3 100644
--- a/Source/WebCore/page/WebKitAnimation.h
+++ b/Source/WebCore/page/WebKitAnimation.h
@@ -70,7 +70,7 @@ public:
     void pause();
 
 protected:
-    WebKitAnimation(PassRefPtr<KeyframeAnimation>);
+    explicit WebKitAnimation(PassRefPtr<KeyframeAnimation>);
 
 private:
     RefPtr<KeyframeAnimation> m_keyframeAnimation;
diff --git a/Source/WebCore/page/WindowFeatures.h b/Source/WebCore/page/WindowFeatures.h
index ea5768f55..7449d850e 100644
--- a/Source/WebCore/page/WindowFeatures.h
+++ b/Source/WebCore/page/WindowFeatures.h
@@ -54,7 +54,7 @@ namespace WebCore {
         {
         }
 
-        WindowFeatures(const String& windowFeaturesString);
+        explicit WindowFeatures(const String& windowFeaturesString);
         WindowFeatures(const String& dialogFeaturesString, const FloatRect& screenAvailableRect);
 
         float x;
diff --git a/Source/WebCore/page/WorkerNavigator.h b/Source/WebCore/page/WorkerNavigator.h
index 8ca2fd93d..4622b741b 100644
--- a/Source/WebCore/page/WorkerNavigator.h
+++ b/Source/WebCore/page/WorkerNavigator.h
@@ -44,7 +44,7 @@ namespace WebCore {
         virtual String userAgent() const;
 
     private:
-        WorkerNavigator(const String&);
+        explicit WorkerNavigator(const String&);
 
         String m_userAgent;
     };
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 1a766370d..d0ac82d31 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -56,7 +56,8 @@ enum CalcExpressionNodeType {
     CalcExpressionNodeUndefined,
     CalcExpressionNodeNumber,
     CalcExpressionNodeLength,
-    CalcExpressionNodeBinaryOperation
+    CalcExpressionNodeBinaryOperation,
+    CalcExpressionNodeBlendLength,
 };
         
 class CalcExpressionNode {
@@ -183,6 +184,37 @@ private:
     CalcOperator m_operator;
 };
 
+class CalcExpressionBlendLength : public CalcExpressionNode {
+public:
+    CalcExpressionBlendLength(Length from, Length to, float progress)
+        : m_from(from)
+        , m_to(to)
+        , m_progress(progress)
+    {
+        m_type = CalcExpressionNodeBlendLength;
+    }
+    
+    bool operator==(const CalcExpressionBlendLength& o) const
+    {
+        return m_progress == o.m_progress && m_from == o.m_from && m_to == o.m_to;
+    }
+    
+    virtual bool operator==(const CalcExpressionNode& o) const
+    {
+        return type() == o.type() && *this == static_cast<const CalcExpressionBlendLength&>(o);
+    }
+    
+    virtual float evaluate(float maxValue) const
+    {
+        return (1.0f - m_progress) * floatValueForLength(m_from, maxValue) + m_progress * floatValueForLength(m_to, maxValue);
+    }
+    
+private:  
+    Length m_from;
+    Length m_to;
+    float m_progress;
+};
+    
 } // namespace WebCore
 
 #endif // CalculationValue_h
diff --git a/Source/WebCore/platform/LayoutTestSupport.cpp b/Source/WebCore/platform/LayoutTestSupport.cpp
new file mode 100644
index 000000000..0c77f8702
--- /dev/null
+++ b/Source/WebCore/platform/LayoutTestSupport.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LayoutTestSupport.h"
+
+namespace WebCore {
+
+static bool s_isRunningLayoutTest = false;
+
+bool isRunningLayoutTest()
+{
+    return s_isRunningLayoutTest;
+}
+
+void setIsRunningLayoutTest(bool value)
+{
+    s_isRunningLayoutTest = value;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/LayoutTestSupport.h b/Source/WebCore/platform/LayoutTestSupport.h
new file mode 100644
index 000000000..48aa2191a
--- /dev/null
+++ b/Source/WebCore/platform/LayoutTestSupport.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayoutTestSupport_h
+#define LayoutTestSupport_h
+
+namespace WebCore {
+
+bool isRunningLayoutTest();
+void setIsRunningLayoutTest(bool);
+
+} // namespace WebCore
+
+#endif // LayoutTestSupport_h
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 9d93cc69f..110dbcd96 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -210,17 +210,7 @@ Length Length::blendCalculation(const Length& from, double progress) const
     if (progress >= 1.0)
         return *this;
         
-    // FIXME: https://webkit.org/b/90037 - some of these allocations can be eliminated
-    OwnPtr<CalcExpressionNode> startScale = adoptPtr(new CalcExpressionNumber(1.0 - progress));
-    OwnPtr<CalcExpressionNode> startLength = adoptPtr(new CalcExpressionLength(from));
-    OwnPtr<CalcExpressionNode> startNode = adoptPtr(new CalcExpressionBinaryOperation(startScale.release(), startLength.release(), CalcMultiply));
-    
-    OwnPtr<CalcExpressionNode> endScale = adoptPtr(new CalcExpressionNumber(progress));
-    OwnPtr<CalcExpressionNode> endLength = adoptPtr(new CalcExpressionLength(*this));
-    OwnPtr<CalcExpressionNode> endNode = adoptPtr(new CalcExpressionBinaryOperation(endScale.release(), endLength.release(), CalcMultiply));
-    
-    OwnPtr<CalcExpressionNode> blend = adoptPtr(new CalcExpressionBinaryOperation(startNode.release(), endNode.release(), CalcAdd));
-        
+    OwnPtr<CalcExpressionNode> blend = adoptPtr(new CalcExpressionBlendLength(from, *this, progress));
     return Length(CalculationValue::create(blend.release(), CalculationRangeAll));
 }
           
diff --git a/Source/WebCore/platform/ScrollbarTheme.h b/Source/WebCore/platform/ScrollbarTheme.h
index 5fe45b1a4..cccc2f925 100644
--- a/Source/WebCore/platform/ScrollbarTheme.h
+++ b/Source/WebCore/platform/ScrollbarTheme.h
@@ -86,6 +86,7 @@ public:
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { defaultPaintScrollCorner(context, cornerRect); }
     static void defaultPaintScrollCorner(GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB); }
 
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect&, const IntRect&, const IntRect&) { }
 
 #if USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.h b/Source/WebCore/platform/ScrollbarThemeComposite.h
index 696db12b1..dfd15ed18 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.h
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.h
@@ -60,7 +60,6 @@ public:
     virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
     virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
     virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
-    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
 
     virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect& rect) { return rect; }
 };
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index c113f8ffd..0c43b9353 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -128,9 +128,6 @@ public:
     static void notifyJSOutOfMemory(Frame*);
     static bool allowScriptDespiteSettings(const KURL& documentURL);
 
-    // LayoutTestMode -----------------------------------------------------
-    static bool layoutTestMode();
-
     // Plugin -------------------------------------------------------------
     static bool plugins(bool refresh, Vector<PluginInfo>*);
     static NPObject* pluginScriptableObject(Widget*);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index 682d82d5b..4a4938ac8 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -113,14 +113,8 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarT
     if (!tickmarks.size())
         return;
 
-    // Get the image for the tickmarks.
-    DEFINE_STATIC_LOCAL(RefPtr<Image>, dash, (Image::loadPlatformResource("tickmarkDash")));
-    if (dash->isNull()) {
-        ASSERT_NOT_REACHED();
-        return;
-    }
-
-    context->save();
+    GraphicsContextStateSaver stateSaver(*context);
+    context->setShouldAntialias(false);
 
     for (Vector<IntRect>::const_iterator i = tickmarks.begin(); i != tickmarks.end(); ++i) {
         // Calculate how far down (in %) the tick-mark should appear.
@@ -129,11 +123,14 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarT
         // Calculate how far down (in pixels) the tick-mark should appear.
         const int yPos = rect.y() + (rect.height() * percent);
 
-        IntPoint tick(scrollbar->x(), yPos);
-        context->drawImage(dash.get(), ColorSpaceDeviceRGB, tick);
-    }
+        context->setFillColor(Color(0xCC, 0xAA, 0x00, 0xFF), ColorSpaceDeviceRGB);
+        FloatRect tickRect(rect.x(), yPos, rect.width(), 3);
+        context->fillRect(tickRect);
 
-    context->restore();
+        context->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), ColorSpaceDeviceRGB);
+        FloatRect tickStroke(rect.x(), yPos + 1, rect.width(), 1);
+        context->fillRect(tickStroke);
+    }
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
index e1e55a1fc..35ce97833 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
@@ -26,18 +26,21 @@
 #include "config.h"
 #include "ScrollbarThemeChromiumAndroid.h"
 
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformSupport.h"
 #include "Scrollbar.h"
 #include "TransformationMatrix.h"
 
+#include <algorithm>
+
+using namespace std;
+
 namespace WebCore {
 
-// On Android, the threaded compositor is in charge of drawing the scrollbar,
-// so set the internal scrollbar thickness and button length to be zero.
-static const int scrollbarThicknessValue = 0;
-static const int buttonLength = 0;
+static const int scrollbarWidth = 8;
+static const int scrollbarMargin = 5;
 
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
@@ -47,40 +50,107 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
 
 int ScrollbarThemeChromiumAndroid::scrollbarThickness(ScrollbarControlSize controlSize)
 {
-    if (PlatformSupport::layoutTestMode()) {
+    if (isRunningLayoutTest()) {
         // Match Chromium-Linux for DumpRenderTree, so the layout test results
         // can be shared. The width of scrollbar down arrow should equal the
         // width of the vertical scrollbar.
         IntSize scrollbarSize = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarDownArrow);
         return scrollbarSize.width();
     }
-    return scrollbarThicknessValue;
+
+    return scrollbarWidth + scrollbarMargin;
 }
 
-void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
+int ScrollbarThemeChromiumAndroid::thumbPosition(ScrollbarThemeClient* scrollbar)
 {
-    // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
-    // on their previous state, which makes the dumped result undetermined.
-    if (PlatformSupport::layoutTestMode())
-        context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
+    if (!scrollbar->totalSize())
+        return 0;
+
+    int trackLen = trackLength(scrollbar);
+    float proportion = static_cast<float>(scrollbar->currentPos()) / scrollbar->totalSize();
+    return round(proportion * trackLen);
+}
+
+int ScrollbarThemeChromiumAndroid::thumbLength(ScrollbarThemeClient* scrollbar)
+{
+    int trackLen = trackLength(scrollbar);
+
+    if (!scrollbar->totalSize())
+        return trackLen;
+
+    float proportion = (float)scrollbar->visibleSize() / scrollbar->totalSize();
+    int length = round(proportion * trackLen);
+    length = min(max(length, minimumThumbLength(scrollbar)), trackLen);
+    return length;
+}
+
+IntRect ScrollbarThemeChromiumAndroid::backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool)
+{
+    return IntRect();
+}
+
+IntRect ScrollbarThemeChromiumAndroid::forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool)
+{
+    return IntRect();
 }
 
-bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
+IntRect ScrollbarThemeChromiumAndroid::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
-    return true;
+    IntRect rect = scrollbar->frameRect();
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        rect.inflateX(-scrollbarMargin);
+    else
+        rect.inflateY(-scrollbarMargin);
+    return rect;
 }
 
-IntSize ScrollbarThemeChromiumAndroid::buttonSize(ScrollbarThemeClient* scrollbar)
+static void fillSmoothEdgedRect(GraphicsContext* context, const IntRect& rect, const Color& color)
 {
-    if (scrollbar->orientation() == VerticalScrollbar)
-        return IntSize(scrollbarThicknessValue, buttonLength);
+    Color halfColor(color.red(), color.green(), color.blue(), color.alpha() / 2);
+
+    IntRect topRect = rect;
+    topRect.inflateX(-1);
+    topRect.setHeight(1);
+    context->fillRect(topRect, halfColor, ColorSpaceDeviceRGB);
+
+    IntRect leftRect = rect;
+    leftRect.inflateY(-1);
+    leftRect.setWidth(1);
+    context->fillRect(leftRect, halfColor, ColorSpaceDeviceRGB);
+
+    IntRect centerRect = rect;
+    centerRect.inflate(-1);
+    context->fillRect(centerRect, color, ColorSpaceDeviceRGB);
+
+    IntRect rightRect = rect;
+    rightRect.inflateY(-1);
+    rightRect.setX(centerRect.maxX());
+    rightRect.setWidth(1);
+    context->fillRect(rightRect, halfColor, ColorSpaceDeviceRGB);
 
-    return IntSize(buttonLength, scrollbarThicknessValue);
+    IntRect bottomRect = rect;
+    bottomRect.inflateX(-1);
+    bottomRect.setY(centerRect.maxY());
+    bottomRect.setHeight(1);
+    context->fillRect(bottomRect, halfColor, ColorSpaceDeviceRGB);
 }
 
-int ScrollbarThemeChromiumAndroid::minimumThumbLength(ScrollbarThemeClient* scrollbar)
+void ScrollbarThemeChromiumAndroid::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
-    return 2 * scrollbarThickness(scrollbar->controlSize());
+    IntRect thumbRect = rect;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        thumbRect.setHeight(thumbRect.height() - scrollbarMargin);
+    else
+        thumbRect.setWidth(thumbRect.width() - scrollbarMargin);
+    fillSmoothEdgedRect(context, thumbRect, Color(128, 128, 128, 128));
+}
+
+void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
+{
+    // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
+    // on their previous state, which makes the dumped result undetermined.
+    if (isRunningLayoutTest())
+        context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
index f3db80e52..3b40ab9fb 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
@@ -30,15 +30,23 @@
 
 namespace WebCore {
 
-class ScrollbarThemeChromiumAndroid : public ScrollbarThemeChromium {
+class ScrollbarThemeChromiumAndroid : public ScrollbarThemeComposite {
 public:
     virtual int scrollbarThickness(ScrollbarControlSize);
+    virtual bool usesOverlayScrollbars() const { return true; }
 
-protected:
+    virtual int thumbPosition(ScrollbarThemeClient*);
+    virtual int thumbLength(ScrollbarThemeClient*);
+
+    virtual bool hasButtons(ScrollbarThemeClient*) { return false; };
+    virtual bool hasThumb(ScrollbarThemeClient*) { return true; };
+
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
+
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
     virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
-    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
-    virtual IntSize buttonSize(ScrollbarThemeClient*);
-    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
index 19346e723..efbdd0992 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -39,6 +39,7 @@ public:
     virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) OVERRIDE;
     
 private:
     void paintGivenTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, const Vector<IntRect>&);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index 75e4a29c8..73d79b0bc 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -227,7 +227,7 @@ bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsC
     }
     // The ends are rounded and the thumb doesn't go there.
     tickmarkTrackRect.inflateY(-tickmarkTrackRect.width());
-    // Inset by 2 on the left and 3 on the right.
+    // Inset a bit.
     tickmarkTrackRect.setX(tickmarkTrackRect.x() + 2);
     tickmarkTrackRect.setWidth(tickmarkTrackRect.width() - 5);
     paintGivenTickmarks(drawingContext, scrollbar, tickmarkTrackRect, tickmarks);
@@ -409,5 +409,25 @@ void ScrollbarThemeChromiumMac::paintOverhangAreas(ScrollView* view, GraphicsCon
     }
 }
 
+void ScrollbarThemeChromiumMac::paintTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
+{
+    // Note: This is only used for css-styled scrollbars on mac.
+    if (scrollbar->orientation() != VerticalScrollbar)
+        return;
+
+    if (rect.height() <= 0 || rect.width() <= 0)
+        return;
+
+    Vector<IntRect> tickmarks;
+    scrollbar->getTickmarks(tickmarks);
+    if (!tickmarks.size())
+        return;
+
+    // Inset a bit.
+    IntRect tickmarkTrackRect = rect;
+    tickmarkTrackRect.setX(tickmarkTrackRect.x() + 1);
+    tickmarkTrackRect.setWidth(tickmarkTrackRect.width() - 2);
+    paintGivenTickmarks(context, scrollbar, tickmarkTrackRect, tickmarks);
+}
 
 }
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index a08198347..33251ed6d 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -31,6 +31,7 @@
 #include <vsstyle.h>
 
 #include "GraphicsContext.h"
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformSupport.h"
@@ -61,7 +62,7 @@ int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSi
 {
     static int thickness;
     if (!thickness) {
-        if (PlatformSupport::layoutTestMode())
+        if (isRunningLayoutTest())
             return kMacScrollbarSize[controlSize];
         thickness = GetSystemMetrics(SM_CXVSCROLL);
     }
@@ -256,7 +257,7 @@ IntSize ScrollbarThemeChromiumWin::buttonSize(ScrollbarThemeClient* scrollbar)
     // test mode so that should be enough to result in repeatable results, but
     // preserving this hack avoids having to rebaseline pixel tests.
     const int kLayoutTestModeGirth = 17;
-    int girth = PlatformSupport::layoutTestMode() ? kLayoutTestModeGirth : thickness;
+    int girth = isRunningLayoutTest() ? kLayoutTestModeGirth : thickness;
 
     if (scrollbar->orientation() == HorizontalScrollbar) {
         int width = scrollbar->width() < 2 * girth ? scrollbar->width() / 2 : girth;
diff --git a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
index 75a7689e3..e7b1a22cf 100644
--- a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
+++ b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
@@ -176,4 +176,9 @@ void Extensions3DChromium::copyTextureCHROMIUM(GC3Denum target, Platform3DObject
     m_private->webContext()->copyTextureCHROMIUM(target, sourceId, destId, level, internalFormat);
 }
 
+void Extensions3DChromium::shallowFlushCHROMIUM()
+{
+    return m_private->webContext()->shallowFlushCHROMIUM();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index e5784af03..b466cbf0f 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -1105,7 +1105,9 @@ String RenderThemeEfl::formatMediaControlsCurrentTime(float currentTime, float d
 
 bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    Node* mediaNode = object->node() ? object->node()->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = object->node();
     if (!mediaNode || (!mediaNode->hasTagName(videoTag)))
         return false;
 
@@ -1117,7 +1119,9 @@ bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const Pain
 
 bool RenderThemeEfl::paintMediaMuteButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    Node* mediaNode = object->node() ? object->node()->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = object->node();
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return false;
 
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index d80660da4..b3b61babb 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -38,7 +38,9 @@
 #if PLATFORM(QT)
 #if HAVE(QRAWFONT)
 #include <QRawFont>
+QT_BEGIN_NAMESPACE
 class QTextLayout;
+QT_END_NAMESPACE
 #else
 #include <QFont>
 #endif
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
index ef8232c5d..2fe641476 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
@@ -48,6 +48,15 @@ static double normalizedAnimationValue(double runningTime, double duration, Anim
     return shouldReverseAnimationValue(direction, loopCount) ? 1 - normalized : normalized;
 }
 
+static double normalizedAnimationValueForFillsForwards(double iterationCount, Animation::AnimationDirection direction)
+{
+    if (direction == Animation::AnimationDirectionNormal)
+        return 1;
+    if (direction == Animation::AnimationDirectionReverse)
+        return 0;
+    return shouldReverseAnimationValue(direction, iterationCount) ? 1 : 0;
+}
+
 static float applyOpacityAnimation(float fromOpacity, float toOpacity, double progress)
 {
     // Optimization: special case the edge values (0 and 1).
@@ -206,14 +215,17 @@ bool GraphicsLayerAnimations::hasRunningAnimations() const
 
 void GraphicsLayerAnimation::apply(Client* client)
 {
-    if (state() == StoppedState)
+    if (!isActive())
         return;
 
     double totalRunningTime = m_state == PausedState ? m_pauseTime : WTF::currentTime() - m_startTime;
     double normalizedValue = normalizedAnimationValue(totalRunningTime, m_animation->duration(), m_animation->direction());
 
-    if (m_animation->iterationCount() != Animation::IterationCountInfinite && totalRunningTime >= m_animation->duration() * m_animation->iterationCount())
+    if (m_animation->iterationCount() != Animation::IterationCountInfinite && totalRunningTime >= m_animation->duration() * m_animation->iterationCount()) {
         setState(StoppedState);
+        if (m_animation->fillsForwards())
+            normalizedValue = normalizedAnimationValueForFillsForwards(m_animation->iterationCount(), m_animation->direction());
+    }
 
     if (!normalizedValue) {
         applyInternal(client, m_keyframes.at(0), m_keyframes.at(1), 0);
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index ff7ed7e29..805e20a79 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -38,6 +38,7 @@ public:
     virtual ~Extensions3DChromium();
 
     // Supported extensions:
+    //   GL_CHROMIUM_shallow_flush  : only supported if an ipc command buffer is used.
     //   GL_CHROMIUM_resource_safe  : indicating that textures/renderbuffers are always initialized before read/write.
     //   GL_CHROMIUM_strict_attribs : indicating a GL error is generated for out-of-bounds buffer accesses.
     //   GL_CHROMIUM_post_sub_buffer
@@ -122,6 +123,9 @@ public:
     // GL_CHROMIUM_copy_texture
     void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
+    // GL_CHROMIUM_shallow_flush
+    virtual void shallowFlushCHROMIUM();
+
 private:
     // Instances of this class are strictly owned by the GraphicsContext3D implementation and do not
     // need to be instantiated by any other code.
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index d4d592e1b..156dcd3d1 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -1,11 +1,11 @@
 /*
  * Copyright (C) 2006, 2007 Apple Computer, Inc.
  * Copyright (c) 2006, 2007, 2008, 2009, 2012 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -15,7 +15,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -35,6 +35,7 @@
 #include "Font.h"
 #include "FontUtilsChromiumWin.h"
 #include "HWndDC.h"
+#include "LayoutTestSupport.h"
 #include "PlatformSupport.h"
 #include "SimpleFontData.h"
 #include <unicode/uniset.h>
@@ -55,10 +56,10 @@ namespace WebCore
 // asked for a CJK font with a Romanized name under a CJK locale,
 // |GetTextFace| (after |CreateFont*|) returns a 'bogus' value (e.g. Arial).
 // This is not consistent with what MSDN says !!
-// Therefore, before we call |CreateFont*|, we have to map a Romanized name to 
-// the corresponding native name under a CJK locale and vice versa 
+// Therefore, before we call |CreateFont*|, we have to map a Romanized name to
+// the corresponding native name under a CJK locale and vice versa
 // under a non-CJK locale.
-// See the corresponding gecko bugs at 
+// See the corresponding gecko bugs at
 // https://bugzilla.mozilla.org/show_bug.cgi?id=373952
 // https://bugzilla.mozilla.org/show_bug.cgi?id=231426
 static bool LookupAltName(const String& name, String& altName)
@@ -206,11 +207,11 @@ static bool LookupAltName(const String& name, String& altName)
             fontNameMap->set(String(namePairs[i].name), &(namePairs[i].altNameCodepage));
     }
 
-    bool isAscii = false; 
+    bool isAscii = false;
     String n;
-    // use |lower| only for ASCII names 
-    // For non-ASCII names, we don't want to invoke an expensive 
-    // and unnecessary |lower|. 
+    // use |lower| only for ASCII names
+    // For non-ASCII names, we don't want to invoke an expensive
+    // and unnecessary |lower|.
     if (name.containsOnlyASCII()) {
         isAscii = true;
         n = name.lower();
@@ -257,7 +258,7 @@ static HFONT createFontIndirectAndGetWinName(const String& family, LOGFONT* winf
 // This maps font family names to their repertoires of supported Unicode
 // characters. Because it's family names rather than font faces we use
 // as keys, there might be edge cases where one face of a font family
-// has a different repertoire from another face of the same family. 
+// has a different repertoire from another face of the same family.
 typedef HashMap<const wchar_t*, icu::UnicodeSet*> FontCmapCache;
 
 static bool fontContainsCharacter(const FontPlatformData* fontData,
@@ -275,10 +276,10 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
         fontCmapCache = new FontCmapCache;
 
     HashMap<const wchar_t*, icu::UnicodeSet*>::iterator it = fontCmapCache->find(family);
-    if (it != fontCmapCache->end()) 
+    if (it != fontCmapCache->end())
         return it->second->contains(character);
-    
-    HFONT hfont = fontData->hfont(); 
+
+    HFONT hfont = fontData->hfont();
     HWndDC hdc(0);
     HGDIOBJ oldFont = static_cast<HFONT>(SelectObject(hdc, hfont));
     int count = GetFontUnicodeRanges(hdc, 0);
@@ -294,7 +295,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     glyphsetBuffer.resize(GetFontUnicodeRanges(hdc, 0));
     GLYPHSET* glyphset = reinterpret_cast<GLYPHSET*>(glyphsetBuffer.data());
     // In addition, refering to the OS/2 table and converting the codepage list
-    // to the coverage map might be faster. 
+    // to the coverage map might be faster.
     count = GetFontUnicodeRanges(hdc, glyphset);
     ASSERT(count > 0);
     SelectObject(hdc, oldFont);
@@ -305,14 +306,14 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     unsigned i = 0;
     icu::UnicodeSet* cmap = new icu::UnicodeSet;
     while (i < glyphset->cRanges) {
-        WCHAR start = glyphset->ranges[i].wcLow; 
+        WCHAR start = glyphset->ranges[i].wcLow;
         cmap->add(start, start + glyphset->ranges[i].cGlyphs - 1);
         i++;
     }
     cmap->freeze();
     // We don't lowercase |family| because all of them are under our control
-    // and they're already lowercased. 
-    fontCmapCache->set(family, cmap); 
+    // and they're already lowercased.
+    fontCmapCache->set(family, cmap);
     return cmap->contains(character);
 }
 
@@ -354,7 +355,7 @@ static void FillLogFont(const FontDescription& fontDescription, LOGFONT* winfont
     winfont->lfStrikeOut = false;
     winfont->lfCharSet = DEFAULT_CHARSET;
     winfont->lfOutPrecision = OUT_TT_ONLY_PRECIS;
-    winfont->lfQuality = PlatformSupport::layoutTestMode() ? NONANTIALIASED_QUALITY : DEFAULT_QUALITY; // Honor user's desktop settings.
+    winfont->lfQuality = isRunningLayoutTest() ? NONANTIALIASED_QUALITY : DEFAULT_QUALITY; // Honor user's desktop settings.
     winfont->lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
     winfont->lfItalic = fontDescription.italic();
     winfont->lfWeight = toGDIFontWeight(fontDescription.weight());
@@ -433,7 +434,7 @@ const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, cons
         fontDescription.genericFamily(), &c, &script);
     FontPlatformData* data = 0;
     if (family)
-        data = getCachedFontPlatformData(font.fontDescription(),  AtomicString(family, wcslen(family)), false); 
+        data = getCachedFontPlatformData(font.fontDescription(),  AtomicString(family, wcslen(family)), false);
 
     // Last resort font list : PanUnicode. CJK fonts have a pretty
     // large repertoire. Eventually, we need to scan all the fonts
@@ -492,7 +493,7 @@ const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, cons
     // warrant an additional (real coverage) check with fontCotainsCharacter.
     int i;
     for (i = 0; (!data || !fontContainsCharacter(data, family, c)) && i < numFonts; ++i) {
-        family = panUniFonts[i]; 
+        family = panUniFonts[i];
         data = getCachedFontPlatformData(font.fontDescription(), AtomicString(family, wcslen(family)));
     }
     // When i-th font (0-base) in |panUniFonts| contains a character and
@@ -603,8 +604,8 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     LOGFONT winfont = {0};
     FillLogFont(fontDescription, &winfont);
 
-    // Windows will always give us a valid pointer here, even if the face name 
-    // is non-existent.  We have to double-check and see if the family name was 
+    // Windows will always give us a valid pointer here, even if the face name
+    // is non-existent. We have to double-check and see if the family name was
     // really used.
     String winName;
     HFONT hfont = createFontIndirectAndGetWinName(family, &winfont, &winName);
@@ -614,15 +615,14 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     // FIXME: Do we need to use predefined fonts "guaranteed" to exist
     // when we're running in layout-test mode?
     if (!equalIgnoringCase(family, winName)) {
-        // For CJK fonts with both English and native names, 
+        // For CJK fonts with both English and native names,
         // GetTextFace returns a native name under the font's "locale"
-        // and an English name under other locales regardless of 
+        // and an English name under other locales regardless of
         // lfFaceName field of LOGFONT. As a result, we need to check
         // if a font has an alternate name. If there is, we need to
         // compare it with what's requested in the first place.
         String altName;
-        if (!LookupAltName(family, altName) || 
-            !equalIgnoringCase(altName, winName)) {
+        if (!LookupAltName(family, altName) || !equalIgnoringCase(altName, winName)) {
             DeleteObject(hfont);
             return 0;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 03203bf1c..24827e946 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -77,7 +77,6 @@ LayerChromium::LayerChromium()
     , m_masksToBounds(false)
     , m_opaque(false)
     , m_doubleSided(true)
-    , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 83058e633..abd9e36f8 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -195,9 +195,6 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
-    bool usesLayerClipping() const { return m_usesLayerClipping; }
-
     virtual void setIsNonCompositedContent(bool);
     bool isNonCompositedContent() const { return m_isNonCompositedContent; }
 
@@ -236,8 +233,6 @@ public:
     bool drawOpacityIsAnimating() const { return m_drawOpacityIsAnimating; }
     void setDrawOpacityIsAnimating(bool drawOpacityIsAnimating) { m_drawOpacityIsAnimating = drawOpacityIsAnimating; }
 
-    const IntRect& clipRect() const { return m_clipRect; }
-    void setClipRect(const IntRect& clipRect) { m_clipRect = clipRect; }
     LayerChromium* renderTarget() const { ASSERT(!m_renderTarget || m_renderTarget->renderSurface()); return m_renderTarget; }
     void setRenderTarget(LayerChromium* target) { m_renderTarget = target; }
 
@@ -351,8 +346,7 @@ private:
     IntRect m_visibleContentRect;
 
     // During drawing, identifies the region outside of which nothing should be drawn.
-    // Currently this is set to layer's clipRect if usesLayerClipping is true, otherwise
-    // it's renderTarget's RenderSurface contentRect.
+    // This is the intersection of the layer's drawableContentRect and damage (if damage tracking is enabled).
     // Uses target surface's space.
     IntRect m_scissorRect;
     IntPoint m_scrollPosition;
@@ -378,7 +372,6 @@ private:
     bool m_masksToBounds;
     bool m_opaque;
     bool m_doubleSided;
-    bool m_usesLayerClipping;
     bool m_isNonCompositedContent;
     bool m_preserves3D;
     bool m_useParentBackfaceVisibility;
@@ -397,9 +390,8 @@ private:
     float m_drawOpacity;
     bool m_drawOpacityIsAnimating;
 
-    // Uses target surface space.
-    IntRect m_clipRect;
     LayerChromium* m_renderTarget;
+
     WebKit::WebTransformationMatrix m_drawTransform;
     WebKit::WebTransformationMatrix m_screenSpaceTransform;
     bool m_drawTransformIsAnimating;
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 1681c5ba3..4749c130e 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -116,8 +116,6 @@ private:
     IntRect m_clipRect;
 
     // During drawing, identifies the region outside of which nothing should be drawn.
-    // Currently this is set to layer's clipRect if usesLayerClipping is true, otherwise
-    // it's targetRenderSurface's contentRect.
     // Uses the space of the surface's target surface.
     IntRect m_scissorRect;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
index d5a7d4295..ac2956a13 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 const double CCFrameRateCounter::kFrameTooFast = 1.0 / 70.0; // measured in seconds
 const double CCFrameRateCounter::kFrameTooSlow = 1.0 / 12.0;
+const double CCFrameRateCounter::kDroppedFrameTime = 1.0 / 50.0;
 
 // safeMod works on -1, returning m-1 in that case.
 static inline int safeMod(int number, int modulus)
@@ -42,13 +43,20 @@ static inline int safeMod(int number, int modulus)
     return (number + modulus) % modulus;
 }
 
-inline int CCFrameRateCounter::frameIndex(int frame) const
+inline double CCFrameRateCounter::frameInterval(int frameNumber) const
 {
-    return safeMod(frame, kTimeStampHistorySize);
+    return m_timeStampHistory[frameIndex(frameNumber)] -
+        m_timeStampHistory[frameIndex(frameNumber - 1)];
+}
+
+inline int CCFrameRateCounter::frameIndex(int frameNumber) const
+{
+    return safeMod(frameNumber, kTimeStampHistorySize);
 }
 
 CCFrameRateCounter::CCFrameRateCounter()
     : m_currentFrameNumber(1)
+    , m_droppedFrameCount(0)
 {
     m_timeStampHistory[0] = currentTime();
     m_timeStampHistory[1] = m_timeStampHistory[0];
@@ -67,6 +75,9 @@ void CCFrameRateCounter::markBeginningOfFrame(double timestamp)
     }
 
     m_timeStampHistory[frameIndex(m_currentFrameNumber)] = timestamp;
+    double delta = frameInterval(m_currentFrameNumber);
+    if (!isBadFrameInterval(delta) && delta > kDroppedFrameTime)
+        ++m_droppedFrameCount;
 }
 
 void CCFrameRateCounter::markEndOfFrame()
@@ -84,9 +95,7 @@ bool CCFrameRateCounter::isBadFrameInterval(double intervalBetweenConsecutiveFra
 
 bool CCFrameRateCounter::isBadFrame(int frameNumber) const
 {
-    double delta = m_timeStampHistory[frameIndex(frameNumber)] -
-            m_timeStampHistory[frameIndex(frameNumber - 1)];
-    return isBadFrameInterval(delta);
+    return isBadFrameInterval(frameInterval(frameNumber));
 }
 
 void CCFrameRateCounter::getAverageFPSAndStandardDeviation(double& averageFPS, double& standardDeviation) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
index c49f17c23..fc23e26e3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
@@ -56,9 +56,12 @@ public:
     // true if the given frame interval is too fast or too slow, based on constant thresholds.
     bool isBadFrameInterval(double intervalBetweenConsecutiveFrames) const;
 
+    int droppedFrameCount() const { return m_droppedFrameCount; }
+
 private:
     CCFrameRateCounter();
 
+    double frameInterval(int frameNumber) const;
     int frameIndex(int frameNumber) const;
     bool isBadFrame(int frameNumber) const;
 
@@ -68,10 +71,17 @@ private:
     static const double kFrameTooFast;
     static const double kFrameTooSlow;
 
+    // If a frame takes longer than this threshold (measured in seconds) then we
+    // (naively) assume that it missed a screen refresh; that is, we dropped a frame.
+    // FIXME: Determine this threshold based on monitor refresh rate, crbug.com/138642.
+    static const double kDroppedFrameTime;
+
     static const int kTimeStampHistorySize = 120;
 
     int m_currentFrameNumber;
     double m_timeStampHistory[kTimeStampHistorySize];
+
+    int m_droppedFrameCount;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
index be8c8a557..405885ffb 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
@@ -48,12 +48,6 @@ public:
 
     WebKit::WebGraphicsContext3D* context3D() { return m_context3D.get(); }
 
-    void flush()
-    {
-        if (m_context3D)
-            m_context3D->flush();
-    }
-
 private:
     CCGraphicsContext() { }
     explicit CCGraphicsContext(PassOwnPtr<WebKit::WebGraphicsContext3D> context3D)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 717d96d10..8a05a8807 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -64,7 +64,6 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
     , m_drawCheckerboardForMissingTiles(false)
-    , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
     , m_drawsContent(false)
     , m_forceRenderSurface(false)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 6196c2c4d..25bedc220 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -148,9 +148,6 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
-    bool usesLayerClipping() const { return m_usesLayerClipping; }
-
     void setIsNonCompositedContent(bool isNonCompositedContent) { m_isNonCompositedContent = isNonCompositedContent; }
     bool isNonCompositedContent() const { return m_isNonCompositedContent; }
 
@@ -178,10 +175,6 @@ public:
     bool drawOpacityIsAnimating() const { return m_drawOpacityIsAnimating; }
     void setDrawOpacityIsAnimating(bool drawOpacityIsAnimating) { m_drawOpacityIsAnimating = drawOpacityIsAnimating; }
 
-    // Usage: if this->usesLayerClipping() is false, then this clipRect should not be used.
-    const IntRect& clipRect() const { return m_clipRect; }
-    void setClipRect(const IntRect& rect) { m_clipRect = rect; }
-
     const IntRect& scissorRect() const { return m_scissorRect; }
     void setScissorRect(const IntRect& rect) { m_scissorRect = rect; }
 
@@ -343,7 +336,6 @@ private:
     bool m_drawCheckerboardForMissingTiles;
     WebKit::WebTransformationMatrix m_sublayerTransform;
     WebKit::WebTransformationMatrix m_transform;
-    bool m_usesLayerClipping;
     bool m_isNonCompositedContent;
 
     bool m_drawsContent;
@@ -389,12 +381,6 @@ private:
     bool m_betweenWillDrawAndDidDraw;
 #endif
 
-    // The rect that contributes to the scissor when this layer is drawn.
-    // Inherited by the parent layer and further restricted if this layer masks
-    // to bounds.
-    // Uses target surface's space.
-    IntRect m_clipRect;
-
     // During drawing, identifies the region outside of which nothing should be drawn.
     // Uses target surface's space.
     IntRect m_scissorRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 377f74d54..d2a79eb1b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -467,9 +467,6 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
         rootLayer->createRenderSurface();
     rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(0, 0), deviceViewportSize()));
 
-    IntRect rootClipRect(IntPoint(), deviceViewportSize());
-    rootLayer->setClipRect(rootClipRect);
-
     LayerList updateList;
     updateList.append(rootLayer);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 3946c23dc..343766a6a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -72,11 +72,7 @@ static IntRect calculateLayerScissorRect(LayerType* layer, const FloatRect& root
     RenderSurfaceType* targetSurface = renderTarget->renderSurface();
 
     FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
-    FloatRect clipAndDamage;
-    if (layer->usesLayerClipping())
-        clipAndDamage = intersection(rootScissorRectInTargetSurface, layer->clipRect());
-    else
-        clipAndDamage = intersection(rootScissorRectInTargetSurface, targetSurface->contentRect());
+    FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, layer->drawableContentRect());
 
     return enclosingIntRect(clipAndDamage);
 }
@@ -95,13 +91,21 @@ static IntRect calculateSurfaceScissorRect(LayerType* layer, const FloatRect& ro
 
     FloatRect clipRect = currentSurface->clipRect();
 
-    // For surfaces, empty clipRect means the same as CCLayerImpl::usesLayerClipping being false
+    // For surfaces, empty clipRect means that the surface does not clip anything.
     if (clipRect.isEmpty())
         clipRect = intersection(targetSurface->contentRect(), currentSurface->drawableContentRect());
+    else
+        clipRect.intersect(currentSurface->drawableContentRect());
 
     FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
 
     FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, clipRect);
+
+    // If the layer has background filters that move pixels, we cannot scissor as tightly.
+    // FIXME: this should be able to be a tighter scissor, perhaps expanded by the filter outsets?
+    if (layer->backgroundFilters().hasFilterThatMovesPixels())
+        clipAndDamage = rootScissorRectInTargetSurface;
+
     return enclosingIntRect(clipAndDamage);
 }
 
@@ -156,14 +160,19 @@ static bool isSurfaceBackFaceVisible(LayerType* layer, const WebTransformationMa
 }
 
 template<typename LayerType>
+static inline bool layerClipsSubtree(LayerType* layer)
+{
+    return layer->masksToBounds() || layer->maskLayer();
+}
+
+template<typename LayerType>
 static IntRect calculateVisibleContentRect(LayerType* layer)
 {
     ASSERT(layer->renderTarget());
 
     IntRect targetSurfaceRect = layer->renderTarget()->renderSurface()->contentRect();
 
-    if (layer->usesLayerClipping())
-        targetSurfaceRect.intersect(layer->clipRect());
+    targetSurfaceRect.intersect(layer->drawableContentRect());
 
     if (targetSurfaceRect.isEmpty() || layer->contentBounds().isEmpty())
         return IntRect();
@@ -298,7 +307,7 @@ static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlig
         return true;
 
     // If the layer clips its descendants but it is not axis-aligned with respect to its parent.
-    if (layer->masksToBounds() && !axisAlignedWithRespectToParent && descendantDrawsContent)
+    if (layerClipsSubtree(layer) && !axisAlignedWithRespectToParent && descendantDrawsContent)
         return true;
 
     // If the layer has opacity != 1 and does not have a preserves-3d transform style.
@@ -393,10 +402,11 @@ WebTransformationMatrix computeScrollCompensationMatrixForChildren(CCLayerImpl*
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
 template<typename LayerType, typename LayerList, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLayer, const WebTransformationMatrix& parentMatrix,
-                                            const WebTransformationMatrix& fullHierarchyMatrix, const WebTransformationMatrix& currentScrollCompensationMatrix,
-                                            RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList,
-                                            LayerSorter* layerSorter, int maxTextureSize)
+static void calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLayer, const WebTransformationMatrix& parentMatrix,
+    const WebTransformationMatrix& fullHierarchyMatrix, const WebTransformationMatrix& currentScrollCompensationMatrix,
+    const IntRect& clipRectFromAncestor, bool ancestorClipsSubtree,
+    RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList,
+    LayerSorter* layerSorter, int maxTextureSize, IntRect& drawableContentRectOfSubtree)
 {
     // This function computes the new matrix transformations recursively for this
     // layer and all its descendants. It also computes the appropriate render surfaces.
@@ -488,9 +498,15 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     //        M[replica2root] = M[surface2root] * Tr[replica->position()] * Tr[replica] * Tr[origin2anchor].inverse()
     //
 
+    // If we early-exit anywhere in this function, the drawableContentRect of this subtree should be considered empty.
+    drawableContentRectOfSubtree = IntRect();
+
     if (subtreeShouldBeSkipped(layer))
-        return false;
+        return;
 
+    IntRect clipRectForSubtree;
+    bool subtreeShouldBeClipped = false;
+    
     float drawOpacity = layer->opacity();
     bool drawOpacityIsAnimating = layer->opacityIsAnimating();
     if (layer->parent() && layer->parent()->preserves3D()) {
@@ -544,13 +560,10 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     // nextHierarchyMatrix will only change if this layer uses a new RenderSurface, otherwise remains the same.
     WebTransformationMatrix nextHierarchyMatrix = fullHierarchyMatrix;
 
-    // FIXME: This seems like the wrong place to set this
-    layer->setUsesLayerClipping(false);
-
     if (subtreeShouldRenderToSeparateSurface(layer, isScaleOrTranslation(combinedTransform))) {
         // Check back-face visibility before continuing with this surface and its subtree
         if (!layer->doubleSided() && transformToParentIsKnown(layer) && isSurfaceBackFaceVisible(layer, combinedTransform))
-            return false;
+            return;
 
         if (!layer->renderSurface())
             layer->createRenderSurface();
@@ -594,14 +607,11 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         // Update the aggregate hierarchy matrix to include the transform of the newly created RenderSurface.
         nextHierarchyMatrix.multiply(surfaceOriginTransform);
 
-        // The render surface clipRect contributes to the scissor rect that needs to
-        // be applied before drawing the render surface onto its containing
-        // surface and is therefore expressed in the parent's coordinate system.
-        renderSurface->setClipRect(layer->parent() ? layer->parent()->clipRect() : layer->clipRect());
-
-        // The layer's clipRect can be reset here. The renderSurface will correctly clip the subtree.
-        layer->setUsesLayerClipping(false);
-        layer->setClipRect(IntRect());
+        // The new renderSurface here will correctly clip the entire subtree. So, we do
+        // not need to continue propagating the clipping state further down the tree. This
+        // way, we can avoid transforming clipRects from ancestor target surface space to
+        // current target surface space that could cause more w < 0 headaches.
+        subtreeShouldBeClipped = false;
 
         if (layer->maskLayer())
             layer->maskLayer()->setRenderTarget(layer);
@@ -611,6 +621,7 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
         if (layer->filters().hasFilterThatMovesPixels())
             nearestAncestorThatMovesPixels = renderSurface;
+
         renderSurface->setNearestAncestorThatMovesPixels(nearestAncestorThatMovesPixels);
 
         renderSurfaceLayerList.append(layer);
@@ -627,26 +638,33 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
             ASSERT(layer->parent());
             layer->clearRenderSurface();
 
-            // Layers inherit the clip rect from their parent.
-            layer->setClipRect(layer->parent()->clipRect());
-            if (layer->parent()->usesLayerClipping())
-                layer->setUsesLayerClipping(true);
-
+            // Layers without renderSurfaces directly inherit the ancestor's clip status.
+            subtreeShouldBeClipped = ancestorClipsSubtree;
+            if (ancestorClipsSubtree)
+                clipRectForSubtree = clipRectFromAncestor;
+            
             // Layers that are not their own renderTarget will render into the target of their nearest ancestor.
             layer->setRenderTarget(layer->parent()->renderTarget());
+        } else {
+            // FIXME: This root layer special case code should eventually go away. But before that is truly possible,
+            //        tests (or code) related to CCOcclusionTracker need to be adjusted so that they do not require
+            //        the rootLayer to clip; the root layer's RenderSurface would already clip and should be enough.
+            ASSERT(!layer->parent());
+            ASSERT(layer->renderSurface());
+            ASSERT(ancestorClipsSubtree);
+            layer->renderSurface()->setClipRect(clipRectFromAncestor);
+            subtreeShouldBeClipped = true;
+            clipRectForSubtree = clipRectFromAncestor;
         }
     }
 
-    if (layer->masksToBounds()) {
-        IntRect clipRect = transformedLayerRect;
-
-        // If the layer already inherited a clipRect, we need to intersect with it before
-        // overriding the layer's clipRect and usesLayerClipping.
-        if (layer->usesLayerClipping())
-            clipRect.intersect(layer->clipRect());
-
-        layer->setClipRect(clipRect);
-        layer->setUsesLayerClipping(true);
+    if (layerClipsSubtree(layer)) {
+        subtreeShouldBeClipped = true;
+        if (ancestorClipsSubtree && !layer->renderSurface()) {
+            clipRectForSubtree = clipRectFromAncestor;
+            clipRectForSubtree.intersect(transformedLayerRect);
+        } else
+            clipRectForSubtree = transformedLayerRect;
     }
 
     // Note that at this point, layer->drawTransform() is not necessarily the same as local variable drawTransform.
@@ -656,16 +674,6 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     layerScreenSpaceTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
     layer->setScreenSpaceTransform(layerScreenSpaceTransform);
 
-    // drawableContentRect() is always stored in the coordinate system of the
-    // RenderSurface the layer draws into.
-    if (layer->drawsContent()) {
-        IntRect drawableContentRect = transformedLayerRect;
-        if (layer->usesLayerClipping())
-            drawableContentRect.intersect(layer->clipRect());
-        layer->setDrawableContentRect(drawableContentRect);
-    } else
-        layer->setDrawableContentRect(IntRect());
-
     WebTransformationMatrix sublayerMatrix = layer->drawTransform();
 
     // Flatten to 2D if the layer doesn't preserve 3D.
@@ -695,36 +703,45 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
     WebTransformationMatrix nextScrollCompensationMatrix = computeScrollCompensationMatrixForChildren(layer, parentMatrix, currentScrollCompensationMatrix);;
 
+    IntRect accumulatedDrawableContentRectOfChildren;
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nextScrollCompensationMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
-
-        if (drawsContent) {
-            if (child->renderSurface()) {
-                RenderSurfaceType* childRenderSurface = child->renderSurface();
-                IntRect drawableContentRect = layer->drawableContentRect();
-                drawableContentRect.unite(enclosingIntRect(childRenderSurface->drawableContentRect()));
-                layer->setDrawableContentRect(drawableContentRect);
+        IntRect drawableContentRectOfChildSubtree;
+        calculateDrawTransformsInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nextScrollCompensationMatrix,
+                                                                                              clipRectForSubtree, subtreeShouldBeClipped, nearestAncestorThatMovesPixels,
+                                                                                              renderSurfaceLayerList, descendants, layerSorter, maxTextureSize, drawableContentRectOfChildSubtree);
+        if (!drawableContentRectOfChildSubtree.isEmpty()) {
+            accumulatedDrawableContentRectOfChildren.unite(drawableContentRectOfChildSubtree);
+            if (child->renderSurface())
                 descendants.append(child);
-            } else {
-                IntRect drawableContentRect = layer->drawableContentRect();
-                drawableContentRect.unite(child->drawableContentRect());
-                layer->setDrawableContentRect(drawableContentRect);
-            }
         }
     }
 
-    if (layer->masksToBounds() || layer->maskLayer()) {
-        IntRect drawableContentRect = layer->drawableContentRect();
-        drawableContentRect.intersect(transformedLayerRect);
-        layer->setDrawableContentRect(drawableContentRect);
-    }
+    // Compute the total drawableContentRect for this subtree (the rect is in targetSurface space)
+    IntRect localDrawableContentRectOfSubtree = accumulatedDrawableContentRectOfChildren;
+    if (layer->drawsContent())
+        localDrawableContentRectOfSubtree.unite(transformedLayerRect);
+    if (subtreeShouldBeClipped)
+        localDrawableContentRectOfSubtree.intersect(clipRectForSubtree);
+
+    // Compute the layer's drawable content rect (the rect is in targetSurface space)
+    IntRect drawableContentRectOfLayer = transformedLayerRect;
+    if (subtreeShouldBeClipped)
+        drawableContentRectOfLayer.intersect(clipRectForSubtree);
+    layer->setDrawableContentRect(drawableContentRectOfLayer);
 
+    // Compute the remaining properties for the render surface, if the layer has one.
     if (layer->renderSurface() && layer != rootLayer) {
         RenderSurfaceType* renderSurface = layer->renderSurface();
-        IntRect clippedContentRect = layer->drawableContentRect();
+        IntRect clippedContentRect = localDrawableContentRectOfSubtree;
         FloatPoint surfaceCenter = FloatRect(clippedContentRect).center();
 
+        // The render surface clipRect is expressed in the space where this surface draws, i.e. the same space as clipRectFromAncestor.
+        if (ancestorClipsSubtree)
+            renderSurface->setClipRect(clipRectFromAncestor);
+        else
+            renderSurface->setClipRect(IntRect());
+
         // Restrict the RenderSurface size to the portion that's visible.
         FloatSize centerOffsetDueToClipping;
 
@@ -733,7 +750,8 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         // its target is not known on the main thread, and we should not use it
         // to clip.
         if (!layer->replicaLayer() && transformToParentIsKnown(layer)) {
-            if (!renderSurface->clipRect().isEmpty() && !clippedContentRect.isEmpty()) {
+            // Note, it is correct to use ancestorClipsSubtree here, because we are looking at this layer's renderSurface, not the layer itself.
+            if (ancestorClipsSubtree && !clippedContentRect.isEmpty()) {
                 IntRect surfaceClipRect = CCLayerTreeHostCommon::calculateVisibleRect(renderSurface->clipRect(), clippedContentRect, renderSurface->originTransform());
                 clippedContentRect.intersect(surfaceClipRect);
             }
@@ -751,10 +769,6 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
         renderSurface->setContentRect(clippedContentRect);
 
-        // Since the layer starts a new render surface we need to adjust its
-        // clipRect to be expressed in the new surface's coordinate system.
-        layer->setClipRect(layer->drawableContentRect());
-
         // Adjust the origin of the transform to be the center of the render surface.
         WebTransformationMatrix drawTransform = renderSurface->originTransform();
         drawTransform.translate3d(surfaceCenter.x() + centerOffsetDueToClipping.width(), surfaceCenter.y() + centerOffsetDueToClipping.height(), 0);
@@ -813,13 +827,13 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
             ASSERT(renderSurfaceLayerList.last() == layer);
             renderSurfaceLayerList.removeLast();
             layer->clearRenderSurface();
-            return false;
+            return;
         }
     }
 
     // If neither this layer nor any of its children were added, early out.
     if (sortingStartIndex == descendants.size())
-        return false;
+        return;
 
     // If preserves-3d then sort all the descendants in 3D so that they can be
     // drawn from back to front. If the preserves-3d property is also set on the parent then
@@ -827,7 +841,12 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     if (descendants.size() && layer->preserves3D() && (!layer->parent() || !layer->parent()->preserves3D()))
         sortLayers(&descendants.at(sortingStartIndex), descendants.end(), layerSorter);
 
-    return true;
+    if (layer->renderSurface())
+        drawableContentRectOfSubtree = enclosingIntRect(layer->renderSurface()->drawableContentRect());
+    else
+        drawableContentRectOfSubtree = localDrawableContentRectOfSubtree;
+
+    return;
 }
 
 // FIXME: Instead of using the following function to set visibility rects on a second
@@ -864,13 +883,19 @@ static void calculateVisibleAndScissorRectsInternal(const LayerList& renderSurfa
 void CCLayerTreeHostCommon::calculateDrawTransforms(LayerChromium* layer, LayerChromium* rootLayer, const WebTransformationMatrix& parentMatrix, const WebTransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
     WebTransformationMatrix scrollCompensationMatrix;
-    WebCore::calculateDrawTransformsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    IntRect drawableContentRect;
+    WebCore::calculateDrawTransformsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix,
+                                                                                                                         rootLayer->renderSurface()->contentRect(), true, 0, renderSurfaceLayerList,
+                                                                                                                         layerList, 0, maxTextureSize, drawableContentRect);
 }
 
 void CCLayerTreeHostCommon::calculateDrawTransforms(CCLayerImpl* layer, CCLayerImpl* rootLayer, const WebTransformationMatrix& parentMatrix, const WebTransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
     WebTransformationMatrix scrollCompensationMatrix;
-    WebCore::calculateDrawTransformsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    IntRect drawableContentRect;
+    WebCore::calculateDrawTransformsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix,
+                                                                                                                rootLayer->renderSurface()->contentRect(), true, 0, renderSurfaceLayerList,
+                                                                                                                layerList, layerSorter, maxTextureSize, drawableContentRect);
 }
 
 void CCLayerTreeHostCommon::calculateVisibleAndScissorRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, const FloatRect& rootScissorRect)
@@ -909,10 +934,10 @@ static bool pointIsClippedBySurfaceOrClipRect(const IntPoint& viewportPoint, CCL
         if (currentLayer->renderSurface() && !pointHitsRect(viewportPoint, currentLayer->renderSurface()->screenSpaceTransform(), currentLayer->renderSurface()->contentRect()))
             return true;
 
-        // Note that clipRects are actually in targetSurface space, so the transform we
+        // Note that drawableContentRects are actually in targetSurface space, so the transform we
         // have to provide is the target surface's screenSpaceTransform.
         CCLayerImpl* renderTarget = currentLayer->renderTarget();
-        if (currentLayer->usesLayerClipping() && !pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->clipRect()))
+        if (!pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->drawableContentRect()))
             return true;
 
         currentLayer = currentLayer->parent();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 7f1240432..598ec6397 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -43,6 +43,7 @@
 #include "cc/CCPageScaleAnimation.h"
 #include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCRenderPassDrawQuad.h"
+#include "cc/CCRenderingStats.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <wtf/CurrentTime.h>
@@ -114,7 +115,6 @@ PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHostImpl::create(const CCLayerTreeSet
 CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCLayerTreeSettings& settings, CCLayerTreeHostImplClient* client)
     : m_client(client)
     , m_sourceFrameNumber(-1)
-    , m_sourceAnimationFrameNumber(0)
     , m_rootScrollLayerImpl(0)
     , m_currentlyScrollingLayerImpl(0)
     , m_scrollingLayerIdFromPreviousTree(-1)
@@ -259,8 +259,6 @@ void CCLayerTreeHostImpl::calculateRenderSurfaceLayerList(CCLayerList& renderSur
     m_rootLayerImpl->renderSurface()->clearLayerList();
     m_rootLayerImpl->renderSurface()->setContentRect(IntRect(IntPoint(), deviceViewportSize()));
 
-    m_rootLayerImpl->setClipRect(IntRect(IntPoint(), deviceViewportSize()));
-
     {
         TRACE_EVENT0("cc", "CCLayerTreeHostImpl::calcDrawEtc");
         WebTransformationMatrix identityMatrix;
@@ -564,8 +562,6 @@ void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
     if (m_debugRectHistory->enabled(settings()))
         m_debugRectHistory->saveDebugRectsForCurrentFrame(m_rootLayerImpl.get(), *frame.renderSurfaceLayerList, frame.occludingScreenSpaceRects, settings());
 
-    ++m_sourceAnimationFrameNumber;
-
     // The next frame should start by assuming nothing has changed, and changes are noted as they occur.
     m_rootLayerImpl->resetAllChangeTrackingForSubtree();
 }
@@ -1189,4 +1185,15 @@ void CCLayerTreeHostImpl::animateGestures(double monotonicTime)
         m_activeGestureAnimation.clear();
 }
 
+int CCLayerTreeHostImpl::sourceAnimationFrameNumber() const
+{
+    return fpsCounter()->currentFrameNumber();
+}
+
+void CCLayerTreeHostImpl::renderingStats(CCRenderingStats& stats) const
+{
+    stats.numFramesSentToScreen = fpsCounter()->currentFrameNumber();
+    stats.droppedFrameCount = fpsCounter()->droppedFrameCount();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index f936e34dd..5587b3462 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -49,6 +49,7 @@ class CCRenderPassDrawQuad;
 class CCResourceProvider;
 class LayerRendererChromium;
 struct LayerRendererCapabilities;
+struct CCRenderingStats;
 
 // CCLayerTreeHost->CCProxy callback interface.
 class CCLayerTreeHostImplClient {
@@ -121,7 +122,7 @@ public:
     void setFontAtlas(PassOwnPtr<CCFontAtlas>);
 
     void finishAllRendering();
-    int sourceAnimationFrameNumber() const { return m_sourceAnimationFrameNumber; }
+    int sourceAnimationFrameNumber() const;
 
     bool initializeLayerRenderer(PassOwnPtr<CCGraphicsContext>, TextureUploaderOption);
     bool isContextLost();
@@ -174,6 +175,8 @@ public:
 
     void setNeedsRedraw();
 
+    void renderingStats(CCRenderingStats&) const;
+
     CCFrameRateCounter* fpsCounter() const { return m_fpsCounter.get(); }
     CCDebugRectHistory* debugRectHistory() const { return m_debugRectHistory.get(); }
     CCResourceProvider* resourceProvider() const { return m_resourceProvider.get(); }
@@ -225,7 +228,6 @@ protected:
 
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
-    int m_sourceAnimationFrameNumber;
 
 private:
     void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index 0083ad1dd..39461578f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -510,11 +510,9 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContribu
 template<typename LayerType, typename RenderSurfaceType>
 IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(const LayerType* layer) const
 {
-    const LayerType* renderTarget = m_stack.last().target;
-    FloatRect totalScissor = renderTarget->renderSurface()->contentRect();
-    if (layer->usesLayerClipping())
-        totalScissor.intersect(layer->clipRect());
-    return enclosingIntRect(totalScissor);
+    // FIXME: we could remove this helper function, but unit tests currently override this
+    //        function, and they need to be verified/adjusted before this can be removed.
+    return layer->scissorRect();
 }
 
 // Declare the possible functions here for the linker.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 79fdac4ec..16d8fa194 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -91,7 +91,6 @@ public:
     bool screenSpaceTransformsAreAnimating() const { return m_screenSpaceTransformsAreAnimating; }
     void setScreenSpaceTransformsAreAnimating(bool animating) { m_screenSpaceTransformsAreAnimating = animating; }
 
-    // Usage: this clipRect should not be used if one of the two conditions is true: (a) clipRect() is empty, or (b) owningLayer->parent()->usesLayerClipping() is false.
     void setClipRect(const IntRect&);
     const IntRect& clipRect() const { return m_clipRect; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
index f69c8e026..d8075aac2 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
@@ -28,12 +28,15 @@
 namespace WebCore {
 
 struct CCRenderingStats {
+    // FIXME: Rename these to animationFrameCount and screenFrameCount, crbug.com/138641.
     int numAnimationFrames;
     int numFramesSentToScreen;
+    int droppedFrameCount;
 
     CCRenderingStats()
         : numAnimationFrames(0)
         , numFramesSentToScreen(0)
+        , droppedFrameCount(0)
     {
     }
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
index ef82bf22a..49c3b243f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
@@ -195,6 +195,20 @@ void CCResourceProvider::flush()
     context3d->flush();
 }
 
+bool CCResourceProvider::shallowFlushIfSupported()
+{
+    ASSERT(CCProxy::isImplThread());
+    WebGraphicsContext3D* context3d = m_context->context3D();
+    if (!context3d) {
+        // FIXME: Implement this path for software compositing.
+        return false;
+    }
+
+    if (m_useShallowFlush)
+        context3d->shallowFlushCHROMIUM();
+    return m_useShallowFlush;
+}
+
 unsigned CCResourceProvider::lockForRead(ResourceId id)
 {
     ASSERT(CCProxy::isImplThread());
@@ -217,6 +231,7 @@ CCResourceProvider::CCResourceProvider(CCGraphicsContext* context)
     , m_nextId(1)
     , m_useTextureStorageExt(false)
     , m_useTextureUsageHint(false)
+    , m_useShallowFlush(false)
     , m_maxTextureSize(0)
 {
 }
@@ -240,6 +255,8 @@ bool CCResourceProvider::initialize()
             m_useTextureUsageHint = true;
         else if (extensions[i] == "GL_CHROMIUM_map_sub")
             useMapSub = true;
+        else if (extensions[i] == "GL_CHROMIUM_shallow_flush")
+            m_useShallowFlush = true;
     }
 
     m_texSubImage = adoptPtr(new LayerTextureSubImage(useMapSub));
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
index 0476f0e88..9b0b44caf 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
@@ -85,6 +85,10 @@ public:
     // respect to other contexts.
     void flush();
 
+    // Only flush the command buffer if supported.
+    // Returns true if the shallow flush occurred, false otherwise.
+    bool shallowFlushIfSupported();
+
 private:
     friend class CCScopedLockResourceForRead;
     friend class CCScopedLockResourceForWrite;
@@ -117,6 +121,7 @@ private:
 
     bool m_useTextureStorageExt;
     bool m_useTextureUsageHint;
+    bool m_useShallowFlush;
     OwnPtr<LayerTextureSubImage> m_texSubImage;
     int m_maxTextureSize;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 002c7a7bf..3550346ba 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -31,7 +31,6 @@
 #include "cc/CCFontAtlas.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
-#include "cc/CCRenderingStats.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTimer.h"
 #include <wtf/CurrentTime.h>
@@ -173,7 +172,7 @@ bool CCSingleThreadProxy::recreateContext()
 
 void CCSingleThreadProxy::implSideRenderingStats(CCRenderingStats& stats)
 {
-    stats.numFramesSentToScreen = m_layerTreeHostImpl->sourceAnimationFrameNumber();
+    m_layerTreeHostImpl->renderingStats(stats);
 }
 
 const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities() const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
index 967ad5e3f..c6f4929a8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
@@ -102,12 +102,12 @@ void CCTextureUpdater::update(CCResourceProvider* resourceProvider, TextureCopie
             uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
             fullUploadCount++;
             if (!(fullUploadCount % kUploadFlushPeriod))
-                resourceProvider->flush();
+                resourceProvider->shallowFlushIfSupported();
         }
 
         // Make sure there are no dangling uploads without a flush.
         if (fullUploadCount % kUploadFlushPeriod)
-            resourceProvider->flush();
+            resourceProvider->shallowFlushIfSupported();
 
         bool moreUploads = maxIndex < m_fullEntries.size();
 
@@ -127,14 +127,14 @@ void CCTextureUpdater::update(CCResourceProvider* resourceProvider, TextureCopie
             UpdateEntry& entry = m_partialEntries[index];
             uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
             if (!((index+1) % kUploadFlushPeriod))
-                resourceProvider->flush();
+                resourceProvider->shallowFlushIfSupported();
         }
 
         // Make sure there are no dangling partial uploads without a flush.
         // Note: We don't need to use (index+1) in this case because index was
         // incremented at the end of the for loop.
         if (index % kUploadFlushPeriod)
-            resourceProvider->flush();
+            resourceProvider->shallowFlushIfSupported();
 
         uploader->endUploads();
     }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 9b6dfe3ac..e09d94c61 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -36,7 +36,6 @@
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerTreeHost.h"
-#include "cc/CCRenderingStats.h"
 #include "cc/CCScheduler.h"
 #include "cc/CCScopedThreadProxy.h"
 #include "cc/CCTextureUpdater.h"
@@ -895,7 +894,7 @@ void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, C
 void CCThreadProxy::implSideRenderingStatsOnImplThread(CCCompletionEvent* completion, CCRenderingStats* stats)
 {
     ASSERT(isImplThread());
-    stats->numFramesSentToScreen = m_layerTreeHostImpl->sourceAnimationFrameNumber();
+    m_layerTreeHostImpl->renderingStats(*stats);
     completion->signal();
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/FEBlend.cpp b/Source/WebCore/platform/graphics/filters/FEBlend.cpp
index 363a75b7f..f6dcf6396 100644
--- a/Source/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -62,71 +63,102 @@ bool FEBlend::setBlendMode(BlendModeType mode)
     return true;
 }
 
-static inline unsigned char normal(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+static inline unsigned char fastDivideBy255(uint16_t value)
 {
-    return (((255 - alphaA) * colorB + colorA * 255) / 255);
+    // This is an approximate algorithm for division by 255, but it gives accurate results for 16bit values.
+    uint16_t quotient = value >> 8;
+    uint16_t remainder = value - (quotient * 255) + 1;
+    return quotient + (remainder >> 8);
 }
 
-static inline unsigned char multiply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
-{
-    return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255);
-}
+class BlendNormal {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+    {
+        return fastDivideBy255((255 - alphaA) * colorB + colorA * 255);
+    }
+};
 
-static inline unsigned char screen(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
-{
-    return (((colorB + colorA) * 255 - colorA * colorB) / 255);
-}
+class BlendMultiply {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA);
+    }
+};
 
-static inline unsigned char darken(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
-{
-    return ((std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
-}
+class BlendScreen {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
+    {
+        return fastDivideBy255((colorB + colorA) * 255 - colorA * colorB);
+    }
+};
+
+class BlendDarken {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255(std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255));
+    }
+};
+
+class BlendLighten {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255(std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255));
+    }
+};
+
+class BlendUnknown {
+public:
+    static unsigned char apply(unsigned char, unsigned char, unsigned char, unsigned char)
+    {
+        return 0;
+    }
+};
 
-static inline unsigned char lighten(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+template<typename BlendFunctor>
+static void platformApply(unsigned char* sourcePixelA, unsigned char* sourcePixelB,
+                          unsigned char* destinationPixel, unsigned pixelArrayLength)
 {
-    return ((std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+    unsigned len = pixelArrayLength / 4;
+    for (unsigned pixelOffset = 0; pixelOffset < len; pixelOffset++) {
+        unsigned char alphaA = sourcePixelA[3];
+        unsigned char alphaB = sourcePixelB[3];
+        destinationPixel[0] = BlendFunctor::apply(sourcePixelA[0], sourcePixelB[0], alphaA, alphaB);
+        destinationPixel[1] = BlendFunctor::apply(sourcePixelA[1], sourcePixelB[1], alphaA, alphaB);
+        destinationPixel[2] = BlendFunctor::apply(sourcePixelA[2], sourcePixelB[2], alphaA, alphaB);
+        destinationPixel[3] = 255 - fastDivideBy255((255 - alphaA) * (255 - alphaB));
+        sourcePixelA += 4;
+        sourcePixelB += 4;
+        destinationPixel += 4;
+    }
 }
 
-void FEBlend::platformApplyGeneric(PassRefPtr<Uint8ClampedArray> pixelArrayA, PassRefPtr<Uint8ClampedArray> pixelArrayB,
-                                   Uint8ClampedArray* dstPixelArray, unsigned pixelArrayLength)
+void FEBlend::platformApplyGeneric(unsigned char* sourcePixelA, unsigned char* sourcePixelB,
+                                   unsigned char* destinationPixel, unsigned pixelArrayLength)
 {
-    RefPtr<Uint8ClampedArray> srcPixelArrayA = pixelArrayA;
-    RefPtr<Uint8ClampedArray> srcPixelArrayB = pixelArrayB;
-
-    for (unsigned pixelOffset = 0; pixelOffset < pixelArrayLength; pixelOffset += 4) {
-        unsigned char alphaA = srcPixelArrayA->item(pixelOffset + 3);
-        unsigned char alphaB = srcPixelArrayB->item(pixelOffset + 3);
-        for (unsigned channel = 0; channel < 3; ++channel) {
-            unsigned char colorA = srcPixelArrayA->item(pixelOffset + channel);
-            unsigned char colorB = srcPixelArrayB->item(pixelOffset + channel);
-            unsigned char result;
-
-            switch (m_mode) {
-            case FEBLEND_MODE_NORMAL:
-                result = normal(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_MULTIPLY:
-                result = multiply(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_SCREEN:
-                result = screen(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_DARKEN:
-                result = darken(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_LIGHTEN:
-                result = lighten(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_UNKNOWN:
-            default:
-                result = 0;
-                break;
-            }
-
-            dstPixelArray->set(pixelOffset + channel, result);
-        }
-        unsigned char alphaR = 255 - ((255 - alphaA) * (255 - alphaB)) / 255;
-        dstPixelArray->set(pixelOffset + 3, alphaR);
+    switch (m_mode) {
+    case FEBLEND_MODE_NORMAL:
+        platformApply<BlendNormal>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_MULTIPLY:
+        platformApply<BlendMultiply>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_SCREEN:
+        platformApply<BlendScreen>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_DARKEN:
+        platformApply<BlendDarken>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_LIGHTEN:
+        platformApply<BlendLighten>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_UNKNOWN:
+        platformApply<BlendUnknown>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
     }
 }
 
@@ -165,7 +197,7 @@ void FEBlend::platformApplySoftware()
         reinterpret_cast<uint32_t*>(dstPixelArray->data())[0] = sourceBAndDest[0];
     }
 #else
-    platformApplyGeneric(srcPixelArrayA, srcPixelArrayB, dstPixelArray, pixelArrayLength);
+    platformApplyGeneric(srcPixelArrayA->data(), srcPixelArrayB->data(), dstPixelArray->data(), pixelArrayLength);
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/FEBlend.h b/Source/WebCore/platform/graphics/filters/FEBlend.h
index cc72e4aca..fe5017c3e 100644
--- a/Source/WebCore/platform/graphics/filters/FEBlend.h
+++ b/Source/WebCore/platform/graphics/filters/FEBlend.h
@@ -45,8 +45,8 @@ public:
     BlendModeType blendMode() const;
     bool setBlendMode(BlendModeType);
 
-    void platformApplyGeneric(PassRefPtr<Uint8ClampedArray> pixelArrayA, PassRefPtr<Uint8ClampedArray> pixelArrayB,
-                              Uint8ClampedArray* dstPixelArray, unsigned pixelArrayLength);
+    void platformApplyGeneric(unsigned char* srcPixelArrayA, unsigned char* srcPixelArrayB, unsigned char* dstPixelArray,
+                           unsigned colorArrayLength);
     void platformApplyNEON(unsigned char* srcPixelArrayA, unsigned char* srcPixelArrayB, unsigned char* dstPixelArray,
                            unsigned colorArrayLength);
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
index f3c635af0..b6e91e2eb 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
@@ -31,15 +31,11 @@
 #ifndef HarfBuzzNGFace_h
 #define HarfBuzzNGFace_h
 
+#include <hb.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
-struct _hb_face_t;
-typedef _hb_face_t hb_face_t;
-struct _hb_font_t;
-typedef _hb_font_t hb_font_t;
-
 namespace WebCore {
 
 class FontPlatformData;
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index e7e8fc909..9ae500775 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -2,11 +2,11 @@
  * Copyright (C) 2007 Apple Computer, Inc.
  * Copyright (c) 2007, 2008, 2009, Google Inc. All rights reserved.
  * Copyright (C) 2010 Company 100, Inc.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -16,7 +16,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -35,12 +35,12 @@
 
 #if OS(WINDOWS)
 #include "OpenTypeUtilities.h"
-#include "PlatformSupport.h"
 #elif OS(UNIX)
 #include "SkStream.h"
 #endif
 
 #include "FontPlatformData.h"
+#include "LayoutTestSupport.h"
 #include "NotImplemented.h"
 #include "OpenTypeSanitizer.h"
 #include "SharedBuffer.h"
@@ -83,7 +83,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
            sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
 
     // FIXME: almost identical to FillLogFont in FontCacheWin.cpp.
-    // Need to refactor. 
+    // Need to refactor.
     logFont.lfHeight = -size;
     logFont.lfWidth = 0;
     logFont.lfEscapement = 0;
@@ -92,7 +92,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     logFont.lfStrikeOut = false;
     logFont.lfCharSet = DEFAULT_CHARSET;
     logFont.lfOutPrecision = OUT_TT_ONLY_PRECIS;
-    logFont.lfQuality = PlatformSupport::layoutTestMode() ?
+    logFont.lfQuality = isRunningLayoutTest() ?
                         NONANTIALIASED_QUALITY :
                         DEFAULT_QUALITY; // Honor user's desktop settings.
     logFont.lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
diff --git a/Source/WebCore/platform/graphics/skia/FontSkia.cpp b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
index abd556c83..03f1417fb 100644
--- a/Source/WebCore/platform/graphics/skia/FontSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2011 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -33,8 +33,8 @@
 
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
-#include "PlatformSupport.h"
 #include "SimpleFontData.h"
 
 #include "SkCanvas.h"
@@ -83,7 +83,7 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
 
     bool shouldSmoothFonts = true;
     bool shouldAntialias = true;
-    
+
     switch (fontDescription().fontSmoothing()) {
     case Antialiased:
         shouldSmoothFonts = false;
@@ -96,10 +96,10 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         break;
     case AutoSmoothing:
         // For the AutoSmooth case, don't do anything! Keep the default settings.
-        break; 
+        break;
     }
-    
-    if (!shouldUseSmoothing() || PlatformSupport::layoutTestMode())
+
+    if (!shouldUseSmoothing() || isRunningLayoutTest())
         shouldSmoothFonts = false;
 
     const GlyphBufferGlyph* glyphs = glyphBuffer.glyphs(from);
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 26aba108a..0af779c51 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -37,14 +37,17 @@
 #include "Gradient.h"
 #include "ImageBuffer.h"
 #include "IntRect.h"
+#include "KURL.h"
 #include "NativeImageSkia.h"
 #include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 
+#include "SkAnnotation.h"
 #include "SkBitmap.h"
 #include "SkBlurMaskFilter.h"
 #include "SkColorFilter.h"
 #include "SkCornerPathEffect.h"
+#include "SkData.h"
 #include "SkLayerDrawLooper.h"
 #include "SkShader.h"
 #include "SkiaUtils.h"
@@ -998,6 +1001,11 @@ void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
 
 void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
 {
+    if (paintingDisabled())
+        return;
+
+    SkAutoDataUnref url(SkData::NewWithCString(link.string().utf8().data()));
+    SkAnnotateRectWithURL(platformContext()->canvas(), destRect, url.get());
 }
 
 void GraphicsContext::setPlatformShouldAntialias(bool enable)
diff --git a/Source/WebCore/platform/graphics/win/UniscribeController.cpp b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
index 60f8d12a1..6158fe617 100644
--- a/Source/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -31,6 +31,8 @@
 #include "TextRun.h"
 #include <wtf/MathExtras.h>
 
+using namespace WTF;
+using namespace Unicode;
 using namespace std;
 
 namespace WebCore {
@@ -131,7 +133,7 @@ void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
     UChar newC = 0;
 
     bool isSmallCaps;
-    bool nextIsSmallCaps = m_font.isSmallCaps() && !(U_GET_GC_MASK(*curr) & U_GC_M_MASK) && (newC = u_toupper(*curr)) != *curr;
+    bool nextIsSmallCaps = m_font.isSmallCaps() && !(category(*curr) & (Mark_NonSpacing | Mark_Enclosing | Mark_SpacingCombining)) && (newC = toUpper(*curr)) != *curr;
 
     if (nextIsSmallCaps)
         smallCapsBuffer[curr - cp] = newC;
@@ -146,10 +148,10 @@ void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
         int index = curr - cp;
         UChar c = *curr;
 
-        bool forceSmallCaps = isSmallCaps && (U_GET_GC_MASK(c) & U_GC_M_MASK);
+        bool forceSmallCaps = isSmallCaps && (category(c) & (Mark_NonSpacing | Mark_Enclosing | Mark_SpacingCombining));
         nextFontData = m_font.glyphDataForCharacter(*curr, false, forceSmallCaps ? SmallCapsVariant : AutoVariant).fontData;
         if (m_font.isSmallCaps()) {
-            nextIsSmallCaps = forceSmallCaps || (newC = u_toupper(c)) != c;
+            nextIsSmallCaps = forceSmallCaps || (newC = toUpper(c)) != c;
             if (nextIsSmallCaps)
                 smallCapsBuffer[index] = forceSmallCaps ? c : newC;
         }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index a77077a05..22b54f651 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -64,7 +64,9 @@ using namespace HTMLNames;
 static HTMLMediaElement* getMediaElementFromRenderObject(RenderObject* o)
 {
     Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    Node* mediaNode = node ? node->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = node;
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return 0;
 
@@ -313,7 +315,9 @@ void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(StyleResolver*, Ren
 static IntRect centerRectVerticallyInParentInputElement(RenderObject* renderObject, const IntRect& rect)
 {
     // Get the renderer of <input> element.
-    Node* input = renderObject->node()->shadowAncestorNode();
+    Node* input = renderObject->node()->shadowHost();
+    if (!input)
+        input = renderObject->node();
     if (!input->renderer()->isBox())
         return IntRect();
 
@@ -711,4 +715,18 @@ String RenderThemeGtk::fileListNameForWidth(const FileList* fileList, const Font
     return StringTruncator::centerTruncate(string, width, font, StringTruncator::EnableRoundingHacks);
 }
 
+#if ENABLE(DATALIST_ELEMENT)
+IntSize RenderThemeGtk::sliderTickSize() const
+{
+    // FIXME: We need to set this to the size of one tick mark.
+    return IntSize(0, 0);
+}
+
+int RenderThemeGtk::sliderTickOffsetFromTrackCenter() const
+{
+    // FIXME: We need to set this to the position of the tick marks.
+    return 0;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index add959d9f..5b4fbe1aa 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -93,6 +93,14 @@ public:
 #endif
 #endif
 
+#if ENABLE(DATALIST_ELEMENT)
+    // Returns size of one slider tick mark for a horizontal track.
+    // For vertical tracks we rotate it and use it. i.e. Width is always length along the track.
+    virtual IntSize sliderTickSize() const;
+    // Returns the distance of slider tick origin from the slider track center.
+    virtual int sliderTickOffsetFromTrackCenter() const;
+#endif
+
 #ifdef GTK_API_VERSION_2
     GtkWidget* gtkContainer() const;
     GtkWidget* gtkEntry() const;
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index e4a4c3829..ecf648fce 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -54,7 +54,9 @@ class Frame;
 #endif
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QWebNetworkJob;
+QT_END_NAMESPACE
 namespace WebCore {
 class QNetworkReplyHandler;
 }
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 3badb6fcc..09f518b86 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -48,7 +48,6 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PaintInfo.h"
-#include "QWebPageClient.h"
 #include "RenderBox.h"
 #if ENABLE(PROGRESS_ELEMENT)
 #include "RenderProgress.h"
@@ -235,37 +234,27 @@ void RenderThemeQt::adjustRepaintRect(const RenderObject* o, IntRect& rect)
 
 Color RenderThemeQt::platformActiveSelectionBackgroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Active, QPalette::Highlight).color();
 }
 
 Color RenderThemeQt::platformInactiveSelectionBackgroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Inactive, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Inactive, QPalette::Highlight).color();
 }
 
 Color RenderThemeQt::platformActiveSelectionForegroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::HighlightedText).color();
+    return colorPalette().brush(QPalette::Active, QPalette::HighlightedText).color();
 }
 
 Color RenderThemeQt::platformInactiveSelectionForegroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Inactive, QPalette::HighlightedText).color();
+    return colorPalette().brush(QPalette::Inactive, QPalette::HighlightedText).color();
 }
 
 Color RenderThemeQt::platformFocusRingColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Active, QPalette::Highlight).color();
 }
 
 void RenderThemeQt::systemFont(int, FontDescription&) const
@@ -275,8 +264,7 @@ void RenderThemeQt::systemFont(int, FontDescription&) const
 
 Color RenderThemeQt::systemColor(int cssValueId) const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
+    QPalette pal = colorPalette();
     switch (cssValueId) {
     case CSSValueButtontext:
         return pal.brush(QPalette::Active, QPalette::ButtonText).color();
@@ -456,13 +444,20 @@ IntRect RenderThemeQt::convertToPaintingRect(RenderObject* inputRenderer, const
     return partRect;
 }
 
+QPalette RenderThemeQt::colorPalette() const
+{
+    return QGuiApplication::palette();
+}
+
 bool RenderThemeQt::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& pi,
                                                  const IntRect& r)
 {
     // Logic copied from RenderThemeChromium.cpp.
 
     // Get the renderer of <input> element.
-    Node* input = o->node()->shadowAncestorNode();
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     if (!input->renderer()->isBox())
         return false;
     RenderBox* inputRenderBox = toRenderBox(input->renderer());
@@ -539,23 +534,6 @@ bool RenderThemeQt::supportsFocus(ControlPart appearance) const
     }
 }
 
-void RenderThemeQt::setPaletteFromPageClientIfExists(QPalette& palette) const
-{
-    // If the webview has a custom palette, use it
-    if (!m_page)
-        return;
-    Chrome* chrome = m_page->chrome();
-    if (!chrome)
-        return;
-    ChromeClient* chromeClient = chrome->client();
-    if (!chromeClient)
-        return;
-    QWebPageClient* pageClient = chromeClient->platformPageClient();
-    if (!pageClient)
-        return;
-    palette = pageClient->palette();
-}
-
 #if ENABLE(VIDEO)
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
@@ -620,11 +598,8 @@ QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
     if (o->node()->active())
         fgColor = fgColor.lighter();
 
-    if (!mediaElementCanPlay(o)) {
-        QPalette pal = QGuiApplication::palette();
-        setPaletteFromPageClientIfExists(pal);
-        fgColor = pal.brush(QPalette::Disabled, QPalette::Text).color();
-    }
+    if (!mediaElementCanPlay(o))
+        fgColor = colorPalette().brush(QPalette::Disabled, QPalette::Text).color();
 
     return fgColor;
 }
@@ -759,9 +734,7 @@ bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const PaintInfo
     int width = b.width();
     int height = b.height();
 
-    // Get the scale color from the page client
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
+    QPalette pal = colorPalette();
     const QColor highlightText = pal.brush(QPalette::Active, QPalette::HighlightedText).color();
     const QColor scaleColor(highlightText.red(), highlightText.green(), highlightText.blue(), mediaControlsBaselineOpacity() * 255);
 
@@ -834,8 +807,9 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
 bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(o->node());
-    Node* hostNode = o->node()->shadowAncestorNode();
-    ASSERT(hostNode);
+    Node* hostNode = o->node()->shadowHost();
+    if (!hostNode)
+        hostNode = o->node();
     HTMLMediaElement* mediaElement = toParentMediaElement(hostNode);
     if (!mediaElement)
         return false;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index a7379140a..29ac33b59 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -25,6 +25,7 @@
 #include "RenderTheme.h"
 
 #include <QBrush>
+#include <QPalette>
 #include <QSharedPointer>
 #include <QString>
 
@@ -164,8 +165,6 @@ protected:
 
     virtual QRect inflateButtonRect(const QRect& originalRect) const;
 
-    void setPaletteFromPageClientIfExists(QPalette&) const;
-
     virtual void setPopupPadding(RenderStyle*) const = 0;
 
     virtual QSharedPointer<StylePainter> getStylePainter(const PaintInfo&) = 0;
@@ -174,6 +173,8 @@ protected:
 
     IntRect convertToPaintingRect(RenderObject* inputRenderer, const RenderObject* partRenderer, IntRect partRect, const IntRect& localOffset) const;
 
+    virtual QPalette colorPalette() const;
+
     Page* m_page;
 
     QString m_buttonFontFamily;
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
index ac0847832..602f3fc99 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
@@ -202,6 +202,12 @@ QSharedPointer<StylePainter> RenderThemeQtMobile::getStylePainter(const PaintInf
     return QSharedPointer<StylePainter>(new StylePainterMobile(this, pi));
 }
 
+QPalette RenderThemeQtMobile::colorPalette() const
+{
+    static QPalette lightGrayPalette(Qt::lightGray);
+    return lightGrayPalette;
+}
+
 StylePainterMobile::StylePainterMobile(RenderThemeQtMobile* theme, const PaintInfo& paintInfo)
     : StylePainter(theme, paintInfo)
 {
@@ -896,13 +902,6 @@ bool RenderThemeQtMobile::checkMultiple(RenderObject* o) const
     return select ? select->multiple() : false;
 }
 
-void RenderThemeQtMobile::setPaletteFromPageClientIfExists(QPalette& palette) const
-{
-    static QPalette lightGrayPalette(Qt::lightGray);
-    palette = lightGrayPalette;
-    return;
-}
-
 void RenderThemeQtMobile::adjustSliderThumbSize(RenderStyle* style, Element* element) const
 {
     const ControlPart part = style->appearance();
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.h b/Source/WebCore/platform/qt/RenderThemeQtMobile.h
index 739e706ae..f2cc944bb 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.h
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.h
@@ -83,12 +83,12 @@ protected:
     virtual void computeSizeBasedOnStyle(RenderStyle*) const;
     virtual QSharedPointer<StylePainter> getStylePainter(const PaintInfo&);
 
+    virtual QPalette colorPalette() const;
+
 private:
     bool checkMultiple(RenderObject*) const;
     void setButtonPadding(RenderStyle*) const;
     void setPopupPadding(RenderStyle*) const;
-
-    void setPaletteFromPageClientIfExists(QPalette&) const;
 };
 
 struct KeyIdentifier {
diff --git a/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h b/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
index bfe7e22e3..750b40f14 100644
--- a/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
+++ b/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
@@ -20,8 +20,10 @@
 #ifndef ThirdPartyCookiesQt_h
 #define ThirdPartyCookiesQt_h
 
+QT_BEGIN_NAMESPACE
 class QNetworkCookieJar;
 class QUrl;
+QT_END_NAMESPACE
 
 namespace WebCore {
 class NetworkingContext;
diff --git a/Source/WebCore/platform/text/LocaleWin.cpp b/Source/WebCore/platform/text/LocaleWin.cpp
index be6685747..0f0e740e0 100644
--- a/Source/WebCore/platform/text/LocaleWin.cpp
+++ b/Source/WebCore/platform/text/LocaleWin.cpp
@@ -57,9 +57,9 @@ namespace WebCore {
 inline LocaleWin::LocaleWin(LCID lcid)
     : m_lcid(lcid)
 {
-    struct tm tm;
-    getCurrentLocalTime(&tm);
-    m_baseYear = tm.tm_year + 1900;
+    SYSTEMTIME systemTime;
+    GetLocalTime(&systemTime);
+    m_baseYear = systemTime.wYear;
 
 #if ENABLE(CALENDAR_PICKER)
     DWORD value = 0;
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index 8281538bf..bd8b7a51e 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -52,7 +52,7 @@
 #include "gtk/TextCodecGtk.h"
 #endif
 #if USE(WINCE_UNICODE)
-#include "TextCodecWinCE.h"
+#include "win/TextCodecWin.h"
 #endif
 
 #include <wtf/CurrentTime.h>
@@ -312,8 +312,8 @@ static void extendTextCodecMaps()
 #endif
 
 #if USE(WINCE_UNICODE)
-    TextCodecWinCE::registerExtendedEncodingNames(addToTextEncodingNameMap);
-    TextCodecWinCE::registerExtendedCodecs(addToTextCodecMap);
+    TextCodecWin::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecWin::registerExtendedCodecs(addToTextCodecMap);
 #endif
 
     pruneBlacklistedCodecs();
diff --git a/Source/WebCore/platform/text/wince/TextCodecWinCE.cpp b/Source/WebCore/platform/text/win/TextCodecWin.cpp
index 0c4ec5012..e19237d68 100644
--- a/Source/WebCore/platform/text/wince/TextCodecWinCE.cpp
+++ b/Source/WebCore/platform/text/win/TextCodecWin.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
- * Copyright (C) 2010-2011 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2010-2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,17 +23,16 @@
  */
 
 #include "config.h"
-#include "TextCodecWinCE.h"
+#include "TextCodecWin.h"
 
-#include "FontCache.h"
+#include "COMPtr.h"
 #include <mlang.h>
-#include <winbase.h>
-#include <winnls.h>
+#include <windows.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -82,39 +81,42 @@ static LanguageManager& languageManager()
 
 LanguageManager::LanguageManager()
 {
-    IEnumCodePage* enumInterface;
-    IMultiLanguage* mli = FontCache::getMultiLanguageInterface();
-    if (mli && S_OK == mli->EnumCodePages(MIMECONTF_BROWSER, &enumInterface)) {
-        MIMECPINFO cpInfo;
-        ULONG ccpInfo;
-        while (S_OK == enumInterface->Next(1, &cpInfo, &ccpInfo) && ccpInfo) {
-            if (!IsValidCodePage(cpInfo.uiCodePage))
-                continue;
-
-            HashMap<UINT, CString>::iterator i = codePageCharsets().find(cpInfo.uiCodePage);
-
-            CString name(String(cpInfo.wszWebCharset).latin1());
-            if (i == codePageCharsets().end()) {
-                CharsetInfo info;
-                info.m_codePage = cpInfo.uiCodePage;
-                knownCharsets().set(name.data(), info);
-                i = codePageCharsets().set(cpInfo.uiCodePage, name).iterator;
-            }
-            if (i != codePageCharsets().end()) {
-                HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(String(i->second.data(), i->second.length()));
-                ASSERT(j != knownCharsets().end());
-                CharsetInfo& info = j->second;
-                info.m_name = i->second.data();
-                info.m_friendlyName = cpInfo.wszDescription;
-                info.m_aliases.append(name);
-                info.m_aliases.append(String(cpInfo.wszHeaderCharset).latin1());
-                info.m_aliases.append(String(cpInfo.wszBodyCharset).latin1());
-                String cpName = "cp" + String::number(cpInfo.uiCodePage);
-                info.m_aliases.append(cpName.latin1());
-                supportedCharsets().add(i->second.data());
-            }
+    COMPtr<IMultiLanguage> multiLanguage;
+    if (FAILED(::CoCreateInstance(CLSID_CMultiLanguage, 0, CLSCTX_INPROC_SERVER, IID_IMultiLanguage, reinterpret_cast<LPVOID*>(&multiLanguage))))
+        return;
+
+    COMPtr<IEnumCodePage> enumInterface;
+    if (FAILED(multiLanguage->EnumCodePages(MIMECONTF_BROWSER, &enumInterface)))
+        return;
+
+    MIMECPINFO cpInfo;
+    ULONG ccpInfo;
+    while (SUCCEEDED(enumInterface->Next(1, &cpInfo, &ccpInfo)) && ccpInfo) {
+        if (!IsValidCodePage(cpInfo.uiCodePage))
+            continue;
+
+        HashMap<UINT, CString>::iterator i = codePageCharsets().find(cpInfo.uiCodePage);
+
+        CString name(String(cpInfo.wszWebCharset).latin1());
+        if (i == codePageCharsets().end()) {
+            CharsetInfo info;
+            info.m_codePage = cpInfo.uiCodePage;
+            knownCharsets().set(name.data(), info);
+            i = codePageCharsets().set(cpInfo.uiCodePage, name).iterator;
+        }
+        if (i != codePageCharsets().end()) {
+            HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(String(i->second.data(), i->second.length()));
+            ASSERT(j != knownCharsets().end());
+            CharsetInfo& info = j->second;
+            info.m_name = i->second.data();
+            info.m_friendlyName = cpInfo.wszDescription;
+            info.m_aliases.append(name);
+            info.m_aliases.append(String(cpInfo.wszHeaderCharset).latin1());
+            info.m_aliases.append(String(cpInfo.wszBodyCharset).latin1());
+            String cpName = "cp" + String::number(cpInfo.uiCodePage);
+            info.m_aliases.append(cpName.latin1());
+            supportedCharsets().add(i->second.data());
         }
-        enumInterface->Release();
     }
 }
 
@@ -127,21 +129,21 @@ static UINT getCodePage(const char* name)
     return i == charsets.end() ? CP_ACP : i->second.m_codePage;
 }
 
-static PassOwnPtr<TextCodec> newTextCodecWinCE(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecWin(const TextEncoding& encoding, const void*)
 {
-    return adoptPtr(new TextCodecWinCE(getCodePage(encoding.name())));
+    return adoptPtr(new TextCodecWin(getCodePage(encoding.name())));
 }
 
-TextCodecWinCE::TextCodecWinCE(UINT codePage)
+TextCodecWin::TextCodecWin(UINT codePage)
     : m_codePage(codePage)
 {
 }
 
-TextCodecWinCE::~TextCodecWinCE()
+TextCodecWin::~TextCodecWin()
 {
 }
 
-void TextCodecWinCE::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
+void TextCodecWin::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
@@ -154,13 +156,13 @@ void TextCodecWinCE::registerExtendedEncodingNames(EncodingNameRegistrar registr
     }
 }
 
-void TextCodecWinCE::registerExtendedCodecs(TextCodecRegistrar registrar)
+void TextCodecWin::registerExtendedCodecs(TextCodecRegistrar registrar)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
         HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(*i);
         if (j != knownCharsets().end())
-            registrar(j->second.m_name.data(), newTextCodecWinCE, 0);
+            registrar(j->second.m_name.data(), newTextCodecWin, 0);
     }
 }
 
@@ -232,7 +234,7 @@ static void decodeInternal(Vector<UChar, 8192>& result, UINT codePage, const cha
     }
 }
 
-String TextCodecWinCE::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+String TextCodecWin::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
 {
     if (!m_decodeBuffer.isEmpty()) {
         m_decodeBuffer.append(bytes, length);
@@ -274,7 +276,7 @@ String TextCodecWinCE::decode(const char* bytes, size_t length, bool flush, bool
     return String::adopt(result);
 }
 
-CString TextCodecWinCE::encode(const UChar* characters, size_t length, UnencodableHandling)
+CString TextCodecWin::encode(const UChar* characters, size_t length, UnencodableHandling)
 {
     if (!characters || !length)
         return CString();
@@ -294,7 +296,7 @@ CString TextCodecWinCE::encode(const UChar* characters, size_t length, Unencodab
     return result;
 }
 
-void TextCodecWinCE::enumerateSupportedEncodings(EncodingReceiver& receiver)
+void TextCodecWin::enumerateSupportedEncodings(EncodingReceiver& receiver)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
diff --git a/Source/WebCore/platform/text/wince/TextCodecWinCE.h b/Source/WebCore/platform/text/win/TextCodecWin.h
index 500a8cdd9..15b2bc3d9 100644
--- a/Source/WebCore/platform/text/wince/TextCodecWinCE.h
+++ b/Source/WebCore/platform/text/win/TextCodecWin.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
- * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2010-2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,27 +23,27 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef TextCodecWinCE_h
-#define TextCodecWinCE_h
+#ifndef TextCodecWin_h
+#define TextCodecWin_h
 
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncoding.h"
-#include <wtf/Vector.h>
 #include <windows.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class TextCodecWinCE : public TextCodec {
+class TextCodecWin : public TextCodec {
 public:
     static void registerExtendedEncodingNames(EncodingNameRegistrar);
     static void registerExtendedCodecs(TextCodecRegistrar);
 
-    TextCodecWinCE(UINT codePage);
-    virtual ~TextCodecWinCE();
+    TextCodecWin(UINT codePage);
+    virtual ~TextCodecWin();
 
     virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
     virtual CString encode(const UChar*, size_t length, UnencodableHandling);
@@ -58,7 +58,7 @@ public:
         virtual bool receive(const char* encoding, const wchar_t* friendlyName, unsigned int codePage) = 0;
     };
 
-    static void enumerateSupportedEncodings(EncodingReceiver& receiver);
+    static void enumerateSupportedEncodings(EncodingReceiver&);
 
 private:
     UINT m_codePage;
@@ -67,4 +67,4 @@ private:
 
 } // namespace WebCore
 
-#endif // TextCodecWinCE_h
+#endif // TextCodecWin_h
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index b18c53feb..eb5c5b1a0 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -378,10 +378,11 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
     }
 
     // Check that we don't go off the screen horizontally
-    if (popupRect.x() < screen.x()) {
-        popupRect.setWidth(popupRect.width() - (screen.x() - popupRect.x()));
+    if (popupRect.x() + popupRect.width() > screen.width())
+        popupRect.setX(screen.x() + screen.width() - popupRect.width());
+    if (popupRect.x() < screen.x())
         popupRect.setX(screen.x());
-    }
+
     m_windowRect = popupRect;
     return;
 }
diff --git a/Source/WebCore/plugins/PluginData.h b/Source/WebCore/plugins/PluginData.h
index 150273904..fdcce6126 100644
--- a/Source/WebCore/plugins/PluginData.h
+++ b/Source/WebCore/plugins/PluginData.h
@@ -83,7 +83,7 @@ public:
     static void refresh();
 
 private:
-    PluginData(const Page*);
+    explicit PluginData(const Page*);
     void initPlugins(const Page*);
 
     Vector<PluginInfo> m_plugins;
diff --git a/Source/WebCore/plugins/PluginViewBase.h b/Source/WebCore/plugins/PluginViewBase.h
index 5f13c8846..702e95adb 100644
--- a/Source/WebCore/plugins/PluginViewBase.h
+++ b/Source/WebCore/plugins/PluginViewBase.h
@@ -61,7 +61,7 @@ public:
     virtual bool wantsWheelEvents() { return false; }
 
 protected:
-    PluginViewBase(PlatformWidget widget = 0) : Widget(widget) { }
+    explicit PluginViewBase(PlatformWidget widget = 0) : Widget(widget) { }
     
 private:
     virtual bool isPluginViewBase() const { return true; }
diff --git a/Source/WebCore/rendering/RenderInputSpeech.cpp b/Source/WebCore/rendering/RenderInputSpeech.cpp
index 370ae0aec..8d42d3be8 100644
--- a/Source/WebCore/rendering/RenderInputSpeech.cpp
+++ b/Source/WebCore/rendering/RenderInputSpeech.cpp
@@ -62,7 +62,7 @@ bool RenderInputSpeech::paintInputFieldSpeechButton(RenderObject* object, const
         return false;
 
     // Get the renderer of <input> element.
-    Node* input = object->node()->shadowAncestorNode();
+    Node* input = object->node()->shadowHost();
     if (!input->renderer()->isBox())
         return false;
     RenderBox* inputRenderBox = toRenderBox(input->renderer());
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
index efa05186d..b3b82982c 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -240,9 +240,7 @@ static bool paintMediaSlider(RenderObject* object, const PaintInfo& paintInfo, c
 static bool paintMediaSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     ASSERT(object->node());
-    Node* hostNode = object->node()->shadowAncestorNode();
-    ASSERT(hostNode);
-    HTMLMediaElement* mediaElement = toParentMediaElement(hostNode);
+    HTMLMediaElement* mediaElement = toParentMediaElement(object->node()->shadowHost());
     if (!mediaElement)
         return false;
 
@@ -295,9 +293,7 @@ static bool paintMediaVolumeSlider(RenderObject* object, const PaintInfo& paintI
 static bool paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     ASSERT(object->node());
-    Node* hostNode = object->node()->shadowAncestorNode();
-    ASSERT(hostNode);
-    HTMLMediaElement* mediaElement = toParentMediaElement(hostNode);
+    HTMLMediaElement* mediaElement = toParentMediaElement(object->node()->shadowHost());
     if (!mediaElement)
         return false;
 
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.cpp b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
index 44e2aa631..6d2e09b2e 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -138,4 +138,9 @@ void RenderScrollbarTheme::paintThumb(GraphicsContext* context, ScrollbarThemeCl
     toRenderScrollbar(scrollbar)->paintPart(context, ThumbPart, rect);
 }
 
+void RenderScrollbarTheme::paintTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
+{
+    ScrollbarTheme::theme()->paintTickmarks(context, scrollbar, rect);
+}
+
 }
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.h b/Source/WebCore/rendering/RenderScrollbarTheme.h
index 9cef3949f..c14de3fbc 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.h
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.h
@@ -73,6 +73,7 @@ protected:
     virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
     virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
     virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) OVERRIDE;
 
     virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect&);
 };
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index 55a65717d..0b63245e5 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -53,10 +53,10 @@ VisiblePosition RenderTextControlInnerBlock::positionForPoint(const LayoutPoint&
 {
     LayoutPoint contentsPoint(point);
 
-    // Multiline text controls have the scroll on shadowAncestorNode, so we need to take that
-    // into account here.
+    // Multiline text controls have the scroll on shadowHost, so we need to take
+    // that into account here.
     if (m_multiLine) {
-        RenderTextControl* renderer = toRenderTextControl(node()->shadowAncestorNode()->renderer());
+        RenderTextControl* renderer = toRenderTextControl(node()->shadowHost()->renderer());
         if (renderer->hasOverflowClip())
             contentsPoint += renderer->scrolledContentOffset();
     }
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
index 5404e47f8..9240df34c 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
@@ -28,6 +28,7 @@
 
 #include "CSSValueKeywords.h"
 #include "Color.h"
+#include "LayoutTestSupport.h"
 #include "PaintInfo.h"
 #include "PlatformSupport.h"
 #include "RenderMediaControlsChromium.h"
@@ -56,7 +57,7 @@ RenderThemeChromiumAndroid::~RenderThemeChromiumAndroid()
 
 Color RenderThemeChromiumAndroid::systemColor(int cssValueId) const
 {
-    if (PlatformSupport::layoutTestMode() && cssValueId == CSSValueButtonface) {
+    if (isRunningLayoutTest() && cssValueId == CSSValueButtonface) {
         // Match Chromium Linux' button color in layout tests.
         static const Color linuxButtonGrayColor(0xffdddddd);
         return linuxButtonGrayColor;
@@ -77,7 +78,7 @@ String RenderThemeChromiumAndroid::extraDefaultStyleSheet()
 
 void RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle(StyleResolver*, RenderStyle* style, Element*) const
 {
-    if (PlatformSupport::layoutTestMode()) {
+    if (isRunningLayoutTest()) {
         // Match Chromium Linux spin button style in layout tests.
         // FIXME: Consider removing the conditional if a future Android theme matches this.
         IntSize size = PlatformSupport::getThemePartSize(PlatformSupport::PartInnerSpinButton);
diff --git a/Source/WebCore/rendering/RenderThemeChromiumMac.mm b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
index 1791b09ab..05a9589db 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/Source/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -21,10 +21,10 @@
 #import "config.h"
 
 #import "CalendarPickerMac.h"
+#import "LayoutTestSupport.h"
 #import "LocalCurrentGraphicsContext.h"
 #import "RenderThemeChromiumMac.h"
 #import "PaintInfo.h"
-#import "PlatformSupport.h"
 #import "RenderMediaControlsChromium.h"
 #import "WebCoreSystemInterface.h"
 #import "UserAgentStyleSheets.h"
@@ -80,7 +80,7 @@ bool RenderThemeChromiumMac::supportsDataListUI(const AtomicString& type) const
 
 bool RenderThemeChromiumMac::usesTestModeFocusRingColor() const
 {
-    return PlatformSupport::layoutTestMode();
+    return isRunningLayoutTest();
 }
 
 NSView* RenderThemeChromiumMac::documentViewFor(RenderObject*) const
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 3f0e907e2..7910acbc1 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -29,9 +29,9 @@
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "Image.h"
+#include "LayoutTestSupport.h"
 #include "MediaControlElements.h"
 #include "PaintInfo.h"
-#include "PlatformSupport.h"
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
 #include "RenderMediaControlsChromium.h"
@@ -160,7 +160,7 @@ double RenderThemeChromiumSkia::caretBlinkInterval() const
 {
     // Disable the blinking caret in layout test mode, as it introduces
     // a race condition for the pixel tests. http://b/1198440
-    if (PlatformSupport::layoutTestMode())
+    if (isRunningLayoutTest())
         return 0;
 
     return caretBlinkIntervalInternal();
@@ -281,10 +281,11 @@ IntRect RenderThemeChromiumSkia::convertToPaintingRect(RenderObject* inputRender
 bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* cancelButtonObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
-    Node* input = cancelButtonObject->node()->shadowAncestorNode();
-    if (!input->renderer()->isBox())
+    Node* input = cancelButtonObject->node()->shadowHost();
+    RenderObject* baseRenderer = input ? input->renderer() : cancelButtonObject;
+    if (!baseRenderer->isBox())
         return false;
-    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    RenderBox* inputRenderBox = toRenderBox(baseRenderer);
     LayoutRect inputContentBox = inputRenderBox->contentBoxRect();
 
     // Make sure the scaled button stays square and will fit in its parent's box.
@@ -324,10 +325,11 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle(StyleResol
 bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* magnifierObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
-    Node* input = magnifierObject->node()->shadowAncestorNode();
-    if (!input->renderer()->isBox())
+    Node* input = magnifierObject->node()->shadowHost();
+    RenderObject* baseRenderer = input ? input->renderer() : magnifierObject;
+    if (!baseRenderer->isBox())
         return false;
-    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    RenderBox* inputRenderBox = toRenderBox(baseRenderer);
     LayoutRect inputContentBox = inputRenderBox->contentBoxRect();
 
     // Make sure the scaled decoration stays square and will fit in its parent's box.
@@ -359,10 +361,11 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle(StyleResolver*
 bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* magnifierObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
-    Node* input = magnifierObject->node()->shadowAncestorNode();
-    if (!input->renderer()->isBox())
+    Node* input = magnifierObject->node()->shadowHost();
+    RenderObject* baseRenderer = input ? input->renderer() : magnifierObject;
+    if (!baseRenderer->isBox())
         return false;
-    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    RenderBox* inputRenderBox = toRenderBox(baseRenderer);
     LayoutRect inputContentBox = inputRenderBox->contentBoxRect();
 
     // Make sure the scaled decoration will fit in its parent's box.
diff --git a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
index c00e46e06..f2a79f4cc 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -36,6 +36,7 @@
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "HWndDC.h"
+#include "LayoutTestSupport.h"
 #include "MediaControlElements.h"
 #include "PaintInfo.h"
 #include "PlatformSupport.h"
@@ -247,7 +248,7 @@ bool RenderThemeChromiumWin::supportsFocusRing(const RenderStyle* style) const
 
 Color RenderThemeChromiumWin::platformActiveSelectionBackgroundColor() const
 {
-    if (PlatformSupport::layoutTestMode())
+    if (isRunningLayoutTest())
         return Color(0x00, 0x00, 0xff); // Royal blue.
     COLORREF color = GetSysColor(COLOR_HIGHLIGHT);
     return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
@@ -255,7 +256,7 @@ Color RenderThemeChromiumWin::platformActiveSelectionBackgroundColor() const
 
 Color RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor() const
 {
-    if (PlatformSupport::layoutTestMode())
+    if (isRunningLayoutTest())
         return Color(0x99, 0x99, 0x99); // Medium gray.
     COLORREF color = GetSysColor(COLOR_GRAYTEXT);
     return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
@@ -263,7 +264,7 @@ Color RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor() const
 
 Color RenderThemeChromiumWin::platformActiveSelectionForegroundColor() const
 {
-    if (PlatformSupport::layoutTestMode())
+    if (isRunningLayoutTest())
         return Color(0xff, 0xff, 0xcc); // Pale yellow.
     COLORREF color = GetSysColor(COLOR_HIGHLIGHTTEXT);
     return Color(GetRValue(color), GetGValue(color), GetBValue(color), 0xff);
@@ -384,7 +385,7 @@ static int cssValueIdToSysColorIndex(int cssValueId)
 Color RenderThemeChromiumWin::systemColor(int cssValueId) const
 {
     int sysColorIndex = cssValueIdToSysColorIndex(cssValueId);
-    if (PlatformSupport::layoutTestMode() || (sysColorIndex == -1))
+    if (isRunningLayoutTest() || (sysColorIndex == -1))
         return RenderTheme::systemColor(cssValueId);
 
     COLORREF color = GetSysColor(sysColorIndex);
@@ -479,7 +480,7 @@ bool RenderThemeChromiumWin::paintSliderThumb(RenderObject* o, const PaintInfo&
 
 static int menuListButtonWidth()
 {
-    static int width = PlatformSupport::layoutTestMode() ? kStandardMenuListButtonWidth : GetSystemMetrics(SM_CXVSCROLL);
+    static int width = isRunningLayoutTest() ? kStandardMenuListButtonWidth : GetSystemMetrics(SM_CXVSCROLL);
     return width;
 }
 
@@ -603,7 +604,7 @@ unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o, ControlS
 
     // So are readonly text fields.
     if (isReadOnlyControl(o) && (part == TextFieldPart || part == TextAreaPart || part == SearchFieldPart))
-        return result;   
+        return result;
 
     if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
         if (!isEnabled(o))
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index 9de2b1252..1b92006f1 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -1559,8 +1559,9 @@ void RenderThemeMac::adjustSearchFieldStyle(StyleResolver* styleResolver, Render
 
 bool RenderThemeMac::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    Element* input = toElement(o->node()->shadowAncestorNode());
-    ASSERT(input);
+    Element* input = o->node()->shadowHost();
+    if (!input)
+        input = toElement(o->node());
 
     if (!input->renderer()->isBox())
         return false;
@@ -1652,7 +1653,9 @@ void RenderThemeMac::adjustSearchFieldResultsDecorationStyle(StyleResolver*, Ren
 
 bool RenderThemeMac::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* input = o->node()->shadowAncestorNode();
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     if (!input->renderer()->isBox())
         return false;
 
@@ -1685,7 +1688,9 @@ void RenderThemeMac::adjustSearchFieldResultsButtonStyle(StyleResolver*, RenderS
 
 bool RenderThemeMac::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
-    Node* input = o->node()->shadowAncestorNode();
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     if (!input->renderer()->isBox())
         return false;
 
@@ -1859,7 +1864,7 @@ bool RenderThemeMac::paintMediaFullscreenButton(RenderObject* o, const PaintInfo
 bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    Node* mediaNode = node ? node->shadowHost() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
 
@@ -1873,7 +1878,7 @@ bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const PaintInfo& pain
 bool RenderThemeMac::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    Node* mediaNode = node ? node->shadowHost() : 0;
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
 
@@ -1909,8 +1914,8 @@ bool RenderThemeMac::paintMediaSeekForwardButton(RenderObject* o, const PaintInf
 bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
+    Element* mediaNode = node ? node->shadowHost() : 0;
+    if (!mediaNode || !mediaNode->isMediaElement())
         return false;
 
     HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
diff --git a/Source/WebCore/rendering/RenderThemeSafari.cpp b/Source/WebCore/rendering/RenderThemeSafari.cpp
index 23fd8b193..4ff0fd07c 100644
--- a/Source/WebCore/rendering/RenderThemeSafari.cpp
+++ b/Source/WebCore/rendering/RenderThemeSafari.cpp
@@ -1075,8 +1075,9 @@ bool RenderThemeSafari::paintSearchFieldCancelButton(RenderObject* o, const Pain
 {
     ASSERT(SafariThemeLibrary());
 
-    Node* input = o->node()->shadowAncestorNode();
-    ASSERT(input);
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     RenderObject* renderer = input->renderer();
     ASSERT(renderer);
 
@@ -1129,8 +1130,9 @@ bool RenderThemeSafari::paintSearchFieldResultsDecoration(RenderObject* o, const
 {
     ASSERT(SafariThemeLibrary());
 
-    Node* input = o->node()->shadowAncestorNode();
-    ASSERT(input);
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     RenderObject* renderer = input->renderer();
     ASSERT(renderer);
 
@@ -1152,8 +1154,9 @@ bool RenderThemeSafari::paintSearchFieldResultsButton(RenderObject* o, const Pai
 {
     ASSERT(SafariThemeLibrary());
 
-    Node* input = o->node()->shadowAncestorNode();
-    ASSERT(input);
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     RenderObject* renderer = input->renderer();
     ASSERT(renderer);
 
diff --git a/Source/WebCore/rendering/RenderThemeWinCE.cpp b/Source/WebCore/rendering/RenderThemeWinCE.cpp
index 40349de10..188cd90b9 100644
--- a/Source/WebCore/rendering/RenderThemeWinCE.cpp
+++ b/Source/WebCore/rendering/RenderThemeWinCE.cpp
@@ -478,7 +478,9 @@ static HTMLMediaElement* mediaElementParent(Node* node)
 {
     if (!node)
         return 0;
-    Node* mediaNode = node->shadowAncestorNode();
+    Node* mediaNode = node->shadowHost();
+    if (!mediaNode)
+        mediaNode = node;
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return 0;
 
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 5e8a12c95..d56d2d3c1 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -304,7 +304,7 @@ protected:
         unsigned _overflowY : 3; // EOverflow
         unsigned _vertical_align : 4; // EVerticalAlign
         unsigned _clear : 2; // EClear
-        unsigned _position : 2; // EPosition
+        unsigned _position : 3; // EPosition
         unsigned _floating : 2; // EFloat
         unsigned _table_layout : 1; // ETableLayout
 
@@ -331,7 +331,7 @@ protected:
         unsigned _affectedByDrag : 1;
         unsigned _isLink : 1;
         // If you add more style bits here, you will also need to update RenderStyle::copyNonInheritedFrom()
-        // 53 bits
+        // 54 bits
     } noninherited_flags;
 
 // !END SYNC!
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 9c03f390f..149cd4471 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -94,7 +94,7 @@ enum EBorderPrecedence { BOFF, BTABLE, BCOLGROUP, BCOL, BROWGROUP, BROW, BCELL }
 enum OutlineIsAuto { AUTO_OFF = 0, AUTO_ON };
 
 enum EPosition {
-    StaticPosition, RelativePosition, AbsolutePosition, FixedPosition
+    StaticPosition, RelativePosition, AbsolutePosition, FixedPosition, StickyPosition
 };
 
 enum EFloat {
diff --git a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
index fd9949295..1a2bd3766 100644
--- a/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
+++ b/Source/WebCore/rendering/style/StyleGeneratedImage.cpp
@@ -85,7 +85,6 @@ void StyleGeneratedImage::removeClient(RenderObject* renderer)
 
 PassRefPtr<Image> StyleGeneratedImage::image(RenderObject* renderer, const IntSize& size) const
 {
-    renderer->document()->styleResolver()->setStyle(renderer->style());
     return m_imageGeneratorValue->image(renderer, size);
 }
 
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index e32142316..4d0315eee 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -624,6 +624,12 @@ String Internals::markerDescriptionForNode(Node* node, const String& markerType,
     return marker->description();
 }
 
+void Internals::addTextMatchMarker(const Range* range, bool isActive)
+{
+    range->ownerDocument()->updateLayoutIgnorePendingStylesheets();
+    range->ownerDocument()->markers()->addTextMatchMarker(range, isActive);
+}
+
 void Internals::setScrollViewPosition(Document* document, long x, long y, ExceptionCode& ec)
 {
     if (!document || !document->view()) {
@@ -918,6 +924,17 @@ unsigned Internals::touchEventHandlerCount(Document* document, ExceptionCode& ec
     return document->touchEventHandlerCount();
 }
 
+bool Internals::hasTouchEventListener(Document* document, ExceptionCode& ec)
+{
+    if (!document) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return document->hasListenerType(Document::TOUCH_LISTENER);
+}
+
+
 PassRefPtr<NodeList> Internals::nodesFromRect(Document* document, int x, int y, unsigned topPadding, unsigned rightPadding,
     unsigned bottomPadding, unsigned leftPadding, bool ignoreClipping, bool allowShadowContent, ExceptionCode& ec) const
 {
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index 040052378..58fc86983 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -117,6 +117,7 @@ public:
     unsigned markerCountForNode(Node*, const String&, ExceptionCode&);
     PassRefPtr<Range> markerRangeForNode(Node*, const String& markerType, unsigned index, ExceptionCode&);
     String markerDescriptionForNode(Node*, const String& markerType, unsigned index, ExceptionCode&);
+    void addTextMatchMarker(const Range*, bool isActive);
 
     void setScrollViewPosition(Document*, long x, long y, ExceptionCode&);
     void setPagination(Document* document, const String& mode, int gap, ExceptionCode& ec) { setPagination(document, mode, gap, 0, ec); }
@@ -154,6 +155,7 @@ public:
 
     unsigned wheelEventHandlerCount(Document*, ExceptionCode&);
     unsigned touchEventHandlerCount(Document*, ExceptionCode&);
+    bool hasTouchEventListener(Document*, ExceptionCode&);
 
     PassRefPtr<NodeList> nodesFromRect(Document*, int x, int y, unsigned topPadding, unsigned rightPadding,
         unsigned bottomPadding, unsigned leftPadding, bool ignoreClipping, bool allowShadowContent, ExceptionCode&) const;
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index fde4577eb..d1335991f 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -86,6 +86,7 @@ module window {
         unsigned long markerCountForNode(in Node node, in DOMString markerType) raises(DOMException);
         Range markerRangeForNode(in Node node, in DOMString markerType, in unsigned long index) raises(DOMException);
         DOMString markerDescriptionForNode(in Node node, in DOMString markerType, in unsigned long index) raises(DOMException);
+        void addTextMatchMarker(in Range range, in boolean isActive);
 
         void setScrollViewPosition(in Document document, in long x, in long y) raises(DOMException);
 
@@ -132,6 +133,7 @@ module window {
 
         unsigned long wheelEventHandlerCount(in Document document) raises (DOMException);
         unsigned long touchEventHandlerCount(in Document document) raises (DOMException);
+        boolean hasTouchEventListener(in Document document) raises (DOMException);
 
         NodeList nodesFromRect(in Document document, in long x, in long y,
             in unsigned long topPadding, in unsigned long rightPadding, in unsigned long bottomPadding, in unsigned long leftPadding,
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index b5686707f..487a17d72 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -19,8 +19,6 @@
 #include "config.h"
 #include "WebPage.h"
 
-#include "AboutData.h"
-#include "AboutTemplate.html.cpp"
 #include "ApplicationCacheStorage.h"
 #include "AutofillManager.h"
 #include "BackForwardController.h"
@@ -157,8 +155,6 @@
 #include <BlackBerryPlatformMouseEvent.h>
 #include <BlackBerryPlatformScreen.h>
 #include <BlackBerryPlatformSettings.h>
-#include <BlackBerryPlatformWebKitCredits.h>
-#include <BuildInformation.h>
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSContextRef.h>
 #include <JavaScriptCore/JSStringRef.h>
@@ -619,84 +615,6 @@ private:
     }
 };
 
-bool WebPagePrivate::loadAbout(const char* aboutURL)
-{
-    if (strncasecmp(aboutURL, "about:", 6))
-        return false;
-
-    // First 6 chars are "about:".
-    String aboutWhat(aboutURL + 6);
-
-    String result;
-
-    if (equalIgnoringCase(aboutWhat, "credits")) {
-        result.append(writeHeader("Credits"));
-        result.append(String("<style> .about {padding:14px;} </style>"));
-        result.append(String(BlackBerry::Platform::WEBKITCREDITS));
-        result.append(String("</body></html>"));
-    } else if (aboutWhat.startsWith("cache?query=", false)) {
-        BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
-        ASSERT(client);
-        std::string key(aboutWhat.substring(12, aboutWhat.length() - 12).utf8().data()); // 12 is length of "cache?query=".
-        result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>"));
-        result.append(String(key.data()));
-        result.append(String("<hr>"));
-        result.append(String(client->generateHtmlFragmentForCacheHeaders(key).data()));
-        result.append(String("</body></html>"));
-    } else if (equalIgnoringCase(aboutWhat, "cache")) {
-        BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
-        ASSERT(client);
-        result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>"));
-        result.append(String(client->generateHtmlFragmentForCacheKeys().data()));
-        result.append(String("</body></html>"));
-#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
-    } else if (equalIgnoringCase(aboutWhat, "cache/disable")) {
-        BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
-        ASSERT(client);
-        client->setDiskCacheEnabled(false);
-        result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>Http disk cache is disabled.</body></html>"));
-    } else if (equalIgnoringCase(aboutWhat, "cache/enable")) {
-        BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
-        ASSERT(client);
-        client->setDiskCacheEnabled(true);
-        result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>Http disk cache is enabled.</body></html>"));
-    } else if (equalIgnoringCase(aboutWhat, "cookie")) {
-        result.append(String("<html><head><title>BlackBerry Browser cookie information</title></head><body>"));
-        result.append(cookieManager().generateHtmlFragmentForCookies());
-        result.append(String("</body></html>"));
-    } else if (equalIgnoringCase(aboutWhat, "version")) {
-        result.append(writeHeader("Version"));
-        result.append(String("<div class='box'><div class='box-title'>Build Time</div><br>"));
-        result.append(String(BlackBerry::Platform::BUILDTIME));
-        result.append(String("</div><br><div style='font-size:10px;text-align:center;'>Also see the <A href='about:build'>build information</A>.</body></html>"));
-    } else if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "config")) {
-        result = configPage();
-    } else if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "build")) {
-        result.append(writeHeader("Build"));
-        result.append(String("<div class='box'><div class='box-title'>Basic</div><table>"));
-        result.append(String("<tr><td>Built On:  </td><td>"));
-        result.append(String(BlackBerry::Platform::BUILDCOMPUTER));
-        result.append(String("</td></tr>"));
-        result.append(String("<tr><td>Build User:  </td><td>"));
-        result.append(String(BlackBerry::Platform::BUILDUSER));
-        result.append(String("</td></tr>"));
-        result.append(String("<tr><td>Build Time:  </td><td>"));
-        result.append(String(BlackBerry::Platform::BUILDTIME));
-        result.append(String("</table></div><br>"));
-        result.append(String(BlackBerry::Platform::BUILDINFO_WEBKIT));
-        result.append(String(BlackBerry::Platform::BUILDINFO_PLATFORM));
-        result.append(String(BlackBerry::Platform::BUILDINFO_LIBWEBVIEW));
-        result.append(String("</body></html>"));
-    } else if (equalIgnoringCase(aboutWhat, "memory")) {
-        result = memoryPage();
-#endif
-    } else
-        return false;
-
-    loadString(result.latin1().data(), aboutURL, "text/html");
-    return true;
-}
-
 void WebPagePrivate::load(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy cachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool isInitial, bool mustHandleInternally, bool forceDownload, const char* overrideContentType, const char* suggestedSaveName)
 {
     stopCurrentLoad();
@@ -747,8 +665,6 @@ void WebPagePrivate::load(const char* url, const char* networkToken, const char*
 
 void WebPage::load(const char* url, const char* networkToken, bool isInitial)
 {
-    if (d->loadAbout(url))
-        return;
     d->load(url, networkToken, "GET", Platform::NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, isInitial, false);
 }
 
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index b4ca9175b..4ca76d39c 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -97,7 +97,6 @@ public:
     bool handleMouseEvent(WebCore::PlatformMouseEvent&);
     bool handleWheelEvent(WebCore::PlatformWheelEvent&);
 
-    bool loadAbout(const char* aboutURL);
     void load(const char* url, const char* networkToken, const char* method, Platform::NetworkRequest::CachePolicy, const char* data, size_t dataLength, const char* const* headers, size_t headersLength, bool isInitial, bool mustHandleInternally = false, bool forceDownload = false, const char* overrideContentType = "", const char* suggestedSaveName = "");
     void loadString(const char* string, const char* baseURL, const char* mimeType, const char* failingURL = 0);
     bool executeJavaScript(const char* script, JavaScriptDataType& returnType, WebString& returnValue);
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 6d340d8e2..c3ec07f2f 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,45 @@
+2012-07-23  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Move about: URL handling out of WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=91541
+
+        Reviewed by Rob Buis.
+
+        PR# 181304.
+        Move about: URL handling to the right place (FrameLoaderClientBlackBerry::createDocumentLoader), so
+        reload and history navigation can work.
+        Other changes: Remove about:version which makes little sense. Make about:memory partially visible.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::load): Remove the call to loadAbout()
+        * Api/WebPage_p.h: Remove loadAbout()
+        (WebPagePrivate):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::createDocumentLoader): Construct about: data here.
+        * WebKitSupport/AboutData.cpp:
+        (BlackBerry::WebKit::numberToHTMLTr): Make it static
+        (BlackBerry::WebKit::configPage): Make it static
+        (BlackBerry::WebKit::memoryPage): Make it static
+        (BlackBerry::WebKit::cachePage):
+        (BlackBerry::WebKit::buildPage):
+        (BlackBerry::WebKit::creditsPage):
+        (BlackBerry::WebKit::cookiePage):
+        (BlackBerry::WebKit::aboutData): The only export function that returns HTML source for a given about: URL.
+        (WebKit):
+        * WebKitSupport/AboutData.h:
+        (WebKit):
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Removed numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+
 2012-07-22  Kent Tamura  <tkent@chromium.org>
 
         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
index 692d08052..d4d02f8bd 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
@@ -90,7 +90,6 @@ public:
     virtual void dispatchViewportPropertiesDidChange(const ViewportArguments&) const;
     virtual bool shouldRubberBandInDirection(ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
     virtual void print(Frame*);
     virtual void exceededDatabaseQuota(Frame*, const String&);
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index 982b13c3e..4902f60f7 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -19,6 +19,7 @@
 #include "config.h"
 #include "FrameLoaderClientBlackBerry.h"
 
+#include "AboutData.h"
 #include "AutofillManager.h"
 #include "BackForwardController.h"
 #include "BackForwardListImpl.h"
@@ -386,9 +387,21 @@ PassRefPtr<DocumentLoader> FrameLoaderClientBlackBerry::createDocumentLoader(con
             newRequest.setToken(originalRequest.token());
     }
 
+    SubstituteData substituteDataLocal = substituteData;
+    if (isMainFrame() && request.url().protocolIs("about")) {
+        // The first 6 letters is "about:"
+        String aboutWhat = request.url().string().substring(6);
+        String source = aboutData(aboutWhat);
+        if (!source.isEmpty()) {
+            // Always ignore existing substitute data if any.
+            WTF::RefPtr<SharedBuffer> buffer = SharedBuffer::create(source.is8Bit() ? reinterpret_cast<const char*>(source.characters8()) : source.latin1().data(), source.length());
+            substituteDataLocal = SubstituteData(buffer, "text/html", "latin1", KURL());
+        }
+    }
+
     // FIXME: This should probably be shared.
-    RefPtr<DocumentLoader> loader = DocumentLoader::create(newRequest, substituteData);
-    if (substituteData.isValid())
+    RefPtr<DocumentLoader> loader = DocumentLoader::create(newRequest, substituteDataLocal);
+    if (substituteDataLocal.isValid())
         loader->setDeferMainResourceDataLoad(false);
     return loader.release();
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
index 745157513..5f565c94b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
@@ -21,13 +21,19 @@
 
 #include "AboutTemplate.html.cpp"
 #include "CString.h"
+#include "CookieManager.h"
 #include "JSDOMWindow.h"
 #include "MemoryCache.h"
 #include "MemoryStatistics.h"
 #include "SurfacePool.h"
 #include "WebKitVersion.h"
 
+#include <BlackBerryPlatformClient.h>
+#include <BlackBerryPlatformLog.h>
+#include <BlackBerryPlatformMemory.h>
 #include <BlackBerryPlatformSettings.h>
+#include <BlackBerryPlatformWebKitCredits.h>
+#include <BuildInformation.h>
 #include <heap/Heap.h>
 #include <process.h>
 #include <runtime/JSGlobalData.h>
@@ -50,7 +56,7 @@ static String writeFeatures(const Vector<String>& trueList, const Vector<String>
     return ret;
 }
 
-template<class T> String numberToHTMLTr(const String& description, T number)
+template<class T> static String numberToHTMLTr(const String& description, T number)
 {
     return String("<tr><td>") + description + "</td><td>" + String::number(number) + "</td></tr>";
 }
@@ -60,7 +66,7 @@ template<> String numberToHTMLTr<bool>(const String& description, bool truth)
     return String("<tr><td>") + description + "</td><td>" + (truth?"true":"false") + "</td></tr>";
 }
 
-String configPage()
+static String configPage()
 {
     String page;
 #if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
@@ -202,7 +208,7 @@ static void dumpJSCTypeCountSetToTableHTML(String& tableHTML, JSC::TypeCountSet*
         tableHTML += numberToHTMLTr(iter->first, iter->second);
 }
 
-String memoryPage()
+static String memoryPage()
 {
     String page;
 
@@ -255,6 +261,8 @@ String memoryPage()
     if (!stat(String::format("/proc/%u/as", getpid()).latin1().data(), &processInfo))
         page += numberToHTMLTr("Total mapped memory", processInfo.st_size);
 
+    page += numberToHTMLTr("System free memory", BlackBerry::Platform::systemFreeMemory());
+
     page += "</table></div><br>";
 
     page += "<div class='box'><div class='box-title'>JS engine memory usage</div><table class='fixed-table'><col width=75%><col width=25%>";
@@ -299,5 +307,112 @@ String memoryPage()
     return page;
 }
 
+static String cachePage(String cacheCommand)
+{
+    String result;
+
+    result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>"));
+
+    BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
+    ASSERT(client);
+
+    if (cacheCommand.isEmpty())
+        result.append(String(client->generateHtmlFragmentForCacheKeys().data()));
+    else if (cacheCommand.startsWith("?query=", false)) {
+        std::string key(cacheCommand.substring(7).utf8().data()); // 7 is length of "query=".
+        result.append(String(key.data()));
+        result.append(String("<hr>"));
+        result.append(String(client->generateHtmlFragmentForCacheHeaders(key).data()));
+    }
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
+    else if (equalIgnoringCase(cacheCommand, "/disable")) {
+        client->setDiskCacheEnabled(false);
+        result.append("Http disk cache is disabled.");
+    } else if (equalIgnoringCase(cacheCommand, "/enable")) {
+        client->setDiskCacheEnabled(true);
+        result.append("Http disk cache is enabled.");
+    }
+#endif
+    else {
+        // Unknown cache command.
+        return String();
+    }
+
+    result.append(String("</body></html>"));
+
+    return result;
+}
+
+static String buildPage()
+{
+    String result;
+
+    result.append(writeHeader("Build"));
+    result.append(String("<div class='box'><div class='box-title'>Basic</div><table>"));
+    result.append(String("<tr><td>Built On:  </td><td>"));
+    result.append(String(BlackBerry::Platform::BUILDCOMPUTER));
+    result.append(String("</td></tr>"));
+    result.append(String("<tr><td>Build User:  </td><td>"));
+    result.append(String(BlackBerry::Platform::BUILDUSER));
+    result.append(String("</td></tr>"));
+    result.append(String("<tr><td>Build Time:  </td><td>"));
+    result.append(String(BlackBerry::Platform::BUILDTIME));
+    result.append(String("</table></div><br>"));
+    result.append(String(BlackBerry::Platform::BUILDINFO_WEBKIT));
+    result.append(String(BlackBerry::Platform::BUILDINFO_PLATFORM));
+    result.append(String(BlackBerry::Platform::BUILDINFO_LIBWEBVIEW));
+    result.append(String("</body></html>"));
+
+    return result;
+}
+
+static String creditsPage()
+{
+    String result;
+
+    result.append(writeHeader("Credits"));
+    result.append(String("<style> .about {padding:14px;} </style>"));
+    result.append(String(BlackBerry::Platform::WEBKITCREDITS));
+    result.append(String("</body></html>"));
+
+    return result;
+}
+
+static String cookiePage()
+{
+    String result;
+
+    result.append(String("<html><head><title>BlackBerry Browser cookie information</title></head><body>"));
+    result.append(cookieManager().generateHtmlFragmentForCookies());
+    result.append(String("</body></html>"));
+
+    return result;
+}
+
+String aboutData(String aboutWhat)
+{
+    if (equalIgnoringCase(aboutWhat, "credits"))
+        return creditsPage();
+
+    if (aboutWhat.startsWith("cache"))
+        return cachePage(aboutWhat.substring(5));
+
+    if (equalIgnoringCase(aboutWhat, "memory"))
+        return memoryPage();
+
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
+    if (equalIgnoringCase(aboutWhat, "cookie"))
+        return cookiePage();
+
+    if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "build"))
+        return buildPage();
+
+    if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "config"))
+        return configPage();
+#endif
+
+    return String();
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/WebKitSupport/AboutData.h b/Source/WebKit/blackberry/WebKitSupport/AboutData.h
index 805054fd5..0e11a60c8 100644
--- a/Source/WebKit/blackberry/WebKitSupport/AboutData.h
+++ b/Source/WebKit/blackberry/WebKitSupport/AboutData.h
@@ -24,8 +24,7 @@
 namespace BlackBerry {
 namespace WebKit {
 
-String configPage();
-String memoryPage();
+String aboutData(String aboutWhat);
 
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index a94bbd7b7..ca446fe90 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,233 @@
+2012-07-24  Jochen Eisinger  <jochen@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123463.
+        http://trac.webkit.org/changeset/123463
+        https://bugs.webkit.org/show_bug.cgi?id=92110
+
+        Broke Android build (Requested by keishi on #webkit).
+
+        * src/WebPagePopupImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleMouseDown):
+
+2012-07-24  Keishi Hattori  <keishi@webkit.org>
+
+        [Chromium] Page popup should close on mouse down
+        https://bugs.webkit.org/show_bug.cgi?id=92092
+
+        Reviewed by Kent Tamura.
+
+        Page popup should close on mouse down because some elements(e.g. <input type=color>) don't have a blur event that
+        we can hook to hide the page popup when the user clicks on the page.
+
+        * src/WebPagePopupImpl.h:
+        (WebKit::WebPagePopupImpl::hasSamePopupClient): Returns true if the given WebPagePopupImpl have the same popup client.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleMouseDown): Close all popups when the page is clicked. Checks if the
+        mouse down event opened the same popup we just closed.
+
+2012-07-24  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Enable initiator column in network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=65533
+
+        Reviewed by Vsevolod Vlasov.
+
+        With 40118 fixed for webkit, Preferences.displayInitiator should be set to true.
+        Removed references to it since the optionality is no longer required.
+
+        Test: http/tests/inspector/network/network-initiator.html
+
+        * src/js/DevTools.js:
+
+2012-07-24  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-23  Mark Pilgrim  <pilgrim@chromium.org>
+
+        [Chromium] Move layoutTestMode to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=92010
+
+        Reviewed by Adam Barth.
+
+        Part of a refactoring series. See tracking bug 82948.
+
+        * src/PlatformSupport.cpp:
+        (WebCore):
+        * src/WebKit.cpp:
+        (WebKit::setLayoutTestMode):
+        (WebKit::layoutTestMode):
+
+2012-07-23  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Add droppedFrameCount to renderingStats.
+        https://bugs.webkit.org/show_bug.cgi?id=91694
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::renderingStats):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestScrollMultipleRedraw::drawLayersOnCCThread):
+
+2012-07-23  Brian Anderson  <brianderson@chromium.org>
+
+        [chromium] Use shallow flushes that don't glFlush
+        https://bugs.webkit.org/show_bug.cgi?id=90325
+
+        Reviewed by Kenneth Russell.
+
+        Changed CCTextureUpdaterTest to recognize shallowFlushCHROMIUM().
+
+        * tests/CCTextureUpdaterTest.cpp:
+
+2012-07-23  Adrienne Walker  <enne@google.com>
+
+        [chromium] Add more compositor unit tests for high DPI transforms
+        https://bugs.webkit.org/show_bug.cgi?id=91917
+
+        Reviewed by Kenneth Russell.
+
+        The current set of high DPI tests only deal with layers in a render
+        surface. Add some extra tests for non-surface layers. Also add a test
+        to make sure that an owning layer in a surface doesn't differ from a
+        non-owning layer in high DPI circumstances.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-07-23  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Fix unit tests in debug mode after r123375
+        https://bugs.webkit.org/show_bug.cgi?id=92030
+
+        Reviewed by Adrienne Walker.
+
+        Fixed two unit tests that were causing debug assertions because
+        they gave calcDrawTransforms an empty sized root layer.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION.
+
+        * features.gypi:
+
+2012-07-23  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Refactor CCLayerTreeHostCommon: clean up clipRect and drawableContentRect design
+        https://bugs.webkit.org/show_bug.cgi?id=80622
+
+        Reviewed by Adrienne Walker.
+
+        Many tests needed to be updated because the semantics of the layer tree have changed:
+          - a few tests that were no longer applicable were removed.
+          - many tests needed to have fixed initialization, properly
+            setting surface contentRect and rootLayer bounds.
+          - because clipRect and usesLayerClipping no longer exists, those places in code had to be removed/changed
+          - the scissorRect tests needed to have updated expectations
+            because after this patch, the rootLayer Surface now clips
+            to its contentBounds.
+          - the clipRect tests were changed to test the layer's new semantics for the drawableContentRect instead.
+
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerIteratorTest.cpp:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity1OnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity0OnMainThread::runMyTest):
+        * tests/LayerChromiumTest.cpp:
+
+2012-07-23  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] Fix build on Ubuntu Precise.
+        https://bugs.webkit.org/show_bug.cgi?id=92021
+
+        Reviewed by Adrienne Walker.
+
+        Remove an array that's written but never read.
+
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::TEST_F):
+
+2012-07-23  Nate Chapin  <japhet@chromium.org>
+
+        Add WebTextInputType enum values for text areas and
+        content-editable.
+        https://bugs.webkit.org/show_bug.cgi?id=91654
+
+        Reviewed by Adam Barth.
+
+        No new tests, no behavior change without corresponding chromium.org changes.
+
+        * public/WebTextInputType.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::textInputType):
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename the functions to follow a more boolean logic.
+
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::hasTouchEventHandlers):
+        * src/ChromeClientImpl.cpp:
+        (WebKit):
+        (WebKit::ChromeClientImpl::needTouchEvents):
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::hasTouchEventHandlers):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        * features.gypi:
+
+2012-07-23  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Buildfix for fixing gclient on the Chromium Windows bot
+        https://bugs.webkit.org/show_bug.cgi?id=91977
+
+        Unreviewed build fix.
+
+        Add the tools/isolate directory to the Windows checkout as these files
+        currently are missing during gyp generation. maruel introduced the need
+        for these in this isolate refactoring, specifically this Chromium CL:
+        http://src.chromium.org/viewvc/chrome?view=rev&revision=147689
+
+        * DEPS:
+
 2012-07-22  Kent Tamura  <tkent@chromium.org>
 
         [Chromium-Mac] Fix a build error.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 90b7caed8..2e48b10e1 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '147759'
+  'chromium_rev': '148093'
 }
 
 deps = {
@@ -155,6 +155,8 @@ deps_os = {
       From('chromium_deps', 'src/third_party/nss'),
     'third_party/perl':
       From('chromium_deps', 'src/third_party/perl'),
+    'tools/isolate':
+      Var('chromium_svn')+'/tools/isolate@'+Var('chromium_rev'),
     # Dependencies used by libjpeg-turbo
     'third_party/yasm/binaries':
       From('chromium_deps', 'src/third_party/yasm/binaries'),
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 8df09639c..3432342a9 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -47,6 +47,7 @@
       'ENABLE_CSS_REGIONS=1',
       'ENABLE_CSS_SHADERS=1',
       'ENABLE_CSS_VARIABLES=1',
+      'ENABLE_CSS_STICKY_POSITION=1',
       'ENABLE_CUSTOM_SCHEME_HANDLER=0',
       'ENABLE_DATALIST_ELEMENT=1',
       'ENABLE_DASHBOARD_SUPPORT=0',
diff --git a/Source/WebKit/chromium/public/WebTextInputType.h b/Source/WebKit/chromium/public/WebTextInputType.h
index b7212758e..c7df9e55e 100644
--- a/Source/WebKit/chromium/public/WebTextInputType.h
+++ b/Source/WebKit/chromium/public/WebTextInputType.h
@@ -54,6 +54,10 @@ enum WebTextInputType {
     WebTextInputTypeMonth,
     WebTextInputTypeTime,
     WebTextInputTypeWeek,
+    WebTextInputTypeTextArea,
+
+    // Input caret is in a contenteditable node (not an INPUT field).
+    WebTextInputTypeContentEditable,
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 662409f7a..65964a128 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -273,7 +273,7 @@ public:
     virtual void focusedNodeChanged(const WebNode&) { }
 
     virtual void numberOfWheelEventHandlersChanged(unsigned) { }
-    virtual void numberOfTouchEventHandlersChanged(unsigned) { }
+    virtual void hasTouchEventHandlers(bool) { }
 
     // Indicates two things:
     //   1) This view may have a new layout now.
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index ed5d73e50..f7cb94bbc 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -1090,10 +1090,12 @@ void ChromeClientImpl::numWheelEventHandlersChanged(unsigned numberOfWheelHandle
     m_webView->numberOfWheelEventHandlersChanged(numberOfWheelHandlers);
 }
 
-void ChromeClientImpl::numTouchEventHandlersChanged(unsigned numberOfTouchHandlers)
+#if ENABLE(TOUCH_EVENTS)
+void ChromeClientImpl::needTouchEvents(bool needsTouchEvents)
 {
-    m_webView->numberOfTouchEventHandlersChanged(numberOfTouchHandlers);
+    m_webView->hasTouchEventHandlers(needsTouchEvents);
 }
+#endif // ENABLE(TOUCH_EVENTS)
 
 #if ENABLE(POINTER_LOCK)
 bool ChromeClientImpl::requestPointerLock()
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 9aa8dff32..30315d394 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -148,8 +148,7 @@ public:
     virtual void setCursorHiddenUntilMouseMoves(bool);
     virtual void formStateDidChange(const WebCore::Node*);
 #if ENABLE(TOUCH_EVENTS)
-    // FIXME: All touch events are forwarded regardless of whether or not they are needed.
-    virtual void needTouchEvents(bool needTouchEvents) { }
+    virtual void needTouchEvents(bool needTouchEvents) OVERRIDE;
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -207,7 +206,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const;
     virtual void numWheelEventHandlersChanged(unsigned);
-    virtual void numTouchEventHandlersChanged(unsigned);
 
 #if ENABLE(POINTER_LOCK)
     virtual bool requestPointerLock();
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index 0afb807e0..aca97d0a3 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -302,13 +302,6 @@ PassRefPtr<SerializedScriptValue> PlatformSupport::injectIDBKeyIntoSerializedVal
     return webKitPlatformSupport()->injectIDBKeyIntoSerializedValue(key, value, keyPath);
 }
 
-// LayoutTestMode -------------------------------------------------------------
-
-bool PlatformSupport::layoutTestMode()
-{
-    return WebKit::layoutTestMode();
-}
-
 // Plugin ---------------------------------------------------------------------
 
 bool PlatformSupport::plugins(bool refresh, Vector<PluginInfo>* results)
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index e41ce228d..a3f0f8391 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "WebKit.h"
 
+#include "LayoutTestSupport.h"
 #include "Logging.h"
 #include "MutationObserver.h"
 #include "Page.h"
@@ -81,7 +82,6 @@ static WebThread::TaskObserver* s_endOfTaskRunner = 0;
 static bool s_webKitInitialized = false;
 
 static WebKitPlatformSupport* s_webKitPlatformSupport = 0;
-static bool s_layoutTestMode = false;
 
 static bool generateEntropy(unsigned char* buffer, size_t length)
 {
@@ -176,12 +176,12 @@ WebKitPlatformSupport* webKitPlatformSupport()
 
 void setLayoutTestMode(bool value)
 {
-    s_layoutTestMode = value;
+    WebCore::setIsRunningLayoutTest(value);
 }
 
 bool layoutTestMode()
 {
-    return s_layoutTestMode;
+    return WebCore::isRunningLayoutTest();
 }
 
 void enableLogChannel(const char* name)
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index 207a8350d..34eb952fd 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -182,6 +182,7 @@ void WebLayerTreeView::renderingStats(WebRenderingStats& stats) const
 
     stats.numAnimationFrames = ccStats.numAnimationFrames;
     stats.numFramesSentToScreen = ccStats.numFramesSentToScreen;
+    stats.droppedFrameCount = ccStats.droppedFrameCount;
 }
 
 void WebLayerTreeView::loseCompositorContext(int numTimes)
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 0d5f25a51..6a253f8e3 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -1108,10 +1108,10 @@ void WebViewImpl::numberOfWheelEventHandlersChanged(unsigned numberOfWheelHandle
         m_client->numberOfWheelEventHandlersChanged(numberOfWheelHandlers);
 }
 
-void WebViewImpl::numberOfTouchEventHandlersChanged(unsigned numberOfTouchHandlers)
+void WebViewImpl::hasTouchEventHandlers(bool hasTouchHandlers)
 {
     if (m_client)
-        m_client->numberOfTouchEventHandlersChanged(numberOfTouchHandlers);
+        m_client->hasTouchEventHandlers(hasTouchHandlers);
 }
 
 #if !OS(DARWIN)
@@ -2100,11 +2100,11 @@ WebTextInputType WebViewImpl::textInputType()
         if (textarea->readOnly() || textarea->disabled())
             return WebTextInputTypeNone;
 
-        return WebTextInputTypeText;
+        return WebTextInputTypeTextArea;
     }
 
     if (node->shouldUseInputMethod())
-        return WebTextInputTypeText;
+        return WebTextInputTypeContentEditable;
 
     return WebTextInputTypeNone;
 }
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index c2f36bf45..1155969fd 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -383,7 +383,7 @@ public:
     void startPageScaleAnimation(const WebCore::IntPoint& targetPosition, bool useAnchor, float newScale, double durationInSeconds);
 
     void numberOfWheelEventHandlersChanged(unsigned);
-    void numberOfTouchEventHandlersChanged(unsigned);
+    void hasTouchEventHandlers(bool);
 
     // PlatformGestureCurveTarget implementation for wheel fling.
     virtual void scrollBy(const WebCore::IntPoint&);
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index ffea8af86..12293f5b1 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -42,7 +42,6 @@
     Preferences.exposeWorkersInspection = true;
     Preferences.showDockToRight = true;
     Preferences.exposeFileSystemInspection = true;
-    Preferences.displayInitiator = true;
 })();}
 
 function buildPlatformExtensionAPI(extensionInfo)
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 22cf897cb..47edeec9d 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -167,8 +167,6 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
 
     // These properties are internal, and should not be considered "change" when they are used.
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setIsNonCompositedContent(true));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setClipRect(arbitraryIntRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUsesLayerClipping(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawOpacity(arbitraryNumber));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setRenderTarget(0));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawTransform(arbitraryTransform));
diff --git a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
index 86a374325..76dc425aa 100644
--- a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
@@ -58,7 +58,8 @@ private:
         , m_drawsContent(true)
     {
         setBounds(IntSize(100, 100));
-        setDrawableContentRect(IntRect(0, 0, 100, 100));
+        setPosition(IntPoint::zero());
+        setAnchorPoint(IntPoint::zero());
     }
 
     bool m_drawsContent;
@@ -239,6 +240,7 @@ TEST(CCLayerIteratorTest, complexTreeMultiSurface)
     RefPtr<TestLayerChromium> root231 = TestLayerChromium::create();
 
     rootLayer->createRenderSurface();
+    rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(), rootLayer->bounds()));
 
     rootLayer->addChild(root1);
     rootLayer->addChild(root2);
@@ -256,6 +258,7 @@ TEST(CCLayerIteratorTest, complexTreeMultiSurface)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > layerList;
     renderSurfaceLayerList.append(rootLayer.get());
+    
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer.get(),
                                                    WebTransformationMatrix(), WebTransformationMatrix(),
                                                    renderSurfaceLayerList, layerList,
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index 26ae6ca47..86af40a02 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -77,6 +77,11 @@ void executeCalculateDrawTransformsAndVisibility(LayerChromium* rootLayer)
     Vector<RefPtr<LayerChromium> > dummyRenderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
+
+    ASSERT(rootLayer->renderSurface());
+    ASSERT(!rootLayer->bounds().isEmpty());
+    rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(), rootLayer->bounds()));
+    
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, rootLayer, identityMatrix, identityMatrix, dummyRenderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
     CCLayerTreeHostCommon::calculateVisibleAndScissorRects(dummyRenderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
 }
@@ -125,6 +130,7 @@ PassOwnPtr<CCLayerImpl> createTreeForFixedPositionTests()
     child->addChild(grandChild.release());
     root->addChild(child.release());
     root->createRenderSurface();
+    root->renderSurface()->setContentRect(IntRect(IntPoint::zero(), root->bounds()));
 
     return root.release();
 }
@@ -154,14 +160,12 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForNoOpLayer)
     child->addChild(grandChild);
 
     WebTransformationMatrix identityMatrix;
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(0, 0), false);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
     setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(0, 0), false);
     setLayerPropertiesForTesting(grandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(0, 0), false);
 
     executeCalculateDrawTransformsAndVisibility(parent.get());
 
-    EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, parent->drawTransform());
-    EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, parent->screenSpaceTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, child->drawTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, child->screenSpaceTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, grandChild->drawTransform());
@@ -177,9 +181,11 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleLayer)
     // Case 1: setting the sublayer transform should not affect this layer's draw transform or screen-space transform.
     WebTransformationMatrix arbitraryTranslation;
     arbitraryTranslation.translate(10, 20);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, arbitraryTranslation, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(0, 0), false);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, arbitraryTranslation, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), false);
     executeCalculateDrawTransformsAndVisibility(layer.get());
-    EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, layer->drawTransform());
+    WebTransformationMatrix expectedDrawTransform = identityMatrix;
+    expectedDrawTransform.translate(50, 50);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedDrawTransform, layer->drawTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, layer->screenSpaceTransform());
 
     // Case 2: setting the bounds of the layer should result in a draw transform that translates to half the width and height.
@@ -200,7 +206,7 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleLayer)
     // Case 4: A change in actual position affects both the draw transform and screen space transform.
     WebTransformationMatrix positionTransform;
     positionTransform.translate(0, 1.2);
-    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 1.2f), IntSize(10, 12), false);
+    setLayerPropertiesForTesting(layer.get(), identityMatrix, identityMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 1.2), IntSize(10, 12), false);
     executeCalculateDrawTransformsAndVisibility(layer.get());
     EXPECT_TRANSFORMATION_MATRIX_EQ(positionTransform * translationToCenter, layer->drawTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(positionTransform, layer->screenSpaceTransform());
@@ -227,7 +233,7 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleLayer)
     //         The current implementation of calculateDrawTransforms does this implicitly, but it is
     //         still worth testing to detect accidental regressions.
     expectedResult = positionTransform * translationToAnchor * layerTransform * translationToAnchor.inverse();
-    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0.5, 0), FloatPoint(0, 1.2f), IntSize(10, 12), false);
+    setLayerPropertiesForTesting(layer.get(), layerTransform, identityMatrix, FloatPoint(0.5, 0), FloatPoint(0, 1.2), IntSize(10, 12), false);
     executeCalculateDrawTransformsAndVisibility(layer.get());
     EXPECT_TRANSFORMATION_MATRIX_EQ(expectedResult * translationToCenter, layer->drawTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(expectedResult, layer->screenSpaceTransform());
@@ -259,7 +265,7 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSimpleHierarchy)
     // Case 2: parent's position affects child and grandChild.
     WebTransformationMatrix parentPositionTransform;
     parentPositionTransform.translate(0, 1.2);
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 1.2f), IntSize(10, 12), false);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 1.2), IntSize(10, 12), false);
     setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(16, 18), false);
     setLayerPropertiesForTesting(grandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(76, 78), false);
     executeCalculateDrawTransformsAndVisibility(parent.get());
@@ -330,24 +336,27 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleRenderSurface)
 
     WebTransformationMatrix identityMatrix;
     WebTransformationMatrix parentLayerTransform;
-    parentLayerTransform.scale3d(2, 2, 1);
+    parentLayerTransform.scale3d(1, 0.9, 1);
     WebTransformationMatrix parentTranslationToAnchor;
-    parentTranslationToAnchor.translate(2.5, 3);
+    parentTranslationToAnchor.translate(25, 30);
     WebTransformationMatrix parentSublayerMatrix;
-    parentSublayerMatrix.scale3d(10, 10, 3.3);
+    parentSublayerMatrix.scale3d(0.9, 1, 3.3);
     WebTransformationMatrix parentTranslationToCenter;
-    parentTranslationToCenter.translate(5, 6);
+    parentTranslationToCenter.translate(50, 60);
     WebTransformationMatrix parentCompositeTransform = parentTranslationToAnchor * parentLayerTransform * parentTranslationToAnchor.inverse()
             * parentTranslationToCenter * parentSublayerMatrix * parentTranslationToCenter.inverse();
+
     WebTransformationMatrix childTranslationToCenter;
     childTranslationToCenter.translate(8, 9);
+    WebTransformationMatrix grandChildTranslationToCenter;
+    grandChildTranslationToCenter.translate(4, 5);
 
     // Child's render surface should not exist yet.
     ASSERT_FALSE(child->renderSurface());
 
-    setLayerPropertiesForTesting(parent.get(), parentLayerTransform, parentSublayerMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 0), IntSize(10, 12), false);
+    setLayerPropertiesForTesting(parent.get(), parentLayerTransform, parentSublayerMatrix, FloatPoint(0.25, 0.25), FloatPoint(0, 0), IntSize(100, 120), false);
     setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(16, 18), false);
-    setLayerPropertiesForTesting(grandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(-0.5, -0.5), IntSize(1, 1), false);
+    setLayerPropertiesForTesting(grandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(8, 10), false);
     executeCalculateDrawTransformsAndVisibility(parent.get());
 
     // Render surface should have been created now.
@@ -359,193 +368,16 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleRenderSurface)
     EXPECT_TRANSFORMATION_MATRIX_EQ(childTranslationToCenter, child->drawTransform());
     EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->screenSpaceTransform());
 
-    // Without clipping, the origin transform and draw transform (in this particular case) should be the same.
     EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->renderTarget()->renderSurface()->originTransform());
-    EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->renderTarget()->renderSurface()->drawTransform());
+
+    // Because the grandChild is the only drawable content, the child's renderSurface will tighten its bounds to the grandChild.
+    // Therefore, the draw transform will have a translation of half-width, half-height of the grandChild's bounds.
+    EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform * grandChildTranslationToCenter, child->renderTarget()->renderSurface()->drawTransform());
 
     // The screen space is the same as the target since the child surface draws into the root.
     EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->renderTarget()->renderSurface()->screenSpaceTransform());
 }
 
-TEST(CCLayerTreeHostCommonTest, scissorRectNoClip)
-{
-    DebugScopedSetImplThread thisScopeIsOnImplThread;
-
-    /*
-      Layers are created as follows:
-
-         +--------------------+
-         |                  1 |
-         |  +-----------+     |
-         |  |         2 |     |
-         |  | +-------------------+
-         |  | |   3               |
-         |  | +-------------------+
-         |  |           |     |
-         |  +-----------+     |
-         |                    |
-         |                    |
-         +--------------------+
-
-         Layers 1, 2 have render surfaces
-     */
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-
-    IntRect rootRect(0, 0, 100, 100);
-    IntRect childRect(10, 10, 50, 50);
-    IntRect grandChildRect(5, 5, 150, 150);
-
-    root->createRenderSurface();
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
-    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
-    root->setDrawsContent(true);
-    root->renderSurface()->setContentRect(IntRect(IntPoint(), IntSize(rootRect.width(), rootRect.height())));
-
-    child->setAnchorPoint(FloatPoint(0, 0));
-    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
-    child->setOpacity(0.5);
-    child->setBounds(IntSize(childRect.width(), childRect.height()));
-    child->setDrawsContent(true);
-
-    grandChild->setAnchorPoint(FloatPoint(0, 0));
-    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild->setDrawsContent(true);
-
-    CCLayerImpl* childPtr = child.get();
-    CCLayerImpl* grandChildPtr = grandChild.get();
-
-    child->addChild(grandChild.release());
-    root->addChild(child.release());
-
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
-    {
-        WebTransformationMatrix identityMatrix;
-        Vector<CCLayerImpl*> layerList;
-        int dummyMaxTextureSize = 512;
-        CCLayerSorter layerSorter;
-
-        renderSurfaceLayerList.append(root.get());
-
-        CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, layerList, &layerSorter, dummyMaxTextureSize);
-
-        FloatRect dummyDamageRect;
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, dummyDamageRect);
-    }
-    
-    ASSERT_TRUE(childPtr->renderSurface());
-    ASSERT_TRUE(root->renderSurface());
-    ASSERT_FALSE(grandChildPtr->renderSurface());
-    
-    EXPECT_EQ(renderSurfaceLayerList.size(), 2U);
-    
-    ASSERT_EQ(root->clipRect(), IntRect(0, 0, 0, 0));
-
-    // Layer's clipRect is a union of all its children's bounds
-    ASSERT_EQ(childPtr->clipRect(), IntRect(0, 0, grandChildRect.x() + grandChildRect.width(), grandChildRect.y() + grandChildRect.height()));
-    ASSERT_EQ(grandChildPtr->clipRect(), IntRect(0, 0, 0, 0));
-
-    ASSERT_EQ(root->renderSurface()->clipRect(), IntRect(0, 0, 0, 0));
-    ASSERT_EQ(childPtr->renderSurface()->clipRect(), IntRect(0, 0, 0, 0));
-    
-    ASSERT_FALSE(root->usesLayerClipping());
-    ASSERT_FALSE(childPtr->usesLayerClipping());
-    ASSERT_FALSE(grandChildPtr->usesLayerClipping());
-    
-    // Damage the entire screen
-    IntRect rootDamage(rootRect);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // child surface doesn't have a clip rect, therefore it will be computed as intersection
-    // between root surface's contentrect and child surface's drawable content rect.
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(childRect.x(), childRect.y(), rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
-
-    EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
-
-    // The damage is the entire rootRect, but child layer starts at an offset.
-    // Even though it has bounds, it is not clipping to bounds so its children
-    // (which extend beyond the bounds) extend the scissor rect
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
-
-    // Grand child will have the same scissor rect as it doesn't have a surface
-    // of its own
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
-    
-    // Empty damage
-    rootDamage = IntRect(0, 0, 0, 0);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Empty damage == empty scissor
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    // Partial damage within child
-    rootDamage = IntRect(10, 10, 20, 20);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child does not have its own surface, so its scissor rect is identical to child's
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Partial damage beyond child
-    rootDamage = IntRect(10, 10, 80, 80);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child does not have its own surface, so its scissor rect is identical to child's
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Partial damage beyond root
-    rootDamage = IntRect(10, 10, 110, 110);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Root surface does not have a clipRect, so its contentRect will be used to intersect with damage.
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    
-    // Root does not use layer clipping, so its content rect will be used to intersect with damage
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-
-    // Children's content rects are bigger than the root's so they don't clip the damage rect, but change its offset.
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-}
-
 TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
 {
     DebugScopedSetImplThread thisScopeIsOnImplThread;
@@ -623,39 +455,27 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
     
     EXPECT_EQ(renderSurfaceLayerList.size(), 2U);
     
-    // Now root is clipping to its bounds
-    ASSERT_EQ(root->clipRect(), rootRect);
-
-    // Layer's clipRect is a union of all its children's bounds
-    ASSERT_EQ(childPtr->clipRect(), IntRect(0, 0, grandChildRect.x() + grandChildRect.width(), grandChildRect.y() + grandChildRect.height()));
-    ASSERT_EQ(grandChildPtr->clipRect(), IntRect(0, 0, 0, 0));
-
-    ASSERT_EQ(root->renderSurface()->clipRect(), IntRect(0, 0, 0, 0));
-
+    ASSERT_EQ(root->renderSurface()->clipRect(), rootRect);
     // Child surface's clipping rect is now set to root's
     ASSERT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
     
-    ASSERT_TRUE(root->usesLayerClipping());
-    ASSERT_FALSE(childPtr->usesLayerClipping());
-    ASSERT_FALSE(grandChildPtr->usesLayerClipping());
-    
     // Damage the entire screen
     IntRect rootDamage(rootRect);
     CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
     
     EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootRect));
+    // Child's renderSurface would have expanded to include the 150x150 grandChild located at (5, 5), and then have been clipped by the parent.
+    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 155, 155));
+    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
     
     EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
 
-    // The damage is the entire rootRect, but child layer starts at an offset.
-    // Even though it has bounds, it is not clipping to bounds so its children
-    // (which extend beyond the bounds) extend the scissor rect
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
+    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
+    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
+    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
 
-    // Grand child will have the same scissor rect as it doesn't have a surface
-    // of its own
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
+    // Grand child is (indirectly) clipped by the root surface. But the scissor is expressed in the targetSurface (child surface) space.
+    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 85, 85));
     
     // Empty damage
     rootDamage = IntRect(0, 0, 0, 0);
@@ -685,8 +505,8 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
     // Entire damage rect is within the layer, but with different offset
     EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
 
-    // Grand child does not have its own surface, so its scissor rect is identical to child's
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
+    // Grand child scissor is the damage intersected with the clipped grandChild layer rect (expressed in targetSurface space).
+    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 15, 15));
 
     // Partial damage beyond child
     rootDamage = IntRect(10, 10, 80, 80);
@@ -701,11 +521,12 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
     // Entire damage rect is within the layer
     EXPECT_EQ(root->scissorRect(), rootDamage);
 
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
+    // Child layer overlaps a portion of the damage rect.
+    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
 
-    // Grand child does not have its own surface, so its scissor rect is identical to child's
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
+    // Grand child scissor is the intersection of damage and grandChild rect, expressed in child surface.
+    // The damage fits entirely within the grandChild.
+    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 75, 75));
 
     // Partial damage beyond root
     rootDamage = IntRect(10, 10, 110, 110);
@@ -714,17 +535,13 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
     // Scissors are not computed for root
     EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
 
-    // Root surface does not have a clipRect, so its contentRect will be used to intersect with damage.
-    // Result is that root damage rect is clipped at root layer boundary
+    // Root damage rect is clipped at root layer boundary.
     EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    
-    // Root does not use layer clipping, so its content rect will be used to intersect with damage
-    // Result is that root damage rect is clipped at root layer boundary
     EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
 
     // Now the scissor rects are clipped by surfaces contentRect
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
+    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
+    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 105, 105));
 }
 
 TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
@@ -813,38 +630,26 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
     
     EXPECT_EQ(renderSurfaceLayerList.size(), 3U);
     
-    // Now root is clipping to its bounds
-    ASSERT_EQ(root->clipRect(), rootRect);
-
-    ASSERT_EQ(childPtr->clipRect(), IntRect(0, 0, childRect.x() + grandChildRect.width() , childRect.y() + grandChildRect.height()));
-
-    // Grandchild now clips
-    ASSERT_EQ(grandChildPtr->clipRect(), IntRect(0, 0, grandChildRect.x() + grandChildRect.width(), grandChildRect.y() + grandChildRect.height()));
-
-    ASSERT_EQ(root->renderSurface()->clipRect(), IntRect(0, 0, 0, 0));
-
+    EXPECT_INT_RECT_EQ(root->renderSurface()->clipRect(), rootRect);
     // Child surface's clipping rect is now set to root's
-    ASSERT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
-    
-    ASSERT_TRUE(root->usesLayerClipping());
-    ASSERT_FALSE(childPtr->usesLayerClipping());
-    ASSERT_FALSE(grandChildPtr->usesLayerClipping());
+    EXPECT_INT_RECT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
     
     // Damage the entire screen
     IntRect rootDamage(rootRect);
     CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
     
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootRect));
+    ASSERT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
+    // Child's renderSurface would have expanded to include the grandChild1 and grandChild2, and then have been clipped by the parent.
+    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 160, 160));
+    ASSERT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
     
     EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
 
-    // The damage is the entire rootRect, but child layer starts at an offset.
-    // Even though it has bounds, it is not clipping to bounds so its children
-    // (which extend beyond the bounds) extend the scissor rect
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x(), rootRect.height() - childRect.y()));
+    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
+    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
+    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
 
-    // Grand child is now scissored by the render surface
+    // Grand child now draws to its own render surface, so the scissorRect is in that surface's space.
     EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x() - grandChildRect.x(), rootRect.height() - childRect.y() - grandChildRect.y()));
     
     // Empty damage
@@ -891,8 +696,8 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
     // Entire damage rect is within the layer
     EXPECT_EQ(root->scissorRect(), rootDamage);
 
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
+    // Entire damage rect is within the layer, but it is still clipped with respect to the root.
+    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
 
     // Grand child now gets scissored by its target surface as well as root
     EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
@@ -912,8 +717,7 @@ TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
     // Result is that root damage rect is clipped at root layer boundary
     EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
 
-    // Now the scissor rects are clipped by surfaces contentRect
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
+    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
 
     // Grandchild's scissor rect is clipped by its target surface
     EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
@@ -1001,7 +805,7 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForRenderSurfaceHierarchy)
 
     // In combination with descendantDrawsContent, opacity != 1 forces the layer to have a new renderSurface.
     renderSurface1->setOpacity(0.5);
-    renderSurface2->setOpacity(0.33f);
+    renderSurface2->setOpacity(0.33);
 
     // All layers in the tree are initialized with an anchor at .25 and a size of (10,10).
     // matrix "A" is the composite layer transform used in all layers, centered about the anchor point
@@ -1131,14 +935,15 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForClipLayer)
     RefPtr<LayerChromium> parent = LayerChromium::create();
     RefPtr<LayerChromium> renderSurface1 = LayerChromium::create();
     RefPtr<LayerChromiumWithForcedDrawsContent> child = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    renderSurface1->setOpacity(0.9f);
+    renderSurface1->setOpacity(0.9);
 
     const WebTransformationMatrix identityMatrix;
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
     setLayerPropertiesForTesting(renderSurface1.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
     setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint(30, 30), IntSize(10, 10), false);
 
     parent->createRenderSurface();
-    parent->setClipRect(IntRect(0, 0, 10, 10));
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     parent->addChild(renderSurface1);
     renderSurface1->createRenderSurface();
     renderSurface1->addChild(child);
@@ -1196,11 +1001,12 @@ TEST(CCLayerTreeHostCommonTest, verifyForceRenderSurface)
     renderSurface1->setForceRenderSurface(true);
 
     const WebTransformationMatrix identityMatrix;
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
     setLayerPropertiesForTesting(renderSurface1.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
     setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
 
     parent->createRenderSurface();
-    parent->setClipRect(IntRect(0, 0, 10, 10));
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     parent->addChild(renderSurface1);
     renderSurface1->addChild(child);
 
@@ -1589,15 +1395,19 @@ TEST(CCLayerTreeHostCommonTest, verifyScrollCompensationForFixedPositionLayerWit
     child->setIsContainerForFixedPositionLayers(true);
     grandChild->setPosition(FloatPoint(8, 6));
     grandChild->setForceRenderSurface(true);
-    greatGrandChild->setPosition(FloatPoint(140, 120));
+    greatGrandChild->setPosition(FloatPoint(40, 60));
     greatGrandChild->setForceRenderSurface(true);
     fixedPositionChild->setFixedToContainerLayer(true);
     fixedPositionChild->setDrawsContent(true);
 
     // The additional rotations, which are non-commutative with translations, help to
     // verify that we have correct order-of-operations in the final scroll compensation.
+    // Note that rotating about the center of the layer ensures we do not accidentally
+    // clip away layers that we want to test.
     WebTransformationMatrix rotationAboutZ;
+    rotationAboutZ.translate(50, 50);
     rotationAboutZ.rotate3d(0, 0, 90);
+    rotationAboutZ.translate(-50, -50);
     grandChild->setTransform(rotationAboutZ);
     greatGrandChild->setTransform(rotationAboutZ);
 
@@ -1616,7 +1426,7 @@ TEST(CCLayerTreeHostCommonTest, verifyScrollCompensationForFixedPositionLayerWit
     expectedGrandChildTransform.translate(50, 50);
 
     WebTransformationMatrix expectedGreatGrandChildSurfaceOriginTransform;
-    expectedGreatGrandChildSurfaceOriginTransform.translate(140, 120);
+    expectedGreatGrandChildSurfaceOriginTransform.translate(40, 60);
     expectedGreatGrandChildSurfaceOriginTransform.multiply(rotationAboutZ);
 
     WebTransformationMatrix expectedGreatGrandChildTransform;
@@ -1657,7 +1467,7 @@ TEST(CCLayerTreeHostCommonTest, verifyScrollCompensationForFixedPositionLayerWit
     WebTransformationMatrix compoundOriginTransform; // transform from greatGrandChildSurface's origin to the root surface.
     compoundOriginTransform.translate(8, 6); // origin translation of grandChild
     compoundOriginTransform.multiply(rotationAboutZ); // rotation of grandChild
-    compoundOriginTransform.translate(140, 120); // origin translation of greatGrandChild
+    compoundOriginTransform.translate(40, 60); // origin translation of greatGrandChild
     compoundOriginTransform.multiply(rotationAboutZ); // rotation of greatGrandChild
 
     expectedFixedPositionChildTransform.makeIdentity();
@@ -1854,16 +1664,16 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
     setLayerPropertiesForTesting(leafNode2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(20, 20), false);
 
     child->setMasksToBounds(true);
-    child->setOpacity(0.4f);
+    child->setOpacity(0.4);
     grandChild->setOpacity(0.5);
-    greatGrandChild->setOpacity(0.4f);
+    greatGrandChild->setOpacity(0.4);
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
 
     // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -1877,67 +1687,6 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
     EXPECT_EQ(child->id(), renderSurfaceLayerList[1]->id());
 }
 
-TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfacesCrashRepro)
-{
-    // This is a similar situation as verifyClipRectCullsRenderSurfaces, except that
-    // it reproduces a crash bug http://code.google.com/p/chromium/issues/detail?id=106734.
-
-    const WebTransformationMatrix identityMatrix;
-    RefPtr<LayerChromium> parent = LayerChromium::create();
-    RefPtr<LayerChromium> child = LayerChromium::create();
-    RefPtr<LayerChromium> grandChild = LayerChromium::create();
-    RefPtr<LayerChromium> greatGrandChild = LayerChromium::create();
-    RefPtr<LayerChromiumWithForcedDrawsContent> leafNode1 = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    RefPtr<LayerChromiumWithForcedDrawsContent> leafNode2 = adoptRef(new LayerChromiumWithForcedDrawsContent());
-    parent->createRenderSurface();
-    parent->addChild(child);
-    child->addChild(grandChild);
-    grandChild->addChild(greatGrandChild);
-
-    // leafNode1 ensures that parent and child are kept on the renderSurfaceLayerList,
-    // even though grandChild and greatGrandChild should be clipped.
-    child->addChild(leafNode1);
-    greatGrandChild->addChild(leafNode2);
-
-    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(20, 20), false);
-    setLayerPropertiesForTesting(grandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(45, 45), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(greatGrandChild.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(10, 10), false);
-    setLayerPropertiesForTesting(leafNode1.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(500, 500), false);
-    setLayerPropertiesForTesting(leafNode2.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(20, 20), false);
-
-    child->setMasksToBounds(true);
-    child->setOpacity(0.4f);
-    grandChild->setOpacity(0.5);
-    greatGrandChild->setOpacity(0.4f);
-
-    // Contaminate the grandChild and greatGrandChild's clipRect to reproduce the crash
-    // bug found in http://code.google.com/p/chromium/issues/detail?id=106734. In this
-    // bug, the clipRect was not re-computed for layers that create RenderSurfaces, and
-    // therefore leafNode2 thinks it should draw itself. As a result, an extra
-    // renderSurface remains on the renderSurfaceLayerList, which violates the assumption
-    // that an empty renderSurface will always be the last item on the list, which
-    // ultimately caused the crash.
-    child->setClipRect(IntRect(IntPoint::zero(), IntSize(20, 20)));
-    greatGrandChild->setClipRect(IntRect(IntPoint::zero(), IntSize(1234, 1234)));
-
-    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
-    Vector<RefPtr<LayerChromium> > dummyLayerList;
-    int dummyMaxTextureSize = 512;
-
-    // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
-    renderSurfaceLayerList.append(parent.get());
-
-    CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
-
-    ASSERT_EQ(2U, renderSurfaceLayerList.size());
-    EXPECT_EQ(parent->id(), renderSurfaceLayerList[0]->id());
-    EXPECT_EQ(child->id(), renderSurfaceLayerList[1]->id());
-}
-
 TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsSurfaceWithoutVisibleContent)
 {
     // When a renderSurface has a clipRect, it is used to clip the contentRect
@@ -1971,15 +1720,15 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsSurfaceWithoutVisibleContent)
     setLayerPropertiesForTesting(leafNode.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(10, 10), false);
 
     parent->setMasksToBounds(true);
-    child->setOpacity(0.4f);
-    grandChild->setOpacity(0.4f);
+    child->setOpacity(0.4);
+    grandChild->setOpacity(0.4);
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
 
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     parent->createRenderSurface();
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -1997,8 +1746,8 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsSurfaceWithoutVisibleContent)
     renderSurfaceLayerList.clear();
     dummyLayerList.clear();
 
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     parent->createRenderSurface();
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2010,14 +1759,14 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsSurfaceWithoutVisibleContent)
     EXPECT_EQ(grandChild->id(), renderSurfaceLayerList[2]->id());
 }
 
-TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToLayers)
+TEST(CCLayerTreeHostCommonTest, verifyDrawableContentRectForLayers)
 {
-    // Verify that layers get the appropriate clipRects when their parent masksToBounds is true.
+    // Verify that layers get the appropriate drawableContentRect when their parent masksToBounds is true.
     //
-    //   grandChild1 - completely inside the region; clipRect should be the mask region (larger than this layer's bounds).
-    //   grandChild2 - partially clipped but NOT masksToBounds; the clipRect should be the parent's clipRect regardless of the layer's bounds.
-    //   grandChild3 - partially clipped and masksToBounds; the clipRect will be the intersection of layerBounds and the mask region.
-    //   grandChild4 - outside parent's clipRect, and masksToBounds; the clipRect should be empty.
+    //   grandChild1 - completely inside the region; drawableContentRect should be the layer rect expressed in target space.
+    //   grandChild2 - partially clipped but NOT masksToBounds; the clipRect will be the intersection of layerBounds and the mask region.
+    //   grandChild3 - partially clipped and masksToBounds; the drawableContentRect will still be the intersection of layerBounds and the mask region.
+    //   grandChild4 - outside parent's clipRect; the drawableContentRect should be empty.
     //
 
     const WebTransformationMatrix identityMatrix;
@@ -2044,10 +1793,9 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToLayers)
 
     child->setMasksToBounds(true);
     grandChild3->setMasksToBounds(true);
-    grandChild4->setMasksToBounds(true);
 
     // Force everyone to be a render surface.
-    child->setOpacity(0.4f);
+    child->setOpacity(0.4);
     grandChild1->setOpacity(0.5);
     grandChild2->setOpacity(0.5);
     grandChild3->setOpacity(0.5);
@@ -2058,7 +1806,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToLayers)
     int dummyMaxTextureSize = 512;
 
     // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2066,17 +1814,17 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToLayers)
     CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
 
 
-    EXPECT_INT_RECT_EQ(IntRect(IntPoint::zero(), IntSize(20, 20)), grandChild1->clipRect());
-    EXPECT_INT_RECT_EQ(IntRect(IntPoint::zero(), IntSize(20, 20)), grandChild2->clipRect());
-    EXPECT_INT_RECT_EQ(IntRect(IntPoint(15, 15), IntSize(5, 5)), grandChild3->clipRect());
-    EXPECT_TRUE(grandChild4->clipRect().isEmpty());
+    EXPECT_INT_RECT_EQ(IntRect(IntPoint(5, 5), IntSize(10, 10)), grandChild1->drawableContentRect());
+    EXPECT_INT_RECT_EQ(IntRect(IntPoint(15, 15), IntSize(5, 5)), grandChild3->drawableContentRect());
+    EXPECT_INT_RECT_EQ(IntRect(IntPoint(15, 15), IntSize(5, 5)), grandChild3->drawableContentRect());
+    EXPECT_TRUE(grandChild4->drawableContentRect().isEmpty());
 }
 
 TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
 {
     // Verify that renderSurfaces (and their layers) get the appropriate clipRects when their parent masksToBounds is true.
     //
-    // Layers that own renderSurfaces (at least for now) do not inherit any clipRect;
+    // Layers that own renderSurfaces (at least for now) do not inherit any clipping;
     // instead the surface will enforce the clip for the entire subtree. They may still
     // have a clipRect of their own layer bounds, however, if masksToBounds was true.
     //
@@ -2122,7 +1870,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
     grandChild4->setMasksToBounds(true);
 
     // Force everyone to be a render surface.
-    child->setOpacity(0.4f);
+    child->setOpacity(0.4);
     grandChild1->setOpacity(0.5);
     grandChild2->setOpacity(0.5);
     grandChild3->setOpacity(0.5);
@@ -2133,7 +1881,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
     int dummyMaxTextureSize = 512;
 
     // FIXME: when we fix this "root-layer special case" behavior in CCLayerTreeHost, we will have to fix it here, too.
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2149,12 +1897,6 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(0, 0), IntSize(20, 20)), grandChild1->renderSurface()->clipRect());
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(0, 0), IntSize(20, 20)), grandChild2->renderSurface()->clipRect());
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(0, 0), IntSize(20, 20)), grandChild3->renderSurface()->clipRect());
-
-    // Layers do not inherit the clipRect from their owned surfaces, but if masksToBounds is true, they do create their own clipRect.
-    EXPECT_FALSE(grandChild1->usesLayerClipping());
-    EXPECT_FALSE(grandChild2->usesLayerClipping());
-    EXPECT_TRUE(grandChild3->usesLayerClipping());
-    EXPECT_TRUE(grandChild4->usesLayerClipping());
 }
 
 TEST(CCLayerTreeHostCommonTest, verifyAnimationsForRenderSurfaceHierarchy)
@@ -2619,7 +2361,6 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithoutPreserves3d)
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
     parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2724,7 +2465,6 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithPreserves3d)
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
     parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2811,7 +2551,6 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithAnimatingTransforms)
     int dummyMaxTextureSize = 512;
 
     parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -2885,7 +2624,6 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithPreserves3dForFlattenin
     Vector<RefPtr<LayerChromium> > dummyLayerList;
     int dummyMaxTextureSize = 512;
     parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), identityMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -3208,7 +2946,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleLayerWithScaledContents
     // test makes sure that hit testing works correctly accounts for the contents scale.
     // A contentsScale that is not 1 effectively forces a non-identity transform between
     // layer's content space and layer's origin space, which is not included in the
-    // screenSpaceTransformn. The hit testing code must take this into account.
+    // screenSpaceTransform. The hit testing code must take this into account.
     //
     // To test this, the layer is positioned at (25, 25), and is size (50, 50). If
     // contentsScale is ignored, then hit testing will mis-interpret the visibleContentRect
@@ -3677,7 +3415,97 @@ PassRefPtr<ContentLayerChromium> createDrawableContentLayerChromium(ContentLayer
     return toReturn.release();
 }
 
-TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
+TEST(CCLayerTreeHostCommonTest, verifyLayerTransformsInHighDPI)
+{
+    // Verify draw and screen space transforms of layers not in a surface.
+    MockContentLayerDelegate delegate;
+    WebTransformationMatrix identityMatrix;
+    WebTransformationMatrix parentMatrix;
+
+    RefPtr<ContentLayerChromium> parent = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(parent.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(100, 100), true);
+
+    RefPtr<ContentLayerChromium> child = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(2, 2), IntSize(10, 10), true);
+
+    RefPtr<ContentLayerChromium> childNoScale = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(childNoScale.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(2, 2), IntSize(10, 10), true);
+
+    parent->addChild(child);
+    parent->addChild(childNoScale);
+
+    Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
+    Vector<RefPtr<LayerChromium> > dummyLayerList;
+    int dummyMaxTextureSize = 512;
+
+    parent->createRenderSurface();
+    parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
+    renderSurfaceLayerList.append(parent.get());
+
+    const double deviceScaleFactor = 2.5;
+    parentMatrix.scale(deviceScaleFactor);
+    parent->setContentsScale(deviceScaleFactor);
+    child->setContentsScale(deviceScaleFactor);
+    EXPECT_EQ(childNoScale->contentsScale(), 1);
+
+    CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), parentMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
+
+    EXPECT_EQ(1u, renderSurfaceLayerList.size());
+
+    // Verify parent transforms
+    WebTransformationMatrix expectedParentScreenSpaceTransform;
+    expectedParentScreenSpaceTransform.setM11(deviceScaleFactor);
+    expectedParentScreenSpaceTransform.setM22(deviceScaleFactor);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedParentScreenSpaceTransform, parent->screenSpaceTransform());
+
+    WebTransformationMatrix expectedParentDrawTransform = expectedParentScreenSpaceTransform;
+    expectedParentDrawTransform.translate(0.5 * parent->bounds().width(), 0.5 * parent->bounds().height());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedParentDrawTransform, parent->drawTransform());
+
+    // Verify results of transformed parent rects
+    IntRect parentBounds(IntPoint(), parent->bounds());
+    IntRect centeredParentBounds = parentBounds;
+    centeredParentBounds.move(-parentBounds.width() * 0.5, -parentBounds.height() * 0.5);
+
+    FloatRect parentDrawRect = CCMathUtil::mapClippedRect(parent->drawTransform(), FloatRect(centeredParentBounds));
+    FloatRect parentScreenSpaceRect = CCMathUtil::mapClippedRect(parent->screenSpaceTransform(), FloatRect(parentBounds));
+
+    FloatRect expectedParentDrawRect(FloatPoint(), parent->bounds());
+    expectedParentDrawRect.scale(deviceScaleFactor);
+    EXPECT_FLOAT_RECT_EQ(expectedParentDrawRect, parentDrawRect);
+    EXPECT_FLOAT_RECT_EQ(expectedParentDrawRect, parentScreenSpaceRect);
+
+    // Verify child transforms
+    WebTransformationMatrix expectedChildScreenSpaceTransform;
+    expectedChildScreenSpaceTransform.setM11(deviceScaleFactor);
+    expectedChildScreenSpaceTransform.setM22(deviceScaleFactor);
+    expectedChildScreenSpaceTransform.translate(child->position().x(), child->position().y());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildScreenSpaceTransform, child->screenSpaceTransform());
+
+    WebTransformationMatrix expectedChildDrawTransform = expectedChildScreenSpaceTransform;
+    expectedChildDrawTransform.translate(0.5 * child->bounds().width(), 0.5 * child->bounds().height());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildDrawTransform, child->drawTransform());
+
+    // Verify results of transformed child rects
+    IntRect childBounds(IntPoint(), child->bounds());
+    IntRect centeredChildBounds = childBounds;
+    centeredChildBounds.move(-childBounds.width() * 0.5, -childBounds.height() * 0.5);
+
+    FloatRect childDrawRect = CCMathUtil::mapClippedRect(child->drawTransform(), FloatRect(centeredChildBounds));
+    FloatRect childScreenSpaceRect = CCMathUtil::mapClippedRect(child->screenSpaceTransform(), FloatRect(childBounds));
+
+    FloatRect expectedChildDrawRect(FloatPoint(), child->bounds());
+    expectedChildDrawRect.move(child->position().x(), child->position().y());
+    expectedChildDrawRect.scale(deviceScaleFactor);
+    EXPECT_FLOAT_RECT_EQ(expectedChildDrawRect, childDrawRect);
+    EXPECT_FLOAT_RECT_EQ(expectedChildDrawRect, childScreenSpaceRect);
+
+    // Verify childNoScale transforms
+    EXPECT_TRANSFORMATION_MATRIX_EQ(child->drawTransform(), childNoScale->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(child->screenSpaceTransform(), childNoScale->screenSpaceTransform());
+}
+
+TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTransformsInHighDPI)
 {
     MockContentLayerDelegate delegate;
     WebTransformationMatrix identityMatrix;
@@ -3694,7 +3522,13 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
     RefPtr<ContentLayerChromium> replica = createDrawableContentLayerChromium(&delegate);
     setLayerPropertiesForTesting(replica.get(), replicaTransform, identityMatrix, FloatPoint(0, 0), FloatPoint(2, 2), IntSize(10, 10), true);
 
+    // This layer should end up in the same surface as child, with the same draw
+    // and screen space transforms.
+    RefPtr<ContentLayerChromium> duplicateChildNonOwner = createDrawableContentLayerChromium(&delegate);
+    setLayerPropertiesForTesting(duplicateChildNonOwner.get(), identityMatrix, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(10, 10), true);
+
     parent->addChild(child);
+    child->addChild(duplicateChildNonOwner);
     child->setReplicaLayer(replica.get());
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
@@ -3703,13 +3537,13 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
 
     parent->createRenderSurface();
     parent->renderSurface()->setContentRect(IntRect(IntPoint(), parent->bounds()));
-    parent->setClipRect(IntRect(IntPoint::zero(), parent->bounds()));
     renderSurfaceLayerList.append(parent.get());
 
     const double deviceScaleFactor = 1.5;
     parentMatrix.scale(deviceScaleFactor);
     parent->setContentsScale(deviceScaleFactor);
     child->setContentsScale(deviceScaleFactor);
+    duplicateChildNonOwner->setContentsScale(deviceScaleFactor);
     replica->setContentsScale(deviceScaleFactor);
 
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent.get(), parentMatrix, identityMatrix, renderSurfaceLayerList, dummyLayerList, dummyMaxTextureSize);
@@ -3718,6 +3552,14 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
     // render surface (it needs one because it has a replica layer).
     EXPECT_EQ(2u, renderSurfaceLayerList.size());
 
+    WebTransformationMatrix expectedParentScreenSpaceTransform;
+    expectedParentScreenSpaceTransform.setM11(deviceScaleFactor);
+    expectedParentScreenSpaceTransform.setM22(deviceScaleFactor);
+    WebTransformationMatrix expectedParentDrawTransform = expectedParentScreenSpaceTransform;
+    expectedParentDrawTransform.translate(0.5 * parent->bounds().width(), 0.5 * parent->bounds().height());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedParentDrawTransform, parent->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedParentScreenSpaceTransform, parent->screenSpaceTransform());
+
     WebTransformationMatrix expectedDrawTransform;
     expectedDrawTransform.setM11(deviceScaleFactor);
     expectedDrawTransform.setM22(deviceScaleFactor);
@@ -3725,6 +3567,17 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
     expectedDrawTransform.setM42(0.5 * deviceScaleFactor * child->bounds().height());
     EXPECT_TRANSFORMATION_MATRIX_EQ(expectedDrawTransform, child->drawTransform());
 
+    WebTransformationMatrix expectedScreenSpaceTransform;
+    expectedScreenSpaceTransform.setM11(deviceScaleFactor);
+    expectedScreenSpaceTransform.setM22(deviceScaleFactor);
+    expectedScreenSpaceTransform.translate(child->position().x(), child->position().y());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedScreenSpaceTransform, child->screenSpaceTransform());
+
+    EXPECT_TRANSFORMATION_MATRIX_EQ(child->drawTransform(), duplicateChildNonOwner->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(child->screenSpaceTransform(), duplicateChildNonOwner->screenSpaceTransform());
+    EXPECT_INT_RECT_EQ(child->drawableContentRect(), duplicateChildNonOwner->drawableContentRect());
+    EXPECT_EQ(child->contentBounds(), duplicateChildNonOwner->contentBounds());
+
     WebTransformationMatrix expectedRenderSurfaceDrawTransform;
     expectedRenderSurfaceDrawTransform.translate(deviceScaleFactor * (child->position().x() + 0.5 * child->bounds().width()), deviceScaleFactor * (child->position().y() + 0.5 * child->bounds().height()));
     EXPECT_TRANSFORMATION_MATRIX_EQ(expectedRenderSurfaceDrawTransform, child->renderSurface()->drawTransform());
@@ -3733,9 +3586,9 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceTranformsInHighDPI)
     expectedOriginTransform.translate(deviceScaleFactor * 2, deviceScaleFactor * 2);
     EXPECT_TRANSFORMATION_MATRIX_EQ(expectedOriginTransform, child->renderSurface()->originTransform());
 
-    WebTransformationMatrix expectedScreenSpaceTransform;
-    expectedScreenSpaceTransform.translate(deviceScaleFactor * 2, deviceScaleFactor * 2);
-    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedScreenSpaceTransform, child->renderSurface()->screenSpaceTransform());
+    WebTransformationMatrix expectedSurfaceScreenSpaceTransform;
+    expectedSurfaceScreenSpaceTransform.translate(deviceScaleFactor * 2, deviceScaleFactor * 2);
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedSurfaceScreenSpaceTransform, child->renderSurface()->screenSpaceTransform());
 
     WebTransformationMatrix expectedReplicaDrawTransform;
     expectedReplicaDrawTransform.setM22(-1);
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index dd525fcbf..1419164b5 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -137,10 +137,15 @@ public:
         root->setMaxScrollPosition(contentSize);
         root->setBounds(contentSize);
         root->setContentBounds(contentSize);
+        root->setPosition(FloatPoint(0, 0));
+        root->setAnchorPoint(FloatPoint(0, 0));
+
         OwnPtr<CCLayerImpl> contents = CCLayerImpl::create(2);
         contents->setDrawsContent(true);
         contents->setBounds(contentSize);
         contents->setContentBounds(contentSize);
+        contents->setPosition(FloatPoint(0, 0));
+        contents->setAnchorPoint(FloatPoint(0, 0));
         root->addChild(contents.release());
         m_hostImpl->setRootLayer(root.release());
     }
@@ -838,13 +843,18 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     OwnPtr<CCLayerImpl> contentLayer = CCLayerImpl::create(1);
     contentLayer->setIsNonCompositedContent(true);
     contentLayer->setDrawsContent(true);
-    contentLayer->setPosition(IntPoint(5, 5));
+    contentLayer->setPosition(FloatPoint(0, 0));
+    contentLayer->setAnchorPoint(FloatPoint(0, 0));
     contentLayer->setBounds(surfaceSize);
     contentLayer->setContentBounds(IntSize(surfaceSize.width() * 2, surfaceSize.height() * 2));
 
     OwnPtr<CCLayerImpl> scrollLayer = CCLayerImpl::create(2);
     scrollLayer->setScrollable(true);
     scrollLayer->setMaxScrollPosition(surfaceSize);
+    scrollLayer->setBounds(surfaceSize);
+    scrollLayer->setContentBounds(surfaceSize);
+    scrollLayer->setPosition(FloatPoint(0, 0));
+    scrollLayer->setAnchorPoint(FloatPoint(0, 0));
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
@@ -862,6 +872,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildCallsCommitAndRedraw)
 {
     IntSize surfaceSize(10, 10);
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    root->setBounds(surfaceSize);
+    root->setContentBounds(surfaceSize);
     root->addChild(createScrollableLayer(2, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
@@ -1038,6 +1050,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildAndChangePageScaleOnMainThread)
 {
     IntSize surfaceSize(10, 10);
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    root->setBounds(surfaceSize);
+    root->setContentBounds(surfaceSize);
     // Also mark the root scrollable so it becomes the root scroll layer.
     root->setScrollable(true);
     int scrollLayerId = 2;
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index b0e9ee8d6..ca3e21c3d 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -2176,8 +2176,14 @@ public:
     virtual void beginTest() OVERRIDE
     {
         m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->rootLayer()->setBounds(IntSize(10, 10));
+        
         m_rootScrollLayer = ContentLayerChromium::create(&m_mockDelegate);
         m_rootScrollLayer->setBounds(IntSize(10, 10));
+
+        m_rootScrollLayer->setPosition(FloatPoint(0, 0));
+        m_rootScrollLayer->setAnchorPoint(FloatPoint(0, 0));
+
         m_rootScrollLayer->setIsDrawable(true);
         m_rootScrollLayer->setScrollable(true);
         m_rootScrollLayer->setMaxScrollPosition(IntSize(100, 100));
@@ -2188,6 +2194,10 @@ public:
         m_childLayer->setIsDrawable(true);
         m_childLayer->setScrollable(true);
         m_childLayer->setMaxScrollPosition(IntSize(100, 100));
+
+        m_childLayer->setPosition(FloatPoint(0, 0));
+        m_childLayer->setAnchorPoint(FloatPoint(0, 0));
+
         m_rootScrollLayer->addChild(m_childLayer);
         postSetNeedsCommitToMainThread();
     }
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index 87bde5117..b559db12c 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -263,7 +263,6 @@ protected:
         ASSERT(!root->renderSurface());
         root->createRenderSurface();
         root->renderSurface()->setContentRect(IntRect(IntPoint::zero(), root->bounds()));
-        root->setClipRect(IntRect(IntPoint::zero(), root->bounds()));
         m_renderSurfaceLayerListImpl.append(m_root.get());
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root, identityMatrix, identityMatrix, m_renderSurfaceLayerListImpl, dummyLayerList, &layerSorter, dummyMaxTextureSize);
@@ -282,7 +281,6 @@ protected:
         ASSERT(!root->renderSurface());
         root->createRenderSurface();
         root->renderSurface()->setContentRect(IntRect(IntPoint::zero(), root->bounds()));
-        root->setClipRect(IntRect(IntPoint::zero(), root->bounds()));
         m_renderSurfaceLayerListChromium.append(m_root);
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root, identityMatrix, identityMatrix, m_renderSurfaceLayerListChromium, dummyLayerList, dummyMaxTextureSize);
@@ -2069,7 +2067,7 @@ protected:
 
         this->visitLayer(surfaceChild2, occlusion);
         this->enterLayer(surfaceChild, occlusion);
-        EXPECT_INT_RECT_EQ(IntRect(100, 0, 150, 300), occlusion.unoccludedContentRect(surfaceChild, IntRect(0, 0, 300, 300)));
+        EXPECT_INT_RECT_EQ(IntRect(100, 0, 100, 300), occlusion.unoccludedContentRect(surfaceChild, IntRect(0, 0, 300, 300)));
         this->leaveLayer(surfaceChild, occlusion);
         this->enterLayer(surface, occlusion);
         EXPECT_INT_RECT_EQ(IntRect(200, 0, 50, 300), occlusion.unoccludedContentRect(surface, IntRect(0, 0, 300, 300)));
@@ -2121,7 +2119,7 @@ protected:
 
         this->visitLayer(surfaceChild2, occlusion);
         this->enterLayer(surfaceChild, occlusion);
-        EXPECT_INT_RECT_EQ(IntRect(100, 0, 150, 300), occlusion.unoccludedContentRect(surfaceChild, IntRect(0, 0, 300, 300)));
+        EXPECT_INT_RECT_EQ(IntRect(100, 0, 100, 300), occlusion.unoccludedContentRect(surfaceChild, IntRect(0, 0, 300, 300)));
         this->leaveLayer(surfaceChild, occlusion);
         this->enterLayer(surface, occlusion);
         EXPECT_INT_RECT_EQ(IntRect(200, 0, 50, 300), occlusion.unoccludedContentRect(surface, IntRect(0, 0, 300, 300)));
diff --git a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
index 57165e6ca..b2c41e525 100644
--- a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
+++ b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
@@ -239,9 +239,8 @@ TEST_F(CCResourceProviderTest, DeleteOwnedResources)
     int pool = 1;
 
     const int count = 3;
-    CCResourceProvider::ResourceId ids[count] = {0};
     for (int i = 0; i < count; ++i)
-        ids[i] = m_resourceProvider->createResource(pool, size, format, CCResourceProvider::TextureUsageAny);
+        m_resourceProvider->createResource(pool, size, format, CCResourceProvider::TextureUsageAny);
     EXPECT_EQ(3, context()->textureCount());
 
     m_resourceProvider->deleteOwnedResources(pool+1);
diff --git a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp b/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp
index b7a26df2f..bfb35c048 100644
--- a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp
@@ -51,12 +51,25 @@ class CCTextureUpdaterTest;
 
 class WebGraphicsContext3DForUploadTest : public FakeWebGraphicsContext3D {
 public:
-    WebGraphicsContext3DForUploadTest(CCTextureUpdaterTest *test) : m_test(test) { }
+    WebGraphicsContext3DForUploadTest(CCTextureUpdaterTest *test)
+        : m_test(test)
+        , m_supportShallowFlush(true)
+    { }
+
     virtual void flush(void);
+    virtual void shallowFlushCHROMIUM(void);
     virtual GrGLInterface* onCreateGrGLInterface() { return 0; }
 
+    virtual WebString getString(WGC3Denum name)
+    {
+        if (m_supportShallowFlush)
+            return WebString("GL_CHROMIUM_shallow_flush");
+        return WebString("");
+    }
+
 private:
     CCTextureUpdaterTest* m_test;
+    bool m_supportShallowFlush;
 };
 
 
@@ -231,6 +244,11 @@ void WebGraphicsContext3DForUploadTest::flush(void)
     m_test->onFlush();
 }
 
+void WebGraphicsContext3DForUploadTest::shallowFlushCHROMIUM(void)
+{
+    m_test->onFlush();
+}
+
 void TextureUploaderForUploadTest::beginUploads()
 {
     m_test->onBeginUploads();
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index 004022b66..a932ab61c 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -495,10 +495,8 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
 
     // Test properties that should not call needsDisplay and needsCommit when changed.
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setVisibleContentRect(IntRect(0, 0, 40, 50)));
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setUsesLayerClipping(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setIsNonCompositedContent(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawOpacity(0.5));
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setClipRect(IntRect(3, 3, 8, 8)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setRenderTarget(0));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawTransform(WebTransformationMatrix()));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setScreenSpaceTransform(WebTransformationMatrix()));
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index a6fb4a584..fe2e6c56e 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,14 @@
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Removed numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/ChromeClientEfl.h:
+
 2012-07-22  Kent Tamura  <tkent@chromium.org>
 
         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index 81b5dae63..3cfc678ec 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -179,7 +179,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
 
     Evas_Object* m_view;
     KURL m_hoveredLinkURL;
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index be5485d56..1501bd2bb 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,14 @@
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/ChromeClientGtk.h:
+
 2012-07-17  Vivek Galatage  <vivekgalatage@gmail.com>
 
         Web Inspector: refactor InspectorController::connectFrontend() to accept InspectorFrontendChannel.
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
index d58ffc1c4..e5e2fa1eb 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.h
@@ -152,7 +152,6 @@ namespace WebKit {
 
         virtual bool shouldRubberBandInDirection(ScrollDirection) const { return true; }
         virtual void numWheelEventHandlersChanged(unsigned) { }
-        virtual void numTouchEventHandlersChanged(unsigned) { }
 
 #if USE(ACCELERATED_COMPOSITING) 
         virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*);
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 60d697325..9df345021 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,39 @@
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/WebChromeClient.h:
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
 2012-07-23  Kent Tamura  <tkent@chromium.org>
 
         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index dedcb83f2..49182f3a0 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -37,15 +37,16 @@ ENABLE_ANIMATION_API = ;
 ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
-ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
-ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
+ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
+ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
@@ -135,4 +136,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index 841345e10..b827ad3ef 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 16041b0cc..a473fe340 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -180,7 +180,6 @@ public:
     virtual PassRefPtr<WebCore::SearchPopupMenu> createSearchPopupMenu(WebCore::PopupMenuClient*) const OVERRIDE;
 
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE { }
-    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const OVERRIDE { return false; }
 private:
     WebView *m_webView;
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index 1330870da..8e9633d18 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -122,6 +122,7 @@
 #include <QApplication>
 #include <QBasicTimer>
 #include <QBitArray>
+#include <QColorDialog>
 #include <QDebug>
 #include <QDesktopWidget>
 #include <QDragEnterEvent>
@@ -2443,6 +2444,19 @@ void QWebPage::triggerAction(WebAction action, bool)
         editor->command(command).execute();
 }
 
+
+QColor QWebPagePrivate::colorSelectionRequested(const QColor &selectedColor)
+{
+    QColor ret = selectedColor;
+#ifndef QT_NO_COLORDIALOG
+    QWidget* parent = (client) ? client->ownerWidget() : 0;
+    ret = QColorDialog::getColor(selectedColor, parent);
+    if (!ret.isValid())
+        ret = selectedColor;
+#endif
+    return ret;
+}
+
 QSize QWebPage::viewportSize() const
 {
     if (d->mainFrame && d->mainFrame.data()->d->frame->view())
diff --git a/Source/WebKit/qt/Api/qwebpage_p.h b/Source/WebKit/qt/Api/qwebpage_p.h
index aabdd1174..ca3aa94ad 100644
--- a/Source/WebKit/qt/Api/qwebpage_p.h
+++ b/Source/WebKit/qt/Api/qwebpage_p.h
@@ -94,6 +94,8 @@ public:
     void updateNavigationActions();
     void updateEditorActions();
 
+    QColor colorSelectionRequested(const QColor& selectedColor);
+
     void timerEvent(QTimerEvent*);
 
     template<class T> void mouseMoveEvent(T*);
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index d75294502..fbfcf398c 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,57 @@
+2012-07-24  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt][WK1] color input type support
+        https://bugs.webkit.org/show_bug.cgi?id=91998
+
+        Reviewed by Simon Hausmann.
+
+        Using QColorDialog. This is private for now, but
+        it could be exposed via a virtual function in
+        QWebPage at a later point in a Qt 5 minor release
+        if there are requests for that.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::colorSelectionRequested):
+        * Api/qwebpage_p.h:
+        (QWebPagePrivate):
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::createColorChooser):
+
+2012-07-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Fix compilation against namespaced Qt
+
+        Reviewed by Simon Hausmann.
+
+        * WebCoreSupport/GeolocationClientQt.h:
+        * examples/platformplugin/WebPlugin.h:
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/ChromeClientQt.h:
+
+2012-07-23  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] RenderThemeQtMobile highlight colors are not being used
+        https://bugs.webkit.org/show_bug.cgi?id=92004
+
+        Reviewed by Noam Rosenthal.
+
+        * WebCoreSupport/RenderThemeQStyle.cpp:
+        (WebCore::RenderThemeQStyle::setPaletteFromPageClientIfExists): Moved here since
+        it's used only by RenderThemeQStyle. Remove unnecessary check for m_page->chrome().
+        (WebCore):
+        (WebCore::RenderThemeQStyle::colorPalette):
+        * WebCoreSupport/RenderThemeQStyle.h:
+        (RenderThemeQStyle):
+
 2012-07-22  Kent Tamura  <tkent@chromium.org>
 
         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index b21ce9e98..43b105ef3 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -32,6 +32,7 @@
 
 #include "ApplicationCacheStorage.h"
 #include "ColorChooser.h"
+#include "ColorChooserClient.h"
 #include "DatabaseTracker.h"
 #include "Document.h"
 #include "FileChooser.h"
@@ -559,9 +560,11 @@ void ChromeClientQt::reachedApplicationCacheOriginQuota(SecurityOrigin* origin,
 }
 
 #if ENABLE(INPUT_TYPE_COLOR)
-PassOwnPtr<ColorChooser> ChromeClientQt::createColorChooser(ColorChooserClient*, const Color&)
+PassOwnPtr<ColorChooser> ChromeClientQt::createColorChooser(ColorChooserClient* client, const Color& color)
 {
-    notImplemented();
+    const QColor selectedColor = m_webPage->d->colorSelectionRequested(QColor(color));
+    client->didChooseColor(selectedColor);
+    client->didEndChooser();
     return nullptr;
 }
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index a7d7dc23e..af1fff6d4 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -191,7 +191,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
 
     QWebPage* m_webPage;
     KURL lastHoverURL;
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
index 94b0f6531..726be157a 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
@@ -39,7 +39,9 @@ class QGeoPositionInfoSource;
 using namespace QtMobility;
 #elif HAVE(QT5)
 #include <QtLocation/QGeoPositionInfo>
+QT_BEGIN_NAMESPACE
 class QGeoPositionInfoSource;
+QT_END_NAMESPACE
 #endif
 
 
diff --git a/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp
index 7cfdabfc2..8bc0df497 100644
--- a/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.cpp
@@ -161,6 +161,20 @@ QStyle* RenderThemeQStyle::fallbackStyle() const
     return (m_fallbackStyle) ? m_fallbackStyle : QApplication::style();
 }
 
+void RenderThemeQStyle::setPaletteFromPageClientIfExists(QPalette& palette) const
+{
+    if (!m_page)
+        return;
+
+    ASSERT(m_page->chrome());
+    ChromeClient* chromeClient = m_page->chrome()->client();
+    if (!chromeClient)
+        return;
+
+    if (QWebPageClient* pageClient = chromeClient->platformPageClient())
+        palette = pageClient->palette();
+}
+
 QStyle* RenderThemeQStyle::qStyle() const
 {
     if (m_page) {
@@ -432,6 +446,12 @@ void RenderThemeQStyle::setPopupPadding(RenderStyle* style) const
     style->setPaddingBottom(Length(2, Fixed));
 }
 
+QPalette RenderThemeQStyle::colorPalette() const
+{
+    QPalette palette = RenderThemeQt::colorPalette();
+    setPaletteFromPageClientIfExists(palette);
+    return palette;
+}
 
 bool RenderThemeQStyle::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
diff --git a/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h
index 7e8c26e91..2cc999308 100644
--- a/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h
+++ b/Source/WebKit/qt/WebCoreSupport/RenderThemeQStyle.h
@@ -97,6 +97,8 @@ protected:
 
     virtual void setPopupPadding(RenderStyle*) const;
 
+    virtual QPalette colorPalette() const;
+
 private:
     ControlPart initializeCommonQStyleOptions(QStyleOption&, RenderObject*) const;
 
@@ -106,6 +108,8 @@ private:
 
     QStyle* fallbackStyle() const;
 
+    void setPaletteFromPageClientIfExists(QPalette&) const;
+
 #ifdef Q_OS_MAC
     int m_buttonFontPixelSize;
 #endif
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
index 74bc2eccc..de06f4a84 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
@@ -28,8 +28,10 @@
 #include <QVideoWidget>
 #endif
 
+QT_BEGIN_NAMESPACE
 class QListWidgetItem;
 class QListWidget;
+QT_END_NAMESPACE
 
 class Popup : public QDialog {
     Q_OBJECT
diff --git a/Source/WebKit/win/COMEnumVariant.h b/Source/WebKit/win/COMEnumVariant.h
index 67251073f..40ab414dd 100644
--- a/Source/WebKit/win/COMEnumVariant.h
+++ b/Source/WebKit/win/COMEnumVariant.h
@@ -26,7 +26,9 @@
 #ifndef COMEnumVariant_h
 #define COMEnumVariant_h
 
+#ifndef NOMINMAX
 #define NOMINMAX
+#endif
 #include <unknwn.h>
 
 
diff --git a/Source/WebKit/win/COMPropertyBag.h b/Source/WebKit/win/COMPropertyBag.h
index dd0a8c42f..c76863f15 100644
--- a/Source/WebKit/win/COMPropertyBag.h
+++ b/Source/WebKit/win/COMPropertyBag.h
@@ -26,7 +26,9 @@
 #ifndef COMPropertyBag_h
 #define COMPropertyBag_h
 
+#ifndef NOMINMAX
 #define NOMINMAX
+#endif
 #include <ocidl.h>
 #include <unknwn.h>
 
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index e836a123e..5eb1be3f8 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,21 @@
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix if NOMINMAX is defined by the build system.
+
+        * COMEnumVariant.h: Added #ifndef NOMINMAX around #define NOMINMAX.
+        * COMPropertyBag.h: Ditto.
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/WebChromeClient.h:
+
 2012-07-17  Vivek Galatage  <vivekgalatage@gmail.com>
 
         Web Inspector: refactor InspectorController::connectFrontend() to accept InspectorFrontendChannel.
diff --git a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
index f5559b0c9..9825922f5 100644
--- a/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -172,7 +172,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
 
 private:
     COMPtr<IWebUIDelegate> uiDelegate();
diff --git a/Source/WebKit/wince/ChangeLog b/Source/WebKit/wince/ChangeLog
index 714aefa2c..1b81b8549 100644
--- a/Source/WebKit/wince/ChangeLog
+++ b/Source/WebKit/wince/ChangeLog
@@ -1,3 +1,14 @@
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebCoreSupport/ChromeClientWinCE.h:
+
 2012-07-17  Vivek Galatage  <vivekgalatage@gmail.com>
 
         Web Inspector: refactor InspectorController::connectFrontend() to accept InspectorFrontendChannel.
diff --git a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
index 57c2f9388..00226d0c8 100644
--- a/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
+++ b/Source/WebKit/wince/WebCoreSupport/ChromeClientWinCE.h
@@ -168,7 +168,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
 
 private:
     WebView* m_webView;
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 7e68e4a80..5af5a7eef 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,14 @@
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebKitSupport/ChromeClientWx.h:
+
 2012-07-17  Vivek Galatage  <vivekgalatage@gmail.com>
 
         Web Inspector: refactor InspectorController::connectFrontend() to accept InspectorFrontendChannel.
diff --git a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
index c16948fbe..50540f094 100644
--- a/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
+++ b/Source/WebKit/wx/WebKitSupport/ChromeClientWx.h
@@ -145,7 +145,6 @@ public:
 
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const { return true; }
     virtual void numWheelEventHandlersChanged(unsigned) { }
-    virtual void numTouchEventHandlersChanged(unsigned) { }
     
     virtual bool hasOpenedPopup() const;
 
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 04cc719ee..384d7e6de 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -155,6 +155,8 @@ SET(WebKit2_SOURCES
     Shared/WebGraphicsContext.cpp
     Shared/WebHitTestResult.cpp
     Shared/WebImage.cpp
+    Shared/WebIntentData.cpp
+    Shared/WebIntentServiceInfo.cpp
     Shared/WebKeyboardEvent.cpp
     Shared/WebLayerTreeInfo.cpp
     Shared/WebMemorySampler.cpp
@@ -247,8 +249,6 @@ SET(WebKit2_SOURCES
     UIProcess/WebIconDatabase.cpp
     UIProcess/WebIconDatabaseClient.cpp
     UIProcess/WebInspectorProxy.cpp
-    UIProcess/WebIntentData.cpp
-    UIProcess/WebIntentServiceInfo.cpp
     UIProcess/WebKeyValueStorageManagerProxy.cpp
     UIProcess/WebLayerTreeRenderer.cpp
     UIProcess/WebLoaderClient.cpp
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index e1855a33c..808b60f2b 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,460 @@
+2012-07-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation after QtQuick API changes
+        https://bugs.webkit.org/show_bug.cgi?id=91822
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        QQuickCanvas is now QQuickWindow, QQuickItem::canvas() is window() and rootItem()
+        is contentItem(). Also QQuickWindow::grabFrameBuffer() is now grabWindow().
+
+        * UIProcess/API/qt/qquickwebpage.cpp:
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebViewPrivate::updateIcon):
+        * UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp:
+        (tst_QQuickWebView::multipleWebViews):
+        (tst_QQuickWebView::basicRenderingSanity):
+        (tst_QQuickWebView::transparentWebViews):
+        * UIProcess/API/qt/tests/testwindow.h:
+        (TestWindow::TestWindow):
+        * UIProcess/qt/QtPageClient.cpp:
+        (WebKit::QtPageClient::isViewVisible):
+        * UIProcess/qt/QtWebPageEventHandler.cpp:
+        (WebKit::QtWebPageEventHandler::startDrag):
+
+2012-07-24  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] Add quirks for running the web process in a profiler shell, like valgrind
+        https://bugs.webkit.org/show_bug.cgi?id=87672
+
+        Reviewed by Jocelyn Turcotte.
+
+        If environment variables QT_WEBKIT_WEB_PROCESS_COMMAND_PREFIX
+        and/or QT_WEBKIT_PLUGIN_PROCESS_COMMAND_PREFIX are set, use their
+        values as the prefix of the command when launching the child process.
+        Example usage:
+            export QT_WEB_PROCESS_COMMAND_PREFIX="valgrind --smc-check=all"
+            ./MiniBrowser http://somepage.html
+            ./WebKitTestRunner --no-timeout-at-all some_layouttest.html
+
+        * UIProcess/Launcher/qt/ProcessLauncherQt.cpp:
+        (WebKit::ProcessLauncher::launchProcess):
+
+2012-07-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Fix compilation against namespaced Qt
+
+        Reviewed by Simon Hausmann.
+
+        * Platform/CoreIPC/Connection.h:
+        * Platform/PlatformProcessIdentifier.h:
+        * Platform/WorkQueue.h:
+        * Shared/qt/QtNetworkRequestData.h:
+        * Shared/qt/WebEventFactoryQt.h:
+        * UIProcess/API/C/qt/WKNativeEvent.h:
+        * UIProcess/API/qt/qquickwebview_p.h:
+        * UIProcess/API/qt/qwebnavigationhistory_p.h:
+        * UIProcess/API/qt/raw/qrawwebview_p.h:
+        * UIProcess/DrawingAreaProxy.h:
+        * UIProcess/Launcher/ThreadLauncher.h:
+        * UIProcess/LayerTreeCoordinatorProxy.h:
+        * UIProcess/qt/QtViewportHandler.h:
+        * UIProcess/qt/QtWebPageSGNode.h:
+        * UIProcess/qt/WebColorChooserProxyQt.h:
+        * UIProcess/qt/WebGeolocationProviderQt.h:
+        * UIProcess/qt/WebPopupMenuProxyQt.h:
+        * WebProcess/WebProcess.h:
+
+2012-07-24  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Remove unneeded WebURLRequestEfl and WebURLResponseEfl
+        https://bugs.webkit.org/show_bug.cgi?id=92087
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove WebURLRequestEfl and WebURLResponseEfl classes
+        and their corresponding C APIs since we don't need / use
+        them.
+
+        * Shared/API/c/efl/WKURLRequestEfl.cpp: Removed.
+        * Shared/API/c/efl/WKURLRequestEfl.h: Removed.
+        * Shared/API/c/efl/WKURLResponseEfl.cpp: Removed.
+        * Shared/API/c/efl/WKURLResponseEfl.h: Removed.
+        * Shared/efl/WebURLRequestEfl.cpp: Removed.
+        * Shared/efl/WebURLRequestEfl.h: Removed.
+        * Shared/efl/WebURLResponseEfl.cpp: Removed.
+        * Shared/efl/WebURLResponseEfl.h: Removed.
+        * UIProcess/API/efl/ewk_url_request.cpp:
+
+2012-07-24  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Enable touch slider when touch events are enabled
+        https://bugs.webkit.org/show_bug.cgi?id=91013
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        TOUCH_SLIDER guards are used in WebCore, so we should really
+        be setting the corresponding ENABLE define in features.prf.
+
+        * Target.pri:
+
+2012-07-24  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Fix possible crash in didSendRequestForResource
+        https://bugs.webkit.org/show_bug.cgi?id=92077
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add NULL check for wkRedirectResponse in
+        didSendRequestForResource() before using it. The
+        argument may be NULL if there was no redirection.
+
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_resource_load_client.cpp:
+        (didSendRequestForResource):
+
+2012-07-24  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL][GTK] Share WebCoreArgumentCoders for soup-related types
+        https://bugs.webkit.org/show_bug.cgi?id=92073
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move WebCoreArgumentCoders for soup-related types such as
+        ResourceRequest, ResourceResponse and ResourceError from
+        port specific file to Shared/soup/WebCoreArgumentCodersSoup.cpp.
+        This way, the different ports using libsoup can share
+        code and avoid duplication.
+
+        * GNUmakefile.list.am:
+        * PlatformEfl.cmake:
+        * Shared/efl/WebCoreArgumentCodersEfl.cpp: Removed.
+        * Shared/soup/WebCoreArgumentCodersSoup.cpp: Renamed from Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp.
+        (CoreIPC):
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+
+2012-07-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123184, r123195, and r123197.
+        http://trac.webkit.org/changeset/123184
+        http://trac.webkit.org/changeset/123195
+        http://trac.webkit.org/changeset/123197
+        https://bugs.webkit.org/show_bug.cgi?id=92049
+
+        pagecycler regression (Requested by morrita on #webkit).
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] WebKitTestRunner needs to print information about Web intents
+        https://bugs.webkit.org/show_bug.cgi?id=90873
+
+        Reviewed by Anders Carlsson.
+
+        Add Bundle API for Web Intents. This is needed by the WebKitTestRunner
+        to print information about the new intent requests and the intent
+        service registrations.
+
+        * CMakeLists.txt: Move WebIntentData and WebIntentServiceInfo from
+        UIProcess/ to Shared/.
+        * GNUmakefile.list.am: Move WebIntentData and WebIntentServiceInfo from
+        UIProcess/ to Shared/.
+        * Shared/APIClientTraits.h:
+        * Shared/WebIntentData.cpp: Renamed from Source/WebKit2/UIProcess/WebIntentData.cpp.
+        (WebKit):
+        (WebKit::WebIntentData::WebIntentData):
+        (WebKit::WebIntentData::data):
+        (WebKit::WebIntentData::suggestions):
+        (WebKit::WebIntentData::extra):
+        (WebKit::WebIntentData::extras):
+        * Shared/WebIntentData.h: Renamed from Source/WebKit2/UIProcess/WebIntentData.h.
+        (WebKit):
+        (WebIntentData):
+        (WebKit::WebIntentData::create):
+        (WebKit::WebIntentData::~WebIntentData):
+        (WebKit::WebIntentData::action):
+        (WebKit::WebIntentData::payloadType):
+        (WebKit::WebIntentData::service):
+        (WebKit::WebIntentData::store):
+        (WebKit::WebIntentData::type):
+        * Shared/WebIntentServiceInfo.cpp: Renamed from Source/WebKit2/UIProcess/WebIntentServiceInfo.cpp.
+        (WebKit):
+        (WebKit::WebIntentServiceInfo::WebIntentServiceInfo):
+        * Shared/WebIntentServiceInfo.h: Renamed from Source/WebKit2/UIProcess/WebIntentServiceInfo.h.
+        (WebKit):
+        (WebIntentServiceInfo):
+        (WebKit::WebIntentServiceInfo::create):
+        (WebKit::WebIntentServiceInfo::~WebIntentServiceInfo):
+        (WebKit::WebIntentServiceInfo::action):
+        (WebKit::WebIntentServiceInfo::payloadType):
+        (WebKit::WebIntentServiceInfo::href):
+        (WebKit::WebIntentServiceInfo::title):
+        (WebKit::WebIntentServiceInfo::disposition):
+        (WebKit::WebIntentServiceInfo::type):
+        * Target.pri: Move WebIntentData and WebIntentServiceInfo from
+        UIProcess/ to Shared/.
+        * UIProcess/API/C/WKPage.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didReceiveIntentForFrame):
+        (registerIntentServiceForFrame):
+        * UIProcess/WebLoaderClient.cpp:
+        (WebKit::WebLoaderClient::didReceiveIntentForFrame):
+        (WebKit::WebLoaderClient::registerIntentServiceForFrame):
+        * UIProcess/WebLoaderClient.h:
+        (WebLoaderClient):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::registerIntentServiceForFrame):
+        (WebKit::WebPageProxy::didReceiveIntentForFrame):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/InjectedBundle/API/c/WKBundlePage.h:
+        * WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp:
+        (WebKit):
+        (WebKit::InjectedBundlePageLoaderClient::didReceiveIntentForFrame):
+        (WebKit::InjectedBundlePageLoaderClient::registerIntentServiceForFrame):
+        * WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h:
+        (WebKit):
+        (InjectedBundlePageLoaderClient):
+        * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebKit::WebFrameLoaderClient::dispatchIntent):
+        (WebKit::WebFrameLoaderClient::registerIntentService):
+        * WebProcess/qt/QtBuiltinBundlePage.cpp:
+        (WebKit::QtBuiltinBundlePage::QtBuiltinBundlePage):
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add unit tests for Ewk_Cookie_Manager
+        https://bugs.webkit.org/show_bug.cgi?id=91639
+
+        Reviewed by Antonio Gomes.
+
+        Add unit tests for Ewk_Cookie_Manager.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/ewk_cookie_manager.h: Fix "accept policy" documentation
+        to indicate that only cookies set by the main document are accepted by default.
+        * UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.cpp: Added.
+        (EWK2UnitTestServer::EWK2UnitTestServer): Add HTTP server similar to the one
+        used by GTK port unit tests.
+        (EWK2UnitTestServer::~EWK2UnitTestServer):
+        (EWK2UnitTestServer::run):
+        (EWK2UnitTestServer::getURIForPath):
+        * UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.h: Added.
+        (EWK2UnitTestServer):
+        (EWK2UnitTestServer::baseURI):
+        * UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp: Added.
+        (serverCallback):
+        (getAcceptPolicyCallback):
+        (getAcceptPolicy):
+        (getHostnamesWithCookiesCallback):
+        (getHostnamesWithCookies):
+        (freeHostNames):
+        (countHostnamesWithCookies):
+        (TEST_F):
+        (cleanUpCookieFiles):
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Enable touch slider when touch events are enabled
+        https://bugs.webkit.org/show_bug.cgi?id=91013
+
+        Reviewed by Antonio Gomes.
+
+        Take advantage of the logic introduced in r122286.
+
+        * Target.pri:
+
+2012-07-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Unify numTouchEventHandlersChanged and needTouchEvents in the chrome client
+        https://bugs.webkit.org/show_bug.cgi?id=91006
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove numTouchEventHandlersChanged stub.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+        (WebChromeClient):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add request manager client
+        https://bugs.webkit.org/show_bug.cgi?id=91193
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add a URL request manager client and attach it
+        to the Ewk_Context.
+
+        The client application can now register a URL scheme
+        via the Ewk_Context API and provide a callback handler
+        that will get called whenever a URL request with this
+        scheme is made.
+
+        A new Ewk_Url_Scheme_Request type is introduced to
+        provide information about the request to the client
+        and to allow the client to finish it by setting its
+        contents.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_context.cpp:
+        (_Ewk_Url_Scheme_Handler):
+        (_Ewk_Url_Scheme_Handler::_Ewk_Url_Scheme_Handler):
+        (_Ewk_Context):
+        (_Ewk_Context::_Ewk_Context):
+        (ewk_context_request_manager_get):
+        (ewk_context_url_scheme_request_received):
+        (createDefaultEwkContext):
+        (ewk_context_uri_scheme_register):
+        * UIProcess/API/efl/ewk_context.h:
+        * UIProcess/API/efl/ewk_context_private.h:
+        * UIProcess/API/efl/ewk_context_request_manager_client.cpp: Added.
+        (toEwkContext):
+        (didReceiveURIRequest):
+        (ewk_context_request_manager_client_attach):
+        * UIProcess/API/efl/ewk_context_request_manager_client_private.h: Added.
+        * UIProcess/API/efl/ewk_url_scheme_request.cpp: Added.
+        (_Ewk_Url_Scheme_Request):
+        (_Ewk_Url_Scheme_Request::_Ewk_Url_Scheme_Request):
+        (_Ewk_Url_Scheme_Request::~_Ewk_Url_Scheme_Request):
+        (ewk_url_scheme_request_ref):
+        (ewk_url_scheme_request_unref):
+        (ewk_url_scheme_request_scheme_get):
+        (ewk_url_scheme_request_url_get):
+        (ewk_url_scheme_request_path_get):
+        (ewk_url_scheme_request_id_get):
+        (ewk_url_scheme_request_finish):
+        (ewk_url_scheme_request_new):
+        * UIProcess/API/efl/ewk_url_scheme_request.h: Added.
+        * UIProcess/API/efl/ewk_url_scheme_request_private.h: Added.
+
+2012-07-23  KwangYong Choi  <ky0.choi@samsung.com>
+
+        [EFL][WK2] ProcessExecutablePath is required
+        https://bugs.webkit.org/show_bug.cgi?id=89719
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Added executablePathOfWebProcess and executablePathOfPluginProcess.
+        It's used for getting the location of WebProcess and PluginProcess.
+
+        * PlatformEfl.cmake: Added LIBEXECDIR definition
+        * Shared/efl/ProcessExecutablePathEfl.cpp: Added.
+        (WebKit):
+        (WebKit::findWebKitProcess):
+        (WebKit::executablePathOfWebProcess): Get the absolute path of WebProcess
+        (WebKit::executablePathOfPluginProcess): Get the absolute path of PluginProcess
+        * UIProcess/Launcher/efl/ProcessLauncherEfl.cpp:
+        (WebKit::ProcessLauncher::launchProcess): Modified to use above routines
+
+2012-07-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        WebKit2 needs layoutTestController.setAlwaysAcceptCookies
+        https://bugs.webkit.org/show_bug.cgi?id=42778
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add setAlwaysAcceptCookies() method to InjectedBundle
+        so that we can use it in LayoutTestController.
+        The method uses WebCookieManager::setHTTPCookieAcceptPolicy()
+        internally.
+
+        * WebProcess/InjectedBundle/API/c/WKBundle.cpp:
+        (WKBundleSetAlwaysAcceptCookies):
+        * WebProcess/InjectedBundle/API/c/WKBundlePrivate.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::setAlwaysAcceptCookies):
+        (WebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        (InjectedBundle):
+
+2012-07-23  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [WK2] SQL Database cannot be disabled at build time
+        https://bugs.webkit.org/show_bug.cgi?id=91837
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebKit2 had no #ifdefs for SQL Database. This patch adds these
+        statments and it can now be disabled at build time.
+
+        * Shared/OriginAndDatabases.cpp:
+        * Shared/OriginAndDatabases.h:
+        * Shared/WebCoreArgumentCoders.cpp:
+        (CoreIPC):
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextGetDatabaseManager):
+        * UIProcess/API/C/WKDatabaseManager.cpp:
+        (WKDatabaseManagerGetTypeID):
+        (WKDatabaseManagerGetOriginKey):
+        (WKDatabaseManagerGetOriginQuotaKey):
+        (WKDatabaseManagerGetOriginUsageKey):
+        (WKDatabaseManagerGetDatabaseDetailsKey):
+        (WKDatabaseManagerGetDatabaseDetailsNameKey):
+        (WKDatabaseManagerGetDatabaseDetailsDisplayNameKey):
+        (WKDatabaseManagerGetDatabaseDetailsExpectedUsageKey):
+        (WKDatabaseManagerGetDatabaseDetailsCurrentUsageKey):
+        (WKDatabaseManagerSetClient):
+        (WKDatabaseManagerGetDatabasesByOrigin):
+        (callGetDatabasesByOriginBlockAndDispose):
+        (WKDatabaseManagerGetDatabasesByOrigin_b):
+        (WKDatabaseManagerGetDatabaseOrigins):
+        (callGetDatabaseOriginsBlockBlockAndDispose):
+        (WKDatabaseManagerGetDatabaseOrigins_b):
+        (WKDatabaseManagerDeleteDatabasesWithNameForOrigin):
+        (WKDatabaseManagerDeleteDatabasesForOrigin):
+        (WKDatabaseManagerDeleteAllDatabases):
+        (WKDatabaseManagerSetQuotaForOrigin):
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::~WebContext):
+        (WebKit::WebContext::shouldTerminate):
+        (WebKit::WebContext::disconnectProcess):
+        (WebKit::WebContext::didReceiveMessage):
+        * UIProcess/WebContext.h:
+        (WebContext):
+        * UIProcess/WebDatabaseManagerProxy.cpp:
+        * UIProcess/WebDatabaseManagerProxy.h:
+        * UIProcess/WebDatabaseManagerProxy.messages.in:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::clearAllDatabases):
+        (WebKit::InjectedBundle::setDatabaseQuota):
+        * WebProcess/WebCoreSupport/WebDatabaseManager.cpp:
+        * WebProcess/WebCoreSupport/WebDatabaseManager.h:
+        * WebProcess/WebCoreSupport/WebDatabaseManager.messages.in:
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::didReceiveMessage):
+
 2012-07-23  Kent Tamura  <tkent@chromium.org>
 
         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index dedcb83f2..49182f3a0 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -37,15 +37,16 @@ ENABLE_ANIMATION_API = ;
 ENABLE_BLOB = ENABLE_BLOB;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_CSP_NEXT = ;
-ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
-ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
+ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
+ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
+ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
 ENABLE_DASHBOARD_SUPPORT_macosx = ENABLE_DASHBOARD_SUPPORT;
@@ -135,4 +136,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/Configurations/Version.xcconfig b/Source/WebKit2/Configurations/Version.xcconfig
index c2637aa45..a80c98ad7 100644
--- a/Source/WebKit2/Configurations/Version.xcconfig
+++ b/Source/WebKit2/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit2/GNUmakefile.list.am b/Source/WebKit2/GNUmakefile.list.am
index cfae2d707..ca81d4707 100644
--- a/Source/WebKit2/GNUmakefile.list.am
+++ b/Source/WebKit2/GNUmakefile.list.am
@@ -374,7 +374,6 @@ webkit2_sources += \
 	Source/WebKit2/Shared/gtk/NativeWebWheelEventGtk.cpp \
 	Source/WebKit2/Shared/gtk/PrintInfoGtk.cpp \
 	Source/WebKit2/Shared/gtk/ProcessExecutablePathGtk.cpp \
-	Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp \
 	Source/WebKit2/Shared/gtk/WebEventFactory.cpp \
 	Source/WebKit2/Shared/gtk/WebEventFactory.h \
 	Source/WebKit2/Shared/ImageOptions.h \
@@ -431,6 +430,7 @@ webkit2_sources += \
 	Source/WebKit2/Shared/soup/PlatformCertificateInfo.cpp \
 	Source/WebKit2/Shared/soup/PlatformCertificateInfo.h \
 	Source/WebKit2/Shared/soup/SoupCookiePersistentStorageType.h \
+	Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp \
 	Source/WebKit2/Shared/TextCheckerState.h \
 	Source/WebKit2/Shared/UserMessageCoders.h \
 	Source/WebKit2/Shared/UpdateInfo.cpp \
@@ -469,6 +469,10 @@ webkit2_sources += \
 	Source/WebKit2/Shared/WebHitTestResult.h \
 	Source/WebKit2/Shared/WebImage.cpp \
 	Source/WebKit2/Shared/WebImage.h \
+	Source/WebKit2/Shared/WebIntentData.cpp \
+	Source/WebKit2/Shared/WebIntentData.h \
+	Source/WebKit2/Shared/WebIntentServiceInfo.cpp \
+	Source/WebKit2/Shared/WebIntentServiceInfo.h \
 	Source/WebKit2/Shared/WebKeyboardEvent.cpp \
 	Source/WebKit2/Shared/WebMouseEvent.cpp \
 	Source/WebKit2/Shared/WebNavigationDataStore.h \
@@ -867,10 +871,6 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebIconDatabaseClient.h \
 	Source/WebKit2/UIProcess/WebInspectorProxy.cpp \
 	Source/WebKit2/UIProcess/WebInspectorProxy.h \
-	Source/WebKit2/UIProcess/WebIntentData.cpp \
-	Source/WebKit2/UIProcess/WebIntentData.h \
-	Source/WebKit2/UIProcess/WebIntentServiceInfo.cpp \
-	Source/WebKit2/UIProcess/WebIntentServiceInfo.h \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebKeyValueStorageManagerProxy.h \
 	Source/WebKit2/UIProcess/WebMediaCacheManagerProxy.cpp \
@@ -1242,13 +1242,13 @@ webkit2_plugin_process_sources += \
 	Source/WebKit2/Shared/WebKeyboardEvent.cpp \
 	Source/WebKit2/Shared/WebMouseEvent.cpp \
 	Source/WebKit2/Shared/WebWheelEvent.cpp \
-	Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp \
 	Source/WebKit2/Shared/gtk/NativeWebKeyboardEventGtk.cpp \
 	Source/WebKit2/Shared/gtk/NativeWebWheelEventGtk.cpp \
 	Source/WebKit2/Shared/gtk/NativeWebMouseEventGtk.cpp \
 	Source/WebKit2/Shared/gtk/ProcessExecutablePathGtk.cpp \
 	Source/WebKit2/Shared/gtk/WebEventFactory.cpp \
 	Source/WebKit2/Shared/cairo/ShareableBitmapCairo.cpp \
+	Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp \
 	Source/WebKit2/UIProcess/Plugins/gtk/PluginProcessProxyGtk.cpp \
 	Source/WebKit2/WebProcess/Plugins/Plugin.cpp \
 	Source/WebKit2/WebProcess/Plugins/Plugin.h \
diff --git a/Source/WebKit2/Platform/CoreIPC/Connection.h b/Source/WebKit2/Platform/CoreIPC/Connection.h
index 773f6e0d1..da9a08a3c 100644
--- a/Source/WebKit2/Platform/CoreIPC/Connection.h
+++ b/Source/WebKit2/Platform/CoreIPC/Connection.h
@@ -43,7 +43,9 @@
 #elif PLATFORM(WIN)
 #include <string>
 #elif PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QSocketNotifier;
+QT_END_NAMESPACE
 #endif
 
 #if PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
diff --git a/Source/WebKit2/Platform/PlatformProcessIdentifier.h b/Source/WebKit2/Platform/PlatformProcessIdentifier.h
index 96ecbe872..2d1897510 100644
--- a/Source/WebKit2/Platform/PlatformProcessIdentifier.h
+++ b/Source/WebKit2/Platform/PlatformProcessIdentifier.h
@@ -28,7 +28,9 @@
 #define PlatformProcessIdentifier_h
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QProcess;
+QT_END_NAMESPACE
 #elif PLATFORM(EFL)
 #include <unistd.h>
 #endif
diff --git a/Source/WebKit2/Platform/WorkQueue.h b/Source/WebKit2/Platform/WorkQueue.h
index d630dc028..5ff7d39cc 100644
--- a/Source/WebKit2/Platform/WorkQueue.h
+++ b/Source/WebKit2/Platform/WorkQueue.h
@@ -47,8 +47,10 @@
 
 #if PLATFORM(QT) && !OS(DARWIN)
 #include <QSocketNotifier>
+QT_BEGIN_NAMESPACE
 class QObject;
 class QThread;
+QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 #include <wtf/gobject/GRefPtr.h>
 typedef gboolean (*GSourceFunc) (gpointer data);
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index 97f7095a6..316006e15 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -1,4 +1,5 @@
 LIST(APPEND WebKit2_LINK_FLAGS
+    ${CAIRO_LDFLAGS}
     ${ECORE_X_LDFLAGS}
     ${EDJE_LDFLAGS}
     ${EFLDEPS_LDFLAGS}
@@ -24,10 +25,11 @@ LIST(APPEND WebKit2_SOURCES
     Shared/efl/NativeWebKeyboardEventEfl.cpp
     Shared/efl/NativeWebWheelEventEfl.cpp
     Shared/efl/NativeWebMouseEventEfl.cpp
+    Shared/efl/ProcessExecutablePathEfl.cpp
     Shared/efl/WebEventFactory.cpp
-    Shared/efl/WebCoreArgumentCodersEfl.cpp
 
     Shared/soup/PlatformCertificateInfo.cpp
+    Shared/soup/WebCoreArgumentCodersSoup.cpp
 
     UIProcess/API/C/efl/WKView.cpp
 
@@ -37,12 +39,14 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/API/efl/BatteryProvider.cpp
     UIProcess/API/efl/PageClientImpl.cpp
     UIProcess/API/efl/ewk_context.cpp
+    UIProcess/API/efl/ewk_context_request_manager_client.cpp
     UIProcess/API/efl/ewk_cookie_manager.cpp
     UIProcess/API/efl/ewk_intent.cpp
     UIProcess/API/efl/ewk_intent_service.cpp
     UIProcess/API/efl/ewk_navigation_policy_decision.cpp
     UIProcess/API/efl/ewk_url_request.cpp
     UIProcess/API/efl/ewk_url_response.cpp
+    UIProcess/API/efl/ewk_url_scheme_request.cpp
     UIProcess/API/efl/ewk_view.cpp
     UIProcess/API/efl/ewk_view_loader_client.cpp
     UIProcess/API/efl/ewk_view_policy_client.cpp
@@ -179,6 +183,7 @@ SET (EWebKit2_HEADERS
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_navigation_policy_decision.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_url_request.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_url_response.h"
+    "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_url_scheme_request.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_view.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_web_error.h"
     "${CMAKE_CURRENT_SOURCE_DIR}/UIProcess/API/efl/ewk_web_resource.h"
@@ -194,9 +199,11 @@ SET(EWK2UnitTests_LIBRARIES
     ${JavaScriptCore_LIBRARY_NAME}
     ${WebCore_LIBRARY_NAME}
     ${WebKit2_LIBRARY_NAME}
+    ${CAIRO_LIBRARIES}
     ${ECORE_LIBRARIES}
     ${ECORE_EVAS_LIBRARIES}
     ${EVAS_LIBRARIES}
+    ${LIBSOUP24_LIBRARIES}
     gtest
 )
 
@@ -213,12 +220,16 @@ SET(TEST_RESOURCES_DIR ${WEBKIT2_EFL_TEST_DIR}/resources)
 ADD_DEFINITIONS(-DTEST_RESOURCES_DIR=\"${TEST_RESOURCES_DIR}\"
     -DTEST_THEME_DIR=\"${THEME_BINARY_DIR}\"
     -DGTEST_LINKED_AS_SHARED_LIBRARY=1
+    -DLIBEXECDIR=\"${CMAKE_INSTALL_PREFIX}/${EXEC_INSTALL_DIR}\"
+    -DWEBPROCESSNAME=\"${WebProcess_EXECUTABLE_NAME}\"
+    -DPLUGINPROCESSNAME=\"${PluginProcess_EXECUTABLE_NAME}\"
 )
 
 ADD_LIBRARY(ewk2UnitTestUtils
     ${WEBKIT2_EFL_TEST_DIR}/UnitTestUtils/EWK2UnitTestBase.cpp
     ${WEBKIT2_EFL_TEST_DIR}/UnitTestUtils/EWK2UnitTestEnvironment.cpp
     ${WEBKIT2_EFL_TEST_DIR}/UnitTestUtils/EWK2UnitTestMain.cpp
+    ${WEBKIT2_EFL_TEST_DIR}/UnitTestUtils/EWK2UnitTestServer.cpp
 )
 
 TARGET_LINK_LIBRARIES(ewk2UnitTestUtils ${EWK2UnitTests_LIBRARIES})
@@ -226,6 +237,7 @@ TARGET_LINK_LIBRARIES(ewk2UnitTestUtils ${EWK2UnitTests_LIBRARIES})
 # The "ewk" on the test name needs to be suffixed with "2", otherwise it
 # will clash with tests from the WebKit 1 test suite.
 SET(EWK2UnitTests_BINARIES
+    test_ewk2_cookie_manager
     test_ewk2_view
 )
 
diff --git a/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.cpp b/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.cpp
deleted file mode 100755
index 9a3e9fcc5..000000000
--- a/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#include "config.h"
-#include "WKURLRequestEfl.h"
-
-#include "WKAPICast.h"
-#include "WebURLRequestEfl.h"
-
-using namespace WebKit;
-
-WKStringRef WKURLRequestEflCopyCookies(WKURLRequestRef requestRef)
-{
-    RefPtr<WebURLRequestEfl> requestEfl = WebURLRequestEfl::create(toImpl(requestRef));
-    return toCopiedAPI(requestEfl->cookies());
-}
diff --git a/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.h b/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.h
deleted file mode 100755
index 62688dd54..000000000
--- a/Source/WebKit2/Shared/API/c/efl/WKURLRequestEfl.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#ifndef WKURLRequestEfl_h
-#define WKURLRequestEfl_h
-
-#include <WebKit2/WKBase.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-WK_EXPORT WKStringRef WKURLRequestEflCopyCookies(WKURLRequestRef);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* WKURLRequestEfl_h */
diff --git a/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.cpp b/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.cpp
deleted file mode 100755
index abe01d77b..000000000
--- a/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.cpp
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#include "config.h"
-#include "WKURLResponseEfl.h"
-
-#include "WKAPICast.h"
-#include "WebURLResponseEfl.h"
-
-using namespace WebKit;
-
-WKStringRef WKURLResponseEflCopyContentType(WKURLResponseRef responseRef)
-{
-    RefPtr<WebURLResponseEfl> responseEfl = WebURLResponseEfl::create(toImpl(responseRef));
-    return toCopiedAPI(responseEfl->contentType());
-}
diff --git a/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.h b/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.h
deleted file mode 100755
index bae655c64..000000000
--- a/Source/WebKit2/Shared/API/c/efl/WKURLResponseEfl.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#ifndef WKURLResponseEfl_h
-#define WKURLResponseEfl_h
-
-#include <WebKit2/WKBase.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-WK_EXPORT WKStringRef WKURLResponseEflCopyContentType(WKURLResponseRef);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* WKURLResponseEfl_h */
diff --git a/Source/WebKit2/Shared/APIClientTraits.h b/Source/WebKit2/Shared/APIClientTraits.h
index d218078c6..e2cce1781 100644
--- a/Source/WebKit2/Shared/APIClientTraits.h
+++ b/Source/WebKit2/Shared/APIClientTraits.h
@@ -38,7 +38,7 @@ template <typename ClientInterface> struct APIClientTraits {
 template <typename ClientInterface> const size_t APIClientTraits<ClientInterface>::interfaceSizesByVersion[] = { sizeof(ClientInterface) };
 
 template<> struct APIClientTraits<WKBundlePageLoaderClient> {
-    static const size_t interfaceSizesByVersion[3];
+    static const size_t interfaceSizesByVersion[4];
 };
 
 template<> struct APIClientTraits<WKBundlePageResourceLoadClient> {
diff --git a/Source/WebKit2/Shared/OriginAndDatabases.cpp b/Source/WebKit2/Shared/OriginAndDatabases.cpp
index ab09581af..0ad0549ad 100644
--- a/Source/WebKit2/Shared/OriginAndDatabases.cpp
+++ b/Source/WebKit2/Shared/OriginAndDatabases.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "OriginAndDatabases.h"
 
+#if ENABLE(SQL_DATABASE)
+
 #include "WebCoreArgumentCoders.h"
 
 using namespace WebCore;
@@ -55,3 +57,5 @@ bool OriginAndDatabases::decode(CoreIPC::ArgumentDecoder* decoder, OriginAndData
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit2/Shared/OriginAndDatabases.h b/Source/WebKit2/Shared/OriginAndDatabases.h
index 03f7261d8..51ef4fae7 100644
--- a/Source/WebKit2/Shared/OriginAndDatabases.h
+++ b/Source/WebKit2/Shared/OriginAndDatabases.h
@@ -26,6 +26,8 @@
 #ifndef OriginAndDatabases_h
 #define OriginAndDatabases_h
 
+#if ENABLE(SQL_DATABASE)
+
 #include <WebCore/DatabaseDetails.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
@@ -49,4 +51,6 @@ struct OriginAndDatabases {
 
 } // namespace WebKit
 
+#endif // ENABLE(SQL_DATABASE)
+
 #endif // OriginAndDatabases_h
diff --git a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
index 542fd3ff8..9b0448ae8 100644
--- a/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
+++ b/Source/WebKit2/Shared/WebCoreArgumentCoders.cpp
@@ -495,7 +495,7 @@ bool ArgumentCoder<CompositionUnderline>::decode(ArgumentDecoder* decoder, Compo
     return true;
 }
 
-
+#if ENABLE(SQL_DATABASE)
 void ArgumentCoder<DatabaseDetails>::encode(ArgumentEncoder* encoder, const DatabaseDetails& details)
 {
     encoder->encode(details.name());
@@ -525,6 +525,7 @@ bool ArgumentCoder<DatabaseDetails>::decode(ArgumentDecoder* decoder, DatabaseDe
     details = DatabaseDetails(name, displayName, expectedUsage, currentUsage);
     return true;
 }
+#endif
 
 void ArgumentCoder<DictationAlternative>::encode(ArgumentEncoder* encoder, const DictationAlternative& dictationAlternative)
 {
diff --git a/Source/WebKit2/UIProcess/WebIntentData.cpp b/Source/WebKit2/Shared/WebIntentData.cpp
index 96128dbe2..96128dbe2 100644
--- a/Source/WebKit2/UIProcess/WebIntentData.cpp
+++ b/Source/WebKit2/Shared/WebIntentData.cpp
diff --git a/Source/WebKit2/UIProcess/WebIntentData.h b/Source/WebKit2/Shared/WebIntentData.h
index decf4ae4f..decf4ae4f 100644
--- a/Source/WebKit2/UIProcess/WebIntentData.h
+++ b/Source/WebKit2/Shared/WebIntentData.h
diff --git a/Source/WebKit2/UIProcess/WebIntentServiceInfo.cpp b/Source/WebKit2/Shared/WebIntentServiceInfo.cpp
index 84329c5e7..84329c5e7 100644
--- a/Source/WebKit2/UIProcess/WebIntentServiceInfo.cpp
+++ b/Source/WebKit2/Shared/WebIntentServiceInfo.cpp
diff --git a/Source/WebKit2/UIProcess/WebIntentServiceInfo.h b/Source/WebKit2/Shared/WebIntentServiceInfo.h
index 8694601f0..8694601f0 100644
--- a/Source/WebKit2/UIProcess/WebIntentServiceInfo.h
+++ b/Source/WebKit2/Shared/WebIntentServiceInfo.h
diff --git a/Source/WebKit2/Shared/efl/ProcessExecutablePathEfl.cpp b/Source/WebKit2/Shared/efl/ProcessExecutablePathEfl.cpp
new file mode 100644
index 000000000..618ab2a14
--- /dev/null
+++ b/Source/WebKit2/Shared/efl/ProcessExecutablePathEfl.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProcessExecutablePath.h"
+
+#include "FileSystem.h"
+#include <libgen.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/CString.h>
+
+namespace WebKit {
+
+static String findProcessPath(const char* processName)
+{
+#if OS(UNIX)
+    char readLinkBuffer[PATH_MAX] = {0};
+
+#if OS(LINUX)
+    ssize_t result = readlink("/proc/self/exe", readLinkBuffer, PATH_MAX);
+#else
+    ssize_t result = readlink("/proc/curproc/file", readLinkBuffer, PATH_MAX);
+#endif
+    if (result > 0) {
+        char* executablePathPtr = dirname(readLinkBuffer);
+        String executablePath = WebCore::pathByAppendingComponent(String(executablePathPtr), processName);
+
+        // Checks whether process exist on the current path.
+        struct stat fileStat;
+        if (!stat(executablePath.utf8().data(), &fileStat))
+            return executablePath;
+    }
+#endif
+
+    return WebCore::pathByAppendingComponent(String(LIBEXECDIR), processName);
+}
+
+String executablePathOfWebProcess()
+{
+    DEFINE_STATIC_LOCAL(const String, webKitWebProcessName, (findProcessPath(WEBPROCESSNAME)));
+
+    return webKitWebProcessName;
+}
+
+String executablePathOfPluginProcess()
+{
+    DEFINE_STATIC_LOCAL(const String, webKitPluginProcessName, (findProcessPath(PLUGINPROCESSNAME)));
+
+    return webKitPluginProcessName;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit2/Shared/efl/WebCoreArgumentCodersEfl.cpp b/Source/WebKit2/Shared/efl/WebCoreArgumentCodersEfl.cpp
deleted file mode 100755
index a964883bb..000000000
--- a/Source/WebKit2/Shared/efl/WebCoreArgumentCodersEfl.cpp
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebCoreArgumentCoders.h"
-
-#include <WebCore/ResourceError.h>
-#include <WebCore/ResourceRequest.h>
-#include <WebCore/ResourceResponse.h>
-
-using namespace WebCore;
-
-namespace CoreIPC {
-
-void ArgumentCoder<ResourceRequest>::encode(ArgumentEncoder* encoder, const ResourceRequest& resourceRequest)
-{
-    encoder->encode(resourceRequest.url().string());
-    encoder->encode(resourceRequest.httpHeaderField("Cookie"));
-}
-
-bool ArgumentCoder<ResourceRequest>::decode(ArgumentDecoder* decoder, ResourceRequest& resourceRequest)
-{
-    ResourceRequest request;
-
-    String url;
-    if (!decoder->decode(url))
-        return false;
-    request.setURL(KURL(KURL(), url));
-
-    String cookie;
-    if (!decoder->decode(cookie))
-        return false;
-    request.setHTTPHeaderField("Cookie", cookie);
-
-    resourceRequest = request;
-    return true;
-}
-
-
-void ArgumentCoder<ResourceResponse>::encode(ArgumentEncoder* encoder, const ResourceResponse& resourceResponse)
-{
-    encoder->encode(resourceResponse.mimeType());
-}
-
-bool ArgumentCoder<ResourceResponse>::decode(ArgumentDecoder* decoder, ResourceResponse& resourceResponse)
-{
-    ResourceResponse response;
-
-    String mimeType;
-    if (!decoder->decode(mimeType))
-        return false;
-    response.setMimeType(mimeType);
-
-    resourceResponse = response;
-    return true;
-}
-
-
-void ArgumentCoder<ResourceError>::encode(ArgumentEncoder* encoder, const ResourceError& resourceError)
-{
-    encoder->encode(resourceError.domain());
-    encoder->encode(resourceError.errorCode());
-    encoder->encode(resourceError.failingURL());
-    encoder->encode(resourceError.localizedDescription());
-}
-
-bool ArgumentCoder<ResourceError>::decode(ArgumentDecoder* decoder, ResourceError& resourceError)
-{
-    String domain;
-    if (!decoder->decode(domain))
-        return false;
-
-    int errorCode;
-    if (!decoder->decode(errorCode))
-        return false;
-
-    String failingURL;
-    if (!decoder->decode(failingURL))
-        return false;
-
-    String localizedDescription;
-    if (!decoder->decode(localizedDescription))
-        return false;
-
-    resourceError = ResourceError(domain, errorCode, failingURL, localizedDescription);
-    return true;
-}
-
-} // namespace CoreIPC
diff --git a/Source/WebKit2/Shared/efl/WebURLRequestEfl.cpp b/Source/WebKit2/Shared/efl/WebURLRequestEfl.cpp
deleted file mode 100755
index 2a498c441..000000000
--- a/Source/WebKit2/Shared/efl/WebURLRequestEfl.cpp
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebURLRequestEfl.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-WebURLRequestEfl::WebURLRequestEfl(const WebURLRequest* request)
-    : m_request(request)
-{
-}
-
-const String WebURLRequestEfl::cookies() const
-{
-    if (!m_request)
-        return String();
-
-    return m_request->resourceRequest().httpHeaderField("Cookie");
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/Shared/efl/WebURLRequestEfl.h b/Source/WebKit2/Shared/efl/WebURLRequestEfl.h
deleted file mode 100755
index 8057db28f..000000000
--- a/Source/WebKit2/Shared/efl/WebURLRequestEfl.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#ifndef WebURLRequestEfl_h
-#define WebURLRequestEfl_h
-
-#include "WebURLRequest.h"
-#include <wtf/Forward.h>
-#include <wtf/RefCounted.h>
-
-namespace WebKit {
-
-class WebURLRequestEfl : public RefCounted<WebURLRequestEfl> {
-public:
-    static PassRefPtr<WebURLRequestEfl> create(const WebURLRequest* request)
-    {
-        return adoptRef(new WebURLRequestEfl(request));
-    }
-
-    const String cookies() const;
-
-private:
-    explicit WebURLRequestEfl(const WebURLRequest*);
-
-    const WebURLRequest* m_request;
-};
-
-} // namespace WebKit
-
-#endif // WebURLRequestEfl_h
diff --git a/Source/WebKit2/Shared/efl/WebURLResponseEfl.cpp b/Source/WebKit2/Shared/efl/WebURLResponseEfl.cpp
deleted file mode 100755
index 55128a420..000000000
--- a/Source/WebKit2/Shared/efl/WebURLResponseEfl.cpp
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#include "config.h"
-#include "WebURLResponseEfl.h"
-
-namespace WebKit {
-
-WebURLResponseEfl::WebURLResponseEfl(const WebURLResponse* response)
-    : m_response(response)
-{
-}
-
-const String& WebURLResponseEfl::contentType() const
-{
-    if (!m_response)
-        return String();
-
-    return m_response->resourceResponse().mimeType();
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit2/Shared/efl/WebURLResponseEfl.h b/Source/WebKit2/Shared/efl/WebURLResponseEfl.h
deleted file mode 100755
index 1193a8023..000000000
--- a/Source/WebKit2/Shared/efl/WebURLResponseEfl.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2012 Samsung Electronics
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
- * Boston, MA  02110-1301, USA.
- */
-
-#ifndef WebURLResponseEfl_h
-#define WebURLResponseEfl_h
-
-#include "WebURLResponse.h"
-#include <wtf/Forward.h>
-#include <wtf/RefCounted.h>
-
-namespace WebKit {
-
-class WebURLResponseEfl : public RefCounted<WebURLResponseEfl> {
-public:
-    static PassRefPtr<WebURLResponseEfl> create(const WebURLResponse* response)
-    {
-        return adoptRef(new WebURLResponseEfl(response));
-    }
-
-    const String& contentType() const;
-
-private:
-    explicit WebURLResponseEfl(const WebURLResponse*);
-
-    const WebURLResponse* m_response;
-};
-
-} // namespace WebKit
-
-#endif // WebURLResponseEfl_h
diff --git a/Source/WebKit2/Shared/qt/QtNetworkRequestData.h b/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
index 940bf815f..9bcaac767 100644
--- a/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
+++ b/Source/WebKit2/Shared/qt/QtNetworkRequestData.h
@@ -34,8 +34,10 @@ class ArgumentEncoder;
 class ArgumentDecoder;
 };
 
+QT_BEGIN_NAMESPACE
 class QNetworkRequest;
 class QNetworkReply;
+QT_END_NAMESPACE
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/Shared/qt/WebEventFactoryQt.h b/Source/WebKit2/Shared/qt/WebEventFactoryQt.h
index deecc25d4..f1c24fb00 100644
--- a/Source/WebKit2/Shared/qt/WebEventFactoryQt.h
+++ b/Source/WebKit2/Shared/qt/WebEventFactoryQt.h
@@ -29,6 +29,8 @@
 
 #include "WebEvent.h"
 
+QT_BEGIN_NAMESPACE
+
 #if ENABLE(TOUCH_EVENTS)
 class QTouchEvent;
 #endif
@@ -37,6 +39,8 @@ class QMouseEvent;
 class QWheelEvent;
 class QKeyEvent;
 
+QT_END_NAMESPACE
+
 namespace WebKit {
 
 class WebEventFactory {
diff --git a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp b/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp
index 9d6e25c66..dbe2c51cd 100644
--- a/Source/WebKit2/Shared/gtk/WebCoreArgumentCodersGtk.cpp
+++ b/Source/WebKit2/Shared/soup/WebCoreArgumentCodersSoup.cpp
@@ -27,10 +27,10 @@
 #include "config.h"
 #include "WebCoreArgumentCoders.h"
 
-#include <wtf/text/CString.h>
 #include <WebCore/ResourceError.h>
 #include <WebCore/ResourceRequest.h>
 #include <WebCore/ResourceResponse.h>
+#include <wtf/text/CString.h>
 
 using namespace WebCore;
 
@@ -190,7 +190,7 @@ void ArgumentCoder<ResourceError>::encode(ArgumentEncoder* encoder, const Resour
 
     encoder->encode(resourceError.domain());
     encoder->encode(resourceError.errorCode());
-    encoder->encode(resourceError.failingURL()); 
+    encoder->encode(resourceError.failingURL());
     encoder->encode(resourceError.localizedDescription());
 }
 
@@ -219,9 +219,10 @@ bool ArgumentCoder<ResourceError>::decode(ArgumentDecoder* decoder, ResourceErro
     String localizedDescription;
     if (!decoder->decode(localizedDescription))
         return false;
-    
+
     resourceError = ResourceError(domain, errorCode, failingURL, localizedDescription);
     return true;
 }
 
 }
+
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index 80e5a651c..e80967278 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -112,6 +112,8 @@ HEADERS += \
     Shared/WebGraphicsContext.h \
     Shared/WebHitTestResult.h \
     Shared/WebImage.h \
+    Shared/WebIntentData.h \
+    Shared/WebIntentServiceInfo.h \
     Shared/WebLayerTreeInfo.h \
     Shared/WebNavigationDataStore.h \
     Shared/WebNumber.h \
@@ -265,8 +267,6 @@ HEADERS += \
     UIProcess/WebIconDatabase.h \
     UIProcess/WebIconDatabaseClient.h \
     UIProcess/WebInspectorProxy.h \
-    UIProcess/WebIntentData.h \
-    UIProcess/WebIntentServiceInfo.h \
     UIProcess/WebKeyValueStorageManagerProxy.h \
     UIProcess/WebLayerTreeRenderer.h \
     UIProcess/WebLoaderClient.h \
@@ -492,6 +492,8 @@ SOURCES += \
     Shared/WebHitTestResult.cpp \
     Shared/WebKeyboardEvent.cpp \
     Shared/WebImage.cpp \
+    Shared/WebIntentData.cpp \
+    Shared/WebIntentServiceInfo.cpp \
     Shared/WebLayerTreeInfo.cpp \
     Shared/WebMouseEvent.cpp \
     Shared/WebNetworkInfo.cpp \
@@ -633,8 +635,6 @@ SOURCES += \
     UIProcess/WebIconDatabase.cpp \
     UIProcess/WebIconDatabaseClient.cpp \
     UIProcess/WebInspectorProxy.cpp \
-    UIProcess/WebIntentData.cpp \
-    UIProcess/WebIntentServiceInfo.cpp \
     UIProcess/WebKeyValueStorageManagerProxy.cpp \
     UIProcess/WebLayerTreeRenderer.cpp \
     UIProcess/WebLoaderClient.cpp \
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.cpp b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
index d168363e8..7fadf3087 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
@@ -181,7 +181,11 @@ WKBatteryManagerRef WKContextGetBatteryManager(WKContextRef contextRef)
 
 WKDatabaseManagerRef WKContextGetDatabaseManager(WKContextRef contextRef)
 {
+#if ENABLE(SQL_DATABASE)
     return toAPI(toImpl(contextRef)->databaseManagerProxy());
+#else
+    return 0;
+#endif
 }
 
 WKGeolocationManagerRef WKContextGetGeolocationManager(WKContextRef contextRef)
diff --git a/Source/WebKit2/UIProcess/API/C/WKDatabaseManager.cpp b/Source/WebKit2/UIProcess/API/C/WKDatabaseManager.cpp
index 8075a1c0d..4f9496878 100644
--- a/Source/WebKit2/UIProcess/API/C/WKDatabaseManager.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKDatabaseManager.cpp
@@ -37,118 +37,176 @@ using namespace WebKit;
 
 WKTypeID WKDatabaseManagerGetTypeID()
 {
+#if ENABLE(SQL_DATABASE)
     return toAPI(WebDatabaseManagerProxy::APIType);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetOriginKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::originKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetOriginQuotaKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::originQuotaKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetOriginUsageKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::originUsageKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetDatabaseDetailsKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::databaseDetailsKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetDatabaseDetailsNameKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::databaseDetailsNameKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetDatabaseDetailsDisplayNameKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::databaseDetailsDisplayNameKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetDatabaseDetailsExpectedUsageKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::databaseDetailsExpectedUsageKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 WKStringRef WKDatabaseManagerGetDatabaseDetailsCurrentUsageKey()
 {
+#if ENABLE(SQL_DATABASE)
     static WebString* key = WebString::create(WebDatabaseManagerProxy::databaseDetailsCurrentUsageKey()).leakRef();
     return toAPI(key);
+#else
+    return 0;
+#endif
 }
 
 void WKDatabaseManagerSetClient(WKDatabaseManagerRef databaseManagerRef, const WKDatabaseManagerClient* wkClient)
 {
+#if ENABLE(SQL_DATABASE)
     if (wkClient && wkClient->version)
         return;
     toImpl(databaseManagerRef)->initializeClient(wkClient);
+#endif
 }
 
 void WKDatabaseManagerGetDatabasesByOrigin(WKDatabaseManagerRef databaseManagerRef, void* context, WKDatabaseManagerGetDatabasesByOriginFunction callback)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->getDatabasesByOrigin(ArrayCallback::create(context, callback));
+#endif
 }
 
 #ifdef __BLOCKS__
 static void callGetDatabasesByOriginBlockAndDispose(WKArrayRef resultValue, WKErrorRef errorRef, void* context)
 {
+#if ENABLE(SQL_DATABASE)
     WKDatabaseManagerGetDatabasesByOriginBlock block = (WKDatabaseManagerGetDatabasesByOriginBlock)context;
     block(resultValue, errorRef);
     Block_release(block);
+#endif
 }
 
 void WKDatabaseManagerGetDatabasesByOrigin_b(WKDatabaseManagerRef databaseManagerRef, WKDatabaseManagerGetDatabasesByOriginBlock block)
 {
+#if ENABLE(SQL_DATABASE)
     WKDatabaseManagerGetDatabasesByOrigin(databaseManagerRef, Block_copy(block), callGetDatabasesByOriginBlockAndDispose);
-}
 #endif
+}
+#endif // __BLOCKS__
 
 void WKDatabaseManagerGetDatabaseOrigins(WKDatabaseManagerRef databaseManagerRef, void* context, WKDatabaseManagerGetDatabaseOriginsFunction callback)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->getDatabaseOrigins(ArrayCallback::create(context, callback));
+#endif
 }
 
 #ifdef __BLOCKS__
 static void callGetDatabaseOriginsBlockBlockAndDispose(WKArrayRef resultValue, WKErrorRef errorRef, void* context)
 {
+#if ENABLE(SQL_DATABASE)
     WKDatabaseManagerGetDatabaseOriginsBlock block = (WKDatabaseManagerGetDatabaseOriginsBlock)context;
     block(resultValue, errorRef);
     Block_release(block);
+#endif
 }
 
 void WKDatabaseManagerGetDatabaseOrigins_b(WKDatabaseManagerRef databaseManagerRef, WKDatabaseManagerGetDatabaseOriginsBlock block)
 {
+#if ENABLE(SQL_DATABASE)
     WKDatabaseManagerGetDatabaseOrigins(databaseManagerRef, Block_copy(block), callGetDatabaseOriginsBlockBlockAndDispose);
-}
 #endif
+}
+#endif // __BLOCKS__
 
 void WKDatabaseManagerDeleteDatabasesWithNameForOrigin(WKDatabaseManagerRef databaseManagerRef, WKStringRef databaseNameRef, WKSecurityOriginRef originRef)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->deleteDatabaseWithNameForOrigin(toWTFString(databaseNameRef), toImpl(originRef));
+#endif
 }
 
 void WKDatabaseManagerDeleteDatabasesForOrigin(WKDatabaseManagerRef databaseManagerRef, WKSecurityOriginRef originRef)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->deleteDatabasesForOrigin(toImpl(originRef));
+#endif
 }
 
 void WKDatabaseManagerDeleteAllDatabases(WKDatabaseManagerRef databaseManagerRef)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->deleteAllDatabases();
+#endif
 }
 
 void WKDatabaseManagerSetQuotaForOrigin(WKDatabaseManagerRef databaseManagerRef, WKSecurityOriginRef originRef, uint64_t quota)
 {
+#if ENABLE(SQL_DATABASE)
     toImpl(databaseManagerRef)->setQuotaForOrigin(toImpl(originRef), quota);
+#endif
 }
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 12a7b63e9..fdacf8b4d 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -73,8 +73,8 @@ typedef bool (*WKPageShouldGoToBackForwardListItemCallback)(WKPageRef page, WKBa
 typedef void (*WKPageDidNewFirstVisuallyNonEmptyLayoutCallback)(WKPageRef page, WKTypeRef userData, const void *clientInfo);
 typedef void (*WKPageWillGoToBackForwardListItemCallback)(WKPageRef page, WKBackForwardListItemRef item, WKTypeRef userData, const void *clientInfo);
 typedef void (*WKPagePluginDidFailCallback)(WKPageRef page, WKErrorCode errorCode, WKStringRef mimeType, WKStringRef pluginIdentifier, WKStringRef pluginVersion, const void* clientInfo);
-typedef void (*WKPageDidReceiveIntentForFrameCallback)(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent, const void *clientInfo);
-typedef void (*WKPageRegisterIntentServiceForFrameCallback)(WKPageRef page, WKFrameRef frame, WKIntentServiceInfoRef serviceInfo, const void *clientInfo);
+typedef void (*WKPageDidReceiveIntentForFrameCallback)(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent, WKTypeRef userData, const void *clientInfo);
+typedef void (*WKPageRegisterIntentServiceForFrameCallback)(WKPageRef page, WKFrameRef frame, WKIntentServiceInfoRef serviceInfo, WKTypeRef userData, const void *clientInfo);
 
 // Deprecated
 typedef void (*WKPageDidFailToInitializePluginCallback_deprecatedForUseWithV0)(WKPageRef page, WKStringRef mimeType, const void* clientInfo);
diff --git a/Source/WebKit2/UIProcess/API/C/qt/WKNativeEvent.h b/Source/WebKit2/UIProcess/API/C/qt/WKNativeEvent.h
index 78df4ac42..974db375f 100644
--- a/Source/WebKit2/UIProcess/API/C/qt/WKNativeEvent.h
+++ b/Source/WebKit2/UIProcess/API/C/qt/WKNativeEvent.h
@@ -29,7 +29,9 @@
 // a Qt specific WKNativeEvent.h file is needed because that the use of __APPLE__
 // in original WKNativeEvent.h file breaks Qt build in MacOS
 
+QT_BEGIN_NAMESPACE
 class QEvent;
+QT_END_NAMESPACE
 typedef const QEvent* WKNativeEventPtr;
 
 #endif /* WKNativeEvent_h */
diff --git a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
index d7d796368..597cf24cb 100644
--- a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
+++ b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
@@ -34,6 +34,7 @@
 #include "ewk_navigation_policy_decision.h"
 #include "ewk_url_request.h"
 #include "ewk_url_response.h"
+#include "ewk_url_scheme_request.h"
 #include "ewk_view.h"
 #include "ewk_web_error.h"
 #include "ewk_web_resource.h"
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
index 21c157c22..b8607e584 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
@@ -23,12 +23,34 @@
 
 #include "BatteryProvider.h"
 #include "WKAPICast.h"
+#include "WKContextSoup.h"
 #include "WKRetainPtr.h"
+#include "WKString.h"
 #include "ewk_context_private.h"
+#include "ewk_context_request_manager_client_private.h"
 #include "ewk_cookie_manager_private.h"
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
 
 using namespace WebKit;
 
+struct _Ewk_Url_Scheme_Handler {
+    Ewk_Url_Scheme_Request_Cb callback;
+    void* userData;
+
+    _Ewk_Url_Scheme_Handler()
+        : callback(0)
+        , userData(0)
+    { }
+
+    _Ewk_Url_Scheme_Handler(Ewk_Url_Scheme_Request_Cb callback, void* userData)
+        : callback(callback)
+        , userData(userData)
+    { }
+};
+
+typedef HashMap<String, _Ewk_Url_Scheme_Handler> URLSchemeHandlerMap;
+
 struct _Ewk_Context {
     WKRetainPtr<WKContextRef> context;
 
@@ -37,10 +59,21 @@ struct _Ewk_Context {
     RefPtr<BatteryProvider> batteryProvider;
 #endif
 
+    WKRetainPtr<WKSoupRequestManagerRef> requestManager;
+    URLSchemeHandlerMap urlSchemeHandlers;
+
     _Ewk_Context(WKContextRef contextRef)
         : context(contextRef)
         , cookieManager(0)
-    { }
+        , requestManager(WKContextGetSoupRequestManager(contextRef))
+    {
+#if ENABLE(BATTERY_STATUS)
+        WKBatteryManagerRef wkBatteryManager = WKContextGetBatteryManager(contextRef);
+        batteryProvider = BatteryProvider::create(wkBatteryManager);
+#endif
+
+        ewk_context_request_manager_client_attach(this);
+    }
 
     ~_Ewk_Context()
     {
@@ -64,17 +97,39 @@ WKContextRef ewk_context_WKContext_get(const Ewk_Context* ewkContext)
     return ewkContext->context.get();
 }
 
-static inline Ewk_Context* createDefaultEwkContext()
+/**
+ * @internal
+ * Retrieve the request manager for @a ewkContext.
+ *
+ * @param ewkContext a #Ewk_Context object.
+ */
+WKSoupRequestManagerRef ewk_context_request_manager_get(const Ewk_Context* ewkContext)
 {
-    WKContextRef wkContext = WKContextGetSharedProcessContext();
-    Ewk_Context* ewkContext = new Ewk_Context(wkContext);
+    return ewkContext->requestManager.get();
+}
 
-#if ENABLE(BATTERY_STATUS)
-    WKBatteryManagerRef wkBatteryManager = WKContextGetBatteryManager(wkContext);
-    ewkContext->batteryProvider = BatteryProvider::create(wkBatteryManager);
-#endif
+/**
+ * @internal
+ * A new URL request was received.
+ *
+ * @param ewkContext a #Ewk_Context object.
+ * @param schemeRequest a #Ewk_Url_Scheme_Request object.
+ */
+void ewk_context_url_scheme_request_received(Ewk_Context* ewkContext, Ewk_Url_Scheme_Request* schemeRequest)
+{
+    EINA_SAFETY_ON_NULL_RETURN(ewkContext);
+    EINA_SAFETY_ON_NULL_RETURN(schemeRequest);
+
+    _Ewk_Url_Scheme_Handler handler = ewkContext->urlSchemeHandlers.get(ewk_url_scheme_request_scheme_get(schemeRequest));
+    if (!handler.callback)
+        return;
+
+    handler.callback(schemeRequest, handler.userData);
+}
 
-    return ewkContext;
+static inline Ewk_Context* createDefaultEwkContext()
+{
+    return new Ewk_Context(WKContextGetSharedProcessContext());
 }
 
 Ewk_Context* ewk_context_default_get()
@@ -83,3 +138,16 @@ Ewk_Context* ewk_context_default_get()
 
     return defaultContext;
 }
+
+Eina_Bool ewk_context_uri_scheme_register(Ewk_Context* ewkContext, const char* scheme, Ewk_Url_Scheme_Request_Cb callback, void* userData)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(ewkContext, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(scheme, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(callback, false);
+
+    ewkContext->urlSchemeHandlers.set(String::fromUTF8(scheme), _Ewk_Url_Scheme_Handler(callback, userData));
+    WKRetainPtr<WKStringRef> wkScheme(AdoptWK, WKStringCreateWithUTF8CString(scheme));
+    WKSoupRequestManagerRegisterURIScheme(ewkContext->requestManager.get(), wkScheme.get());
+
+    return true;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.h b/Source/WebKit2/UIProcess/API/efl/ewk_context.h
index e89037766..3df362f6f 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.h
@@ -30,6 +30,7 @@
 #define ewk_context_h
 
 #include "ewk_cookie_manager.h"
+#include "ewk_url_scheme_request.h"
 #include <Evas.h>
 
 #ifdef __cplusplus
@@ -40,6 +41,12 @@ extern "C" {
 typedef struct _Ewk_Context Ewk_Context;
 
 /**
+ * @typedef Ewk_Url_Scheme_Request_Cb Ewk_Url_Scheme_Request_Cb
+ * @brief Callback type for use with ewk_context_uri_scheme_register().
+ */
+typedef void (*Ewk_Url_Scheme_Request_Cb) (Ewk_Url_Scheme_Request *request, void *user_data);
+
+/**
  * Gets default Ewk_Context instance.
  *
  * @return Ewk_Context object.
@@ -55,6 +62,49 @@ EAPI Ewk_Context *ewk_context_default_get();
  */
 EAPI Ewk_Cookie_Manager *ewk_context_cookie_manager_get(const Ewk_Context *context);
 
+/**
+ * Register @a scheme in @a context.
+ *
+ * When an URL request with @a scheme is made in the #Ewk_Context, the callback
+ * function provided will be called with a #Ewk_Url_Scheme_Request.
+ *
+ * It is possible to handle URL scheme requests asynchronously, by calling ewk_url_scheme_ref() on the
+ * #Ewk_Url_Scheme_Request and calling ewk_url_scheme_request_finish() later when the data of
+ * the request is available.
+ *
+ * @param context a #Ewk_Context object.
+ * @param scheme the network scheme to register
+ * @param callback the function to be called when an URL request with @a scheme is made.
+ * @param user_data data to pass to callback function
+ *
+ * @code
+ * static void about_uri_scheme_request_cb(Ewk_Url_Scheme_Request *request, void *user_data)
+ * {
+ *     const char *path;
+ *     char *contents_data = NULL;
+ *     unsigned int contents_length = 0;
+ *
+ *     path = ewk_url_scheme_request_path_get(request);
+ *     if (!strcmp(path, "plugins")) {
+ *         // Initialize contents_data with the contents of plugins about page, and set its length to contents_length
+ *     } else if (!strcmp(path, "memory")) {
+ *         // Initialize contents_data with the contents of memory about page, and set its length to contents_length
+ *     } else if (!strcmp(path, "applications")) {
+ *         // Initialize contents_data with the contents of application about page, and set its length to contents_length
+ *     } else {
+ *         Eina_Strbuf *buf = eina_strbuf_new();
+ *         eina_strbuf_append_printf(buf, "&lt;html&gt;&lt;body&gt;&lt;p&gt;Invalid about:%s page&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;", path);
+ *         contents_data = eina_strbuf_string_steal(buf);
+ *         contents_length = strlen(contents);
+ *         eina_strbuf_free(buf);
+ *     }
+ *     ewk_url_scheme_request_finish(request, contents_data, contents_length, "text/html");
+ *     free(contents_data);
+ * }
+ * @endcode
+ */
+EAPI Eina_Bool ewk_context_uri_scheme_register(Ewk_Context *context, const char *scheme, Ewk_Url_Scheme_Request_Cb callback, void *user_data);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
index 813a94257..d78e1e961 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context_private.h
@@ -23,7 +23,10 @@
 #include <WebKit2/WKBase.h>
 
 typedef struct _Ewk_Context Ewk_Context;
+typedef struct _Ewk_Url_Scheme_Request Ewk_Url_Scheme_Request;
 
 WKContextRef ewk_context_WKContext_get(const Ewk_Context*);
+WKSoupRequestManagerRef ewk_context_request_manager_get(const Ewk_Context*);
+void ewk_context_url_scheme_request_received(Ewk_Context*, Ewk_Url_Scheme_Request*);
 
 #endif // ewk_context_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp
new file mode 100644
index 000000000..b22bd36ff
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WKBase.h"
+#include "WKSoupRequestManager.h"
+#include "ewk_context_private.h"
+#include "ewk_context_request_manager_client_private.h"
+#include "ewk_url_scheme_request.h"
+#include "ewk_url_scheme_request_private.h"
+
+static inline Ewk_Context* toEwkContext(const void* clientInfo)
+{
+    return static_cast<Ewk_Context*>(const_cast<void*>(clientInfo));
+}
+
+static void didReceiveURIRequest(WKSoupRequestManagerRef soupRequestManagerRef, WKURLRef urlRef, uint64_t requestID, const void* clientInfo)
+{
+    Ewk_Url_Scheme_Request* schemeRequest = ewk_url_scheme_request_new(soupRequestManagerRef, urlRef, requestID);
+    ewk_context_url_scheme_request_received(toEwkContext(clientInfo), schemeRequest);
+    ewk_url_scheme_request_unref(schemeRequest);
+}
+
+void ewk_context_request_manager_client_attach(Ewk_Context* context)
+{
+    WKSoupRequestManagerClient wkRequestManagerClient;
+    memset(&wkRequestManagerClient, 0, sizeof(WKSoupRequestManagerClient));
+
+    wkRequestManagerClient.version = kWKSoupRequestManagerClientCurrentVersion;
+    wkRequestManagerClient.clientInfo = context;
+    wkRequestManagerClient.didReceiveURIRequest = didReceiveURIRequest;
+
+    WKSoupRequestManagerSetClient(ewk_context_request_manager_get(context), &wkRequestManagerClient);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h
new file mode 100644
index 000000000..689bbf622
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context_request_manager_client_private.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_context_request_manager_client_private_h
+#define ewk_context_request_manager_client_private_h
+
+typedef struct _Ewk_Context Ewk_Context;
+
+void ewk_context_request_manager_client_attach(Ewk_Context* context);
+
+#endif // ewk_context_request_manager_client_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_cookie_manager.h b/Source/WebKit2/UIProcess/API/efl/ewk_cookie_manager.h
index 442c4f7ca..e93ed8ed8 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_cookie_manager.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_cookie_manager.h
@@ -51,7 +51,7 @@ enum _Ewk_Cookie_Accept_Policy {
     EWK_COOKIE_ACCEPT_POLICY_ALWAYS,
     /// Rejects all cookies.
     EWK_COOKIE_ACCEPT_POLICY_NEVER,
-    /// Accepts cookies only from the main page.
+    /// Accepts only cookies set by the main document loaded.
     EWK_COOKIE_ACCEPT_POLICY_NO_THIRD_PARTY
 };
 
@@ -107,7 +107,7 @@ EAPI void ewk_cookie_manager_persistent_storage_set(Ewk_Cookie_Manager *manager,
 /**
  * Set @a policy as the cookie acceptance policy for @a manager.
  *
- * By default, cookies are always accepted.
+ * By default, only cookies set by the main document loaded are accepted.
  *
  * @param manager The cookie manager to update.
  * @param policy a #Ewk_Cookie_Accept_Policy
@@ -118,7 +118,7 @@ EAPI void ewk_cookie_manager_accept_policy_set(Ewk_Cookie_Manager *manager, Ewk_
 /**
  * Asynchronously get the cookie acceptance policy of @a manager.
  *
- * By default, cookies are always accepted.
+ * By default, only cookies set by the main document loaded are accepted.
  *
  * @param manager The cookie manager to query.
  * @param callback The function to call when the policy is received or an error occured.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
index a424ddda3..f209952fe 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
@@ -31,7 +31,6 @@
 #include "WKURL.h"
 #include "WKURLRequest.h"
 #include "WebURLRequest.h"
-#include "WebURLRequestEfl.h"
 #include "ewk_url_request_private.h"
 #include <wtf/text/CString.h>
 
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp
new file mode 100644
index 000000000..693ff3df6
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_url_scheme_request.h"
+
+#include "WKData.h"
+#include "WKRetainPtr.h"
+#include "WKSoupRequestManager.h"
+#include "WKString.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+/**
+ * \struct  _Ewk_Url_Scheme_Request
+ * @brief   Contains the URL scheme request data.
+ */
+struct _Ewk_Url_Scheme_Request {
+    unsigned int __ref; /**< the reference count of the object */
+    WKRetainPtr<WKSoupRequestManagerRef> wkRequestManager;
+    const char* url;
+    uint64_t requestID;
+    const char* scheme;
+    const char* path;
+
+    _Ewk_Url_Scheme_Request(WKSoupRequestManagerRef manager, const char* _url, uint64_t _requestID)
+        : __ref(1)
+        , wkRequestManager(manager)
+        , url(eina_stringshare_add(_url))
+        , requestID(_requestID)
+    {
+        SoupURI* soupURI = soup_uri_new(_url);
+        scheme = eina_stringshare_add(soupURI->scheme);
+        path = eina_stringshare_add(soupURI->path);
+        soup_uri_free(soupURI);
+    }
+
+    ~_Ewk_Url_Scheme_Request()
+    {
+        ASSERT(!__ref);
+        eina_stringshare_del(url);
+        eina_stringshare_del(scheme);
+        eina_stringshare_del(path);
+    }
+};
+
+void ewk_url_scheme_request_ref(Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN(request);
+    ++request->__ref;
+}
+
+void ewk_url_scheme_request_unref(Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN(request);
+
+    if (--request->__ref)
+        return;
+
+    delete request;
+}
+
+const char* ewk_url_scheme_request_scheme_get(const Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    return request->scheme;
+}
+
+const char* ewk_url_scheme_request_url_get(const Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    return request->url;
+}
+
+const char* ewk_url_scheme_request_path_get(const Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    return request->path;
+}
+
+/**
+ * @internal
+ * Returns the #Ewk_Url_Scheme_Request identifier.
+ */
+uint64_t ewk_url_scheme_request_id_get(const Ewk_Url_Scheme_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, 0);
+
+    return request->requestID;
+}
+
+Eina_Bool ewk_url_scheme_request_finish(const Ewk_Url_Scheme_Request* request, void* contentData, unsigned int contentLength, const char* mimeType)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(request, false);
+
+    WKRetainPtr<WKDataRef> wkData(AdoptWK, WKDataCreate(contentLength ? reinterpret_cast<const unsigned char*>(contentData) : 0, contentLength));
+    WKRetainPtr<WKStringRef> wkMimeType = mimeType ? adoptWK(WKStringCreateWithUTF8CString(mimeType)) : 0;
+
+    // In case of empty reply an empty WKDataRef is sent to the WebProcess.
+    WKSoupRequestManagerDidHandleURIRequest(request->wkRequestManager.get(), wkData.get(), contentLength, wkMimeType.get(), request->requestID);
+
+    return true;
+}
+
+/**
+ * @internal
+ * Constructs a Ewk_Url_Scheme_Request.
+ */
+Ewk_Url_Scheme_Request* ewk_url_scheme_request_new(WKSoupRequestManagerRef requestManager, WKURLRef url, uint64_t requestID)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(requestManager, 0);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(url, 0);
+
+    return new Ewk_Url_Scheme_Request(requestManager, toImpl(url)->string().utf8().data(), requestID);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h
new file mode 100644
index 000000000..034cbd474
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_url_scheme_request.h
+ * @brief   Describes the Ewk URL scheme request API.
+ */
+
+#ifndef ewk_url_scheme_request_h
+#define ewk_url_scheme_request_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Url_Scheme_Request */
+typedef struct _Ewk_Url_Scheme_Request Ewk_Url_Scheme_Request;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param request the URL scheme request object to increase the reference count
+ */
+EAPI void ewk_url_scheme_request_ref(Ewk_Url_Scheme_Request *request);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the URL scheme request is freed.
+ *
+ * @param request the URL request object to decrease the reference count
+ */
+EAPI void ewk_url_scheme_request_unref(Ewk_Url_Scheme_Request *request);
+
+/**
+ * Query the URL scheme for this request.
+ *
+ * @param request request object to query.
+ *
+ * @return the URL scheme pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_url_scheme_request_scheme_get(const Ewk_Url_Scheme_Request *request);
+
+/**
+ * Query the URL for this request.
+ *
+ * @param request request object to query.
+ *
+ * @return the URL pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_url_scheme_request_url_get(const Ewk_Url_Scheme_Request *request);
+
+/**
+ * Query the path part of the URL for this request.
+ *
+ * @param request request object to query.
+ *
+ * @return the path pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_url_scheme_request_path_get(const Ewk_Url_Scheme_Request *request);
+
+/**
+ * Finish a Ewk_Url_Scheme_Request by setting the content of the request and its mime type.
+ *
+ * @param request a Ewk_Url_Scheme_Request.
+ * @param content_data the data content of the request (may be %c NULL if the content is empty).
+ * @param content_length the length of the @a content_data.
+ * @param mime_type the content type of the stream or %c NULL if not known
+ */
+EAPI Eina_Bool ewk_url_scheme_request_finish(const Ewk_Url_Scheme_Request *request, void *content_data, unsigned int content_length, const char *mime_type);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // ewk_url_scheme_request_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h
new file mode 100644
index 000000000..e5dd4174b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_scheme_request_private.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_url_scheme_request_private_h
+#define ewk_url_scheme_request_private_h
+
+#include "WKBase.h"
+
+typedef struct _Ewk_Url_Scheme_Request Ewk_Url_Scheme_Request;
+typedef struct _Ewk_Context Ewk_Context;
+
+Ewk_Url_Scheme_Request* ewk_url_scheme_request_new(WKSoupRequestManagerRef, WKURLRef, uint64_t requestID);
+
+uint64_t ewk_url_scheme_request_id_get(const Ewk_Url_Scheme_Request* request);
+
+#endif // ewk_url_scheme_request_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.h b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
index 6a8e74f82..924dbcf67 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
@@ -161,7 +161,7 @@ typedef struct _Ewk_Web_Resource_Request Ewk_Web_Resource_Request;
 struct _Ewk_Web_Resource_Request {
     Ewk_Web_Resource *resource; /**< resource being requested */
     Ewk_Url_Request *request; /**< URL request for the resource */
-    Ewk_Url_Response *redirect_response; /**< Possible redirect response for the resource */
+    Ewk_Url_Response *redirect_response; /**< Possible redirect response for the resource or @c NULL */
 };
 
 /// Creates a type name for _Ewk_Web_Resource_Load_Response.
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
index 3c28f2984..cc8b120cd 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
@@ -48,7 +48,7 @@ static void didReceiveTitleForFrame(WKPageRef, WKStringRef title, WKFrameRef fra
 }
 
 #if ENABLE(WEB_INTENTS)
-static void didReceiveIntentForFrame(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent, const void* clientInfo)
+static void didReceiveIntentForFrame(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent, WKTypeRef, const void* clientInfo)
 {
     Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
     Ewk_Intent* ewkIntent = ewk_intent_new(intent);
@@ -58,7 +58,7 @@ static void didReceiveIntentForFrame(WKPageRef page, WKFrameRef frame, WKIntentD
 #endif
 
 #if ENABLE(WEB_INTENTS_TAG)
-static void registerIntentServiceForFrame(WKPageRef page, WKFrameRef frame, WKIntentServiceInfoRef serviceInfo, const void *clientInfo)
+static void registerIntentServiceForFrame(WKPageRef page, WKFrameRef frame, WKIntentServiceInfoRef serviceInfo, WKTypeRef, const void *clientInfo)
 {
     Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
     Ewk_Intent_Service* ewkIntentService = ewk_intent_service_new(serviceInfo);
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp
index 505bbeddb..113e178b9 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp
@@ -44,6 +44,7 @@
 #include "ewk_web_resource_private.h"
 #include <wtf/text/CString.h>
 
+using namespace WebCore;
 using namespace WebKit;
 
 static inline Evas_Object* toEwkView(const void* clientInfo)
@@ -66,10 +67,11 @@ static void didInitiateLoadForResource(WKPageRef, WKFrameRef wkFrame, uint64_t r
 static void didSendRequestForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLRequestRef wkRequest, WKURLResponseRef wkRedirectResponse, const void* clientInfo)
 {
     Ewk_Url_Request* request = ewk_url_request_new(wkRequest);
-    Ewk_Url_Response* redirectResponse = ewk_url_response_new(toImpl(wkRedirectResponse)->resourceResponse());
+    Ewk_Url_Response* redirectResponse = wkRedirectResponse ? ewk_url_response_new(toImpl(wkRedirectResponse)->resourceResponse()) : 0;
     ewk_view_resource_request_sent(toEwkView(clientInfo), resourceIdentifier, request, redirectResponse);
     ewk_url_request_unref(request);
-    ewk_url_response_unref(redirectResponse);
+    if (redirectResponse)
+        ewk_url_response_unref(redirectResponse);
 }
 
 static void didReceiveResponseForResource(WKPageRef, WKFrameRef, uint64_t resourceIdentifier, WKURLResponseRef wkResponse, const void* clientInfo)
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
index 05168e26d..b8da86dce 100644
--- a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestBase.cpp
@@ -23,6 +23,7 @@
 #include "EWK2UnitTestEnvironment.h"
 #include <EWebKit2.h>
 #include <Ecore.h>
+#include <glib-object.h>
 #include <wtf/UnusedParam.h>
 
 extern EWK2UnitTest::EWK2UnitTestEnvironment* environment;
@@ -48,6 +49,11 @@ void EWK2UnitTestBase::SetUp()
 {
     ASSERT_GT(ecore_evas_init(), 0);
 
+    // glib support (for libsoup).
+    g_type_init();
+    if (!ecore_main_loop_glib_integrate())
+        fprintf(stderr, "WARNING: Glib main loop integration is not working. Some tests may fail.");
+
     unsigned int width = environment->defaultWidth();
     unsigned int height = environment->defaultHeight();
 
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.cpp b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.cpp
new file mode 100644
index 000000000..13e577984
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ * Copyright (C) 2012 Intel Corporation
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "EWK2UnitTestServer.h"
+
+EWK2UnitTestServer::EWK2UnitTestServer()
+{
+    SoupAddress* address = soup_address_new("127.0.0.1", SOUP_ADDRESS_ANY_PORT);
+    soup_address_resolve_sync(address, 0);
+
+    m_soupServer = soup_server_new(SOUP_SERVER_INTERFACE, address, 0);
+    m_baseURI = soup_uri_new("http://127.0.0.1/");
+    soup_uri_set_port(m_baseURI, soup_server_get_port(m_soupServer));
+    g_object_unref(address);
+}
+
+EWK2UnitTestServer::~EWK2UnitTestServer()
+{
+    soup_uri_free(m_baseURI);
+    g_object_unref(m_soupServer);
+}
+
+void EWK2UnitTestServer::run(SoupServerCallback serverCallback)
+{
+    soup_server_run_async(m_soupServer);
+    soup_server_add_handler(m_soupServer, 0, serverCallback, 0, 0);
+}
+
+CString EWK2UnitTestServer::getURIForPath(const char* path) const
+{
+    SoupURI* soupURI = soup_uri_new_with_base(m_baseURI, path);
+    char* uri = soup_uri_to_string(soupURI, false);
+    CString uriString = uri;
+    free(uri);
+    soup_uri_free(soupURI);
+
+    return uriString;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.h b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.h
new file mode 100644
index 000000000..3eb146f06
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/UnitTestUtils/EWK2UnitTestServer.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ * Copyright (C) 2012 Intel Corporation
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef EWK2UnitTestServer_h
+#define EWK2UnitTestServer_h
+
+#include <libsoup/soup.h>
+#include <wtf/text/CString.h>
+
+class EWK2UnitTestServer {
+public:
+    EWK2UnitTestServer();
+    virtual ~EWK2UnitTestServer();
+
+    SoupURI* baseURI() const { return m_baseURI; }
+
+    CString getURIForPath(const char* path) const;
+    void run(SoupServerCallback);
+
+private:
+    SoupServer* m_soupServer;
+    SoupURI* m_baseURI;
+};
+
+#endif // EWK2UnitTestServer_h
+
diff --git a/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp
new file mode 100644
index 000000000..86815b42c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/tests/test_ewk2_cookie_manager.cpp
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ * Copyright (C) 2012 Intel Corporation
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "UnitTestUtils/EWK2UnitTestBase.h"
+#include "UnitTestUtils/EWK2UnitTestEnvironment.h"
+#include "UnitTestUtils/EWK2UnitTestServer.h"
+#include <EWebKit2.h>
+#include <Ecore.h>
+#include <Eina.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace EWK2UnitTest;
+using namespace WTF;
+
+extern EWK2UnitTestEnvironment* environment;
+
+static const char FIRST_PARTY_DOMAIN[] = "127.0.0.1";
+static const char THIRD_PARTY_DOMAIN[] = "localhost";
+static const char INDEX_HTML_STRING[] =
+    "<html><body>"
+    " <p>EFLWebKit2 Cookie Manager test</p>"
+    " <img src='http://localhost:%u/image.png' width=5 height=5></img>"
+    "</body></html>";
+
+static void serverCallback(SoupServer* server, SoupMessage* message, const char* path, GHashTable*, SoupClientContext*, gpointer)
+{
+    if (message->method != SOUP_METHOD_GET) {
+        soup_message_set_status(message, SOUP_STATUS_NOT_IMPLEMENTED);
+        return;
+    }
+
+    soup_message_set_status(message, SOUP_STATUS_OK);
+    if (!strcmp(path, "/index.html")) {
+        Eina_Strbuf* buffer = eina_strbuf_new();
+        eina_strbuf_append_printf(buffer, INDEX_HTML_STRING, soup_server_get_port(server));
+        soup_message_headers_replace(message->response_headers, "Set-Cookie", "foo=bar; Max-Age=60");
+        soup_message_body_append(message->response_body, SOUP_MEMORY_TAKE, eina_strbuf_string_steal(buffer), eina_strbuf_length_get(buffer));
+        eina_strbuf_string_free(buffer);
+    } else if (!strcmp(path, "/image.png"))
+        soup_message_headers_replace(message->response_headers, "Set-Cookie", "baz=qux; Max-Age=60");
+    else
+        FAIL();
+    soup_message_body_complete(message->response_body);
+}
+
+static void getAcceptPolicyCallback(Ewk_Cookie_Accept_Policy policy, Ewk_Web_Error* error, void* event_info)
+{
+    ASSERT_FALSE(error);
+    Ewk_Cookie_Accept_Policy* ret = static_cast<Ewk_Cookie_Accept_Policy*>(event_info);
+    *ret = policy;
+    ecore_main_loop_quit();
+}
+
+static Ewk_Cookie_Accept_Policy getAcceptPolicy(Ewk_Cookie_Manager* manager)
+{
+    Ewk_Cookie_Accept_Policy policy = EWK_COOKIE_ACCEPT_POLICY_ALWAYS;
+    ewk_cookie_manager_async_accept_policy_get(manager, getAcceptPolicyCallback, &policy);
+    ecore_main_loop_begin();
+    return policy;
+}
+
+static void getHostnamesWithCookiesCallback(Eina_List* hostnames, Ewk_Web_Error* error, void* event_info)
+{
+    ASSERT_FALSE(error);
+
+    Eina_List** ret = static_cast<Eina_List**>(event_info);
+    Eina_List* l;
+    void* data;
+    EINA_LIST_FOREACH(hostnames, l, data)
+        *ret = eina_list_append(*ret, eina_stringshare_ref(static_cast<char*>(data)));
+    ecore_main_loop_quit();
+}
+
+static Eina_List* getHostnamesWithCookies(Ewk_Cookie_Manager* manager)
+{
+    Eina_List* ret = 0;
+    ewk_cookie_manager_async_hostnames_with_cookies_get(manager, getHostnamesWithCookiesCallback, &ret);
+    ecore_main_loop_begin();
+    return ret;
+}
+
+static void freeHostNames(Eina_List* hostnames)
+{
+    void* data;
+    EINA_LIST_FREE(hostnames, data)
+        eina_stringshare_del(static_cast<char*>(data));
+}
+
+static int countHostnamesWithCookies(Ewk_Cookie_Manager* manager)
+{
+    Eina_List* hostnames = getHostnamesWithCookies(manager);
+    int count = eina_list_count(hostnames);
+    freeHostNames(hostnames);
+    return count;
+}
+
+TEST_F(EWK2UnitTestBase, ewk_cookie_manager_accept_policy)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    Ewk_Cookie_Manager* cookieManager = ewk_context_cookie_manager_get(ewk_context_default_get());
+    ASSERT_TRUE(cookieManager);
+
+    // Default policy is EWK_COOKIE_ACCEPT_POLICY_NO_THIRD_PARTY.
+    ASSERT_EQ(getAcceptPolicy(cookieManager), EWK_COOKIE_ACCEPT_POLICY_NO_THIRD_PARTY);
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+
+    Eina_List* hostnames = getHostnamesWithCookies(cookieManager);
+    ASSERT_EQ(eina_list_count(hostnames), 1);
+    ASSERT_STREQ(static_cast<char*>(eina_list_nth(hostnames, 0)), FIRST_PARTY_DOMAIN);
+    freeHostNames(hostnames);
+    ewk_cookie_manager_cookies_clear(cookieManager);
+
+    // Change policy to EWK_COOKIE_ACCEPT_POLICY_ALWAYS
+    ewk_cookie_manager_accept_policy_set(cookieManager, EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+    ASSERT_EQ(getAcceptPolicy(cookieManager), EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+
+    hostnames = getHostnamesWithCookies(cookieManager);
+    ASSERT_EQ(eina_list_count(hostnames), 2);
+    ASSERT_STREQ(static_cast<char*>(eina_list_nth(hostnames, 0)), FIRST_PARTY_DOMAIN);
+    ASSERT_STREQ(static_cast<char*>(eina_list_nth(hostnames, 1)), THIRD_PARTY_DOMAIN);
+    freeHostNames(hostnames);
+    ewk_cookie_manager_cookies_clear(cookieManager);
+
+    // Change policy to EWK_COOKIE_ACCEPT_POLICY_NEVER
+    ewk_cookie_manager_accept_policy_set(cookieManager, EWK_COOKIE_ACCEPT_POLICY_NEVER);
+    ASSERT_EQ(getAcceptPolicy(cookieManager), EWK_COOKIE_ACCEPT_POLICY_NEVER);
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_cookie_manager_cookies_delete)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    Ewk_Cookie_Manager* cookieManager = ewk_context_cookie_manager_get(ewk_context_default_get());
+    ASSERT_TRUE(cookieManager);
+
+    ewk_cookie_manager_accept_policy_set(cookieManager, EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+    ASSERT_EQ(getAcceptPolicy(cookieManager), EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+    Eina_List* hostnames = getHostnamesWithCookies(cookieManager);
+    ASSERT_EQ(eina_list_count(hostnames), 2);
+    freeHostNames(hostnames);
+
+    // Delete first party cookie
+    ewk_cookie_manager_hostname_cookies_clear(cookieManager, FIRST_PARTY_DOMAIN);
+    hostnames = getHostnamesWithCookies(cookieManager);
+    ASSERT_EQ(eina_list_count(hostnames), 1);
+    ASSERT_STREQ(static_cast<char*>(eina_list_nth(hostnames, 0)), THIRD_PARTY_DOMAIN);
+    freeHostNames(hostnames);
+
+    // Delete third party cookie
+    ewk_cookie_manager_hostname_cookies_clear(cookieManager, THIRD_PARTY_DOMAIN);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+
+    // Get all cookies again
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 2);
+
+    // Clear all cookies
+    ewk_cookie_manager_cookies_clear(cookieManager);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+}
+
+TEST_F(EWK2UnitTestBase, ewk_cookie_manager_permanent_storage)
+{
+    OwnPtr<EWK2UnitTestServer> httpServer = adoptPtr(new EWK2UnitTestServer);
+    httpServer->run(serverCallback);
+
+    // Generate unique names for cookie storages.
+    char textStorage[] = "/tmp/txt-cookie.XXXXXX";
+    ASSERT_TRUE(mktemp(textStorage));
+    char sqliteStorage[] = "/tmp/sqlite-cookie.XXXXXX";
+    ASSERT_TRUE(mktemp(sqliteStorage));
+
+    Ewk_Cookie_Manager* cookieManager = ewk_context_cookie_manager_get(ewk_context_default_get());
+    ASSERT_TRUE(cookieManager);
+
+    ewk_cookie_manager_accept_policy_set(cookieManager, EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+    ASSERT_EQ(getAcceptPolicy(cookieManager), EWK_COOKIE_ACCEPT_POLICY_ALWAYS);
+
+    // Text storage using a new file.
+    ewk_cookie_manager_persistent_storage_set(cookieManager, textStorage, EWK_COOKIE_PERSISTENT_STORAGE_TEXT);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 2);
+
+    // SQLite storage using a new file.
+    ewk_cookie_manager_persistent_storage_set(cookieManager, sqliteStorage, EWK_COOKIE_PERSISTENT_STORAGE_SQLITE);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+
+    loadUrlSync(httpServer->getURIForPath("/index.html").data());
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 2);
+
+    // Text storage using an existing file.
+    ewk_cookie_manager_persistent_storage_set(cookieManager, textStorage, EWK_COOKIE_PERSISTENT_STORAGE_TEXT);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 2);
+    ewk_cookie_manager_cookies_clear(cookieManager);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+
+    // SQLite storage with an existing file.
+    ewk_cookie_manager_persistent_storage_set(cookieManager, sqliteStorage, EWK_COOKIE_PERSISTENT_STORAGE_SQLITE);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 2);
+    ewk_cookie_manager_cookies_clear(cookieManager);
+    ASSERT_EQ(countHostnamesWithCookies(cookieManager), 0);
+
+    // Final clean up.
+    unlink(textStorage);
+    unlink(sqliteStorage);
+}
+
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
index e1f6759ac..99c5ffb40 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebpage.cpp
@@ -30,7 +30,6 @@
 #include "qquickwebpage_p_p.h"
 #include "qquickwebview_p.h"
 #include "qwebkittest_p.h"
-#include <QtQuick/QQuickCanvas>
 
 using namespace WebKit;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
index 1ba028f23..fa0446fec 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp
@@ -491,7 +491,7 @@ void QQuickWebViewPrivate::updateIcon()
 {
     Q_Q(QQuickWebView);
 
-    QQuickView* view = qobject_cast<QQuickView*>(q->canvas());
+    QQuickView* view = qobject_cast<QQuickView*>(q->window());
     if (!view)
         return;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
index ceaab68a0..8d0f4ffb9 100644
--- a/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qquickwebview_p.h
@@ -27,8 +27,10 @@
 #include <QtQuick/qquickitem.h>
 #include <private/qquickflickable_p.h>
 
-class QWebNavigationRequest;
+QT_BEGIN_NAMESPACE
 class QQmlComponent;
+QT_END_NAMESPACE
+class QWebNavigationRequest;
 class QQuickWebPage;
 class QQuickWebViewAttached;
 class QWebLoadRequest;
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebnavigationhistory_p.h b/Source/WebKit2/UIProcess/API/qt/qwebnavigationhistory_p.h
index fa630754b..f1a3e572c 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebnavigationhistory_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebnavigationhistory_p.h
@@ -33,11 +33,13 @@
 #include <QVariant>
 #include <QtQml/qqml.h>
 
+QT_BEGIN_NAMESPACE
 class QAbstractListModel;
+class QString;
+class QUrl;
+QT_END_NAMESPACE
 class QWebNavigationHistoryPrivate;
 class QWebNavigationListModelPrivate;
-class QUrl;
-class QString;
 
 class QWEBKIT_EXPORT QWebNavigationListModel : public QAbstractListModel {
     Q_OBJECT
diff --git a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h
index a4bef5dd2..4608ff9d7 100644
--- a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h
@@ -32,6 +32,7 @@
 #include <WebKit2/WKPageGroup.h>
 #include <wtf/Platform.h>
 
+QT_BEGIN_NAMESPACE
 class QRect;
 class QRectF;
 class QPoint;
@@ -43,6 +44,7 @@ class QTouchEvent;
 class QUrl;
 class QMatrix4x4;
 class QCursor;
+QT_END_NAMESPACE
 
 class QRawWebViewPrivate;
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
index a81778270..d347e158a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qquickwebview/tst_qquickwebview.cpp
@@ -314,9 +314,9 @@ void tst_QQuickWebView::multipleWebViews()
 
     // This should not crash.
     QScopedPointer<QQuickWebView> webView1(newWebView());
-    webView1->setParentItem(m_window->rootItem());
+    webView1->setParentItem(m_window->contentItem());
     QScopedPointer<QQuickWebView> webView2(newWebView());
-    webView2->setParentItem(m_window->rootItem());
+    webView2->setParentItem(m_window->contentItem());
 
     webView1->setSize(QSizeF(300, 400));
     webView1->setUrl(QUrl::fromLocalFile(QLatin1String(TESTS_SOURCE_DIR "/html/scroll.html")));
@@ -344,7 +344,7 @@ void tst_QQuickWebView::basicRenderingSanity()
     // This should not crash.
     webView()->setVisible(true);
     QTest::qWait(200);
-    QImage grabbedWindow = m_window->grabFrameBuffer();
+    QImage grabbedWindow = m_window->grabWindow();
     QRgb testColor = qRgba(0, 0xff, 0, 0xff);
     QVERIFY(grabbedWindow.pixel(10, 10) == testColor);
     QVERIFY(grabbedWindow.pixel(100, 10) == testColor);
@@ -376,9 +376,9 @@ void tst_QQuickWebView::transparentWebViews()
 
     // This should not crash.
     QScopedPointer<QQuickWebView> webView1(newWebView());
-    webView1->setParentItem(m_window->rootItem());
+    webView1->setParentItem(m_window->contentItem());
     QScopedPointer<QQuickWebView> webView2(newWebView());
-    webView2->setParentItem(m_window->rootItem());
+    webView2->setParentItem(m_window->contentItem());
     QVERIFY(!webView1->experimental()->transparentBackground());
     webView2->experimental()->setTransparentBackground(true);
     QVERIFY(webView2->experimental()->transparentBackground());
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
index 6d855cf97..4b2cfcf11 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
@@ -43,7 +43,7 @@ inline TestWindow::TestWindow(QQuickItem* webView)
     : webView(webView)
 {
     Q_ASSERT(webView);
-    webView->setParentItem(rootItem());
+    webView->setParentItem(contentItem());
 }
 
 inline void TestWindow::resizeEvent(QResizeEvent* event)
diff --git a/Source/WebKit2/UIProcess/DrawingAreaProxy.h b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
index 426fea14a..805b8ac34 100644
--- a/Source/WebKit2/UIProcess/DrawingAreaProxy.h
+++ b/Source/WebKit2/UIProcess/DrawingAreaProxy.h
@@ -36,7 +36,9 @@
 #include <wtf/Noncopyable.h>
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QPainter;
+QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _cairo cairo_t;
 #endif
diff --git a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h b/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
index f3a5312a2..46a72086c 100644
--- a/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
+++ b/Source/WebKit2/UIProcess/Launcher/ThreadLauncher.h
@@ -32,7 +32,9 @@
 #include <wtf/Threading.h>
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QLocalSocket;
+QT_END_NAMESPACE
 #endif
 
 namespace WebKit {
diff --git a/Source/WebKit2/UIProcess/Launcher/efl/ProcessLauncherEfl.cpp b/Source/WebKit2/UIProcess/Launcher/efl/ProcessLauncherEfl.cpp
index 86dddbf61..23d213545 100644
--- a/Source/WebKit2/UIProcess/Launcher/efl/ProcessLauncherEfl.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/efl/ProcessLauncherEfl.cpp
@@ -21,11 +21,10 @@
 #include "ProcessLauncher.h"
 
 #include "Connection.h"
+#include "ProcessExecutablePath.h"
 #include <WebCore/FileSystem.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/RunLoop.h>
-#include <libgen.h>
-#include <unistd.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
@@ -45,38 +44,26 @@ void ProcessLauncher::launchProcess()
     if (!pid) { // child process
         close(sockets[1]);
         String socket = String::format("%d", sockets[0]);
-        String processName;
+        String executablePath;
         switch (m_launchOptions.processType) {
         case WebProcess:
-            processName = "WebProcess";
+            executablePath = executablePathOfWebProcess();
             break;
         case PluginProcess:
-            processName = "PluginProcess";
+            executablePath = executablePathOfPluginProcess();
             break;
         default:
             ASSERT_NOT_REACHED();
             return;
         }
 
-        String executablePath;
-        char readLinkBuffer[PATH_MAX];
-        memset(readLinkBuffer, 0, PATH_MAX);
-        ssize_t result = readlink("/proc/self/exe", readLinkBuffer, PATH_MAX);
-
-        if (result == -1)
-            executablePath = String("/usr/bin");
-        else {
-            char* executablePathPtr = dirname(readLinkBuffer);
-            executablePath = String(executablePathPtr);
-        }
-        String fullPath = executablePath + "/" + processName;
 #ifndef NDEBUG
         if (m_launchOptions.processCmdPrefix.isEmpty())
 #endif
-            execl(fullPath.utf8().data(), processName.utf8().data(), socket.utf8().data(), static_cast<char*>(0));
+            execl(executablePath.utf8().data(), executablePath.utf8().data(), socket.utf8().data(), static_cast<char*>(0));
 #ifndef NDEBUG
         else {
-            String cmd = makeString(m_launchOptions.processCmdPrefix, ' ', fullPath, ' ', socket);
+            String cmd = makeString(m_launchOptions.processCmdPrefix, ' ', executablePath, ' ', socket);
             if (system(cmd.utf8().data()) == -1) {
                 ASSERT_NOT_REACHED();
                 return;
@@ -92,7 +79,6 @@ void ProcessLauncher::launchProcess()
         ASSERT_NOT_REACHED();
         return;
     }
-
 }
 
 void ProcessLauncher::terminateProcess()
diff --git a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
index c5c3f7145..f099d6283 100644
--- a/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/qt/ProcessLauncherQt.cpp
@@ -101,9 +101,15 @@ void QtWebProcess::setupChildProcess()
 
 void ProcessLauncher::launchProcess()
 {
-    QString commandLine = QLatin1String("%1 %2");
-    commandLine = commandLine.arg(m_launchOptions.processType == WebProcess ?
-                                  executablePathOfWebProcess() : executablePathOfPluginProcess());
+    QString commandLine = QLatin1String("%1 %2 %3");
+    if (m_launchOptions.processType == WebProcess) {
+        QByteArray webProcessPrefix = qgetenv("QT_WEBKIT2_WP_CMD_PREFIX");
+        commandLine = commandLine.arg(QLatin1String(webProcessPrefix.constData())).arg(QString(executablePathOfWebProcess()));
+    } else if (m_launchOptions.processType == PluginProcess) {
+        QByteArray pluginProcessPrefix = qgetenv("QT_WEBKIT2_PP_CMD_PREFIX");
+        commandLine = commandLine.arg(QLatin1String(pluginProcessPrefix.constData())).arg(QString(executablePathOfPluginProcess()));
+    } else
+        ASSERT_NOT_REACHED();
 
 #if OS(DARWIN)
     // Create the listening port.
diff --git a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h b/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h
index b4e7b7ce2..eca6900b6 100644
--- a/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h
+++ b/Source/WebKit2/UIProcess/LayerTreeCoordinatorProxy.h
@@ -36,7 +36,9 @@
 #include <wtf/Functional.h>
 #include <wtf/HashSet.h>
 
+QT_BEGIN_NAMESPACE
 class QSGNode;
+QT_END_NAMESPACE
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index c9c0b94df..22e4e2006 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -146,7 +146,9 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
     , m_batteryManagerProxy(WebBatteryManagerProxy::create(this))
 #endif
     , m_cookieManagerProxy(WebCookieManagerProxy::create(this))
+#if ENABLE(SQL_DATABASE)
     , m_databaseManagerProxy(WebDatabaseManagerProxy::create(this))
+#endif
     , m_geolocationManagerProxy(WebGeolocationManagerProxy::create(this))
     , m_iconDatabase(WebIconDatabase::create(this))
     , m_keyValueStorageManagerProxy(WebKeyValueStorageManagerProxy::create(this))
@@ -210,8 +212,10 @@ WebContext::~WebContext()
     m_cookieManagerProxy->invalidate();
     m_cookieManagerProxy->clearContext();
 
+#if ENABLE(SQL_DATABASE)
     m_databaseManagerProxy->invalidate();
     m_databaseManagerProxy->clearContext();
+#endif
     
     m_geolocationManagerProxy->invalidate();
     m_geolocationManagerProxy->clearContext();
@@ -381,8 +385,10 @@ bool WebContext::shouldTerminate(WebProcessProxy* process)
         return false;
     if (!m_cookieManagerProxy->shouldTerminate(process))
         return false;
+#if ENABLE(SQL_DATABASE)
     if (!m_databaseManagerProxy->shouldTerminate(process))
         return false;
+#endif
     if (!m_keyValueStorageManagerProxy->shouldTerminate(process))
         return false;
     if (!m_mediaCacheManagerProxy->shouldTerminate(process))
@@ -438,7 +444,9 @@ void WebContext::disconnectProcess(WebProcessProxy* process)
     m_batteryManagerProxy->invalidate();
 #endif
     m_cookieManagerProxy->invalidate();
+#if ENABLE(SQL_DATABASE)
     m_databaseManagerProxy->invalidate();
+#endif
     m_geolocationManagerProxy->invalidate();
     m_keyValueStorageManagerProxy->invalidate();
     m_mediaCacheManagerProxy->invalidate();
@@ -788,10 +796,12 @@ void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+#if ENABLE(SQL_DATABASE)
     if (messageID.is<CoreIPC::MessageClassWebDatabaseManagerProxy>()) {
         m_databaseManagerProxy->didReceiveWebDatabaseManagerProxyMessage(connection, messageID, arguments);
         return;
     }
+#endif
 
     if (messageID.is<CoreIPC::MessageClassWebGeolocationManagerProxy>()) {
         m_geolocationManagerProxy->didReceiveMessage(connection, messageID, arguments);
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index c748f22f2..6b6d97e0f 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -167,7 +167,9 @@ public:
     WebBatteryManagerProxy* batteryManagerProxy() const { return m_batteryManagerProxy.get(); }
 #endif
     WebCookieManagerProxy* cookieManagerProxy() const { return m_cookieManagerProxy.get(); }
+#if ENABLE(SQL_DATABASE)
     WebDatabaseManagerProxy* databaseManagerProxy() const { return m_databaseManagerProxy.get(); }
+#endif
     WebGeolocationManagerProxy* geolocationManagerProxy() const { return m_geolocationManagerProxy.get(); }
     WebIconDatabase* iconDatabase() const { return m_iconDatabase.get(); }
     WebKeyValueStorageManagerProxy* keyValueStorageManagerProxy() const { return m_keyValueStorageManagerProxy.get(); }
@@ -321,7 +323,9 @@ private:
     RefPtr<WebBatteryManagerProxy> m_batteryManagerProxy;
 #endif
     RefPtr<WebCookieManagerProxy> m_cookieManagerProxy;
+#if ENABLE(SQL_DATABASE)
     RefPtr<WebDatabaseManagerProxy> m_databaseManagerProxy;
+#endif
     RefPtr<WebGeolocationManagerProxy> m_geolocationManagerProxy;
     RefPtr<WebIconDatabase> m_iconDatabase;
     RefPtr<WebKeyValueStorageManagerProxy> m_keyValueStorageManagerProxy;
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
index e61faa162..76db33686 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebDatabaseManagerProxy.h"
 
+#if ENABLE(SQL_DATABASE)
+
 #include "ImmutableArray.h"
 #include "ImmutableDictionary.h"
 #include "WebDatabaseManagerMessages.h"
@@ -231,3 +233,4 @@ void WebDatabaseManagerProxy::didModifyDatabase(const String& originIdentifier,
 
 } // namespace WebKit
 
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
index d70011c38..fe920bb03 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.h
@@ -26,6 +26,8 @@
 #ifndef WebDatabaseManagerProxy_h
 #define WebDatabaseManagerProxy_h
 
+#if ENABLE(SQL_DATABASE)
+
 #include "APIObject.h"
 #include "Arguments.h"
 #include "GenericCallback.h"
@@ -99,4 +101,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(SQL_DATABASE)
+
 #endif // DatabaseManagerProxy_h
diff --git a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.messages.in
index 37a9b89ec..503275fff 100644
--- a/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebDatabaseManagerProxy.messages.in
@@ -20,9 +20,13 @@
 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+#if ENABLE(SQL_DATABASE)
+
 messages -> WebDatabaseManagerProxy {
     DidGetDatabasesByOrigin(Vector<WebKit::OriginAndDatabases> originAndDatabases, uint64_t callbackID);
     DidGetDatabaseOrigins(Vector<WTF::String> originIdentifiers, uint64_t callbackID)
     DidModifyOrigin(WTF::String originIdentifier)
     DidModifyDatabase(WTF::String originIdentifier, WTF::String databaseIdentifier)
 }
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit2/UIProcess/WebLoaderClient.cpp b/Source/WebKit2/UIProcess/WebLoaderClient.cpp
index 289e8797d..4d3c459ce 100644
--- a/Source/WebKit2/UIProcess/WebLoaderClient.cpp
+++ b/Source/WebKit2/UIProcess/WebLoaderClient.cpp
@@ -169,22 +169,22 @@ void WebLoaderClient::didDetectXSSForFrame(WebPageProxy* page, WebFrameProxy* fr
 }
 
 #if ENABLE(WEB_INTENTS)
-void WebLoaderClient::didReceiveIntentForFrame(WebPageProxy* page, WebFrameProxy* frame, WebIntentData* intentData)
+void WebLoaderClient::didReceiveIntentForFrame(WebPageProxy* page, WebFrameProxy* frame, WebIntentData* intentData, APIObject* userData)
 {
     if (!m_client.didReceiveIntentForFrame)
         return;
 
-    m_client.didReceiveIntentForFrame(toAPI(page), toAPI(frame), toAPI(intentData), m_client.clientInfo);
+    m_client.didReceiveIntentForFrame(toAPI(page), toAPI(frame), toAPI(intentData), toAPI(userData), m_client.clientInfo);
 }
 #endif
 
 #if ENABLE(WEB_INTENTS_TAG)
-void WebLoaderClient::registerIntentServiceForFrame(WebPageProxy* page, WebFrameProxy* frame, WebIntentServiceInfo* serviceInfo)
+void WebLoaderClient::registerIntentServiceForFrame(WebPageProxy* page, WebFrameProxy* frame, WebIntentServiceInfo* serviceInfo, APIObject* userData)
 {
     if (!m_client.registerIntentServiceForFrame)
         return;
 
-    m_client.registerIntentServiceForFrame(toAPI(page), toAPI(frame), toAPI(serviceInfo), m_client.clientInfo);
+    m_client.registerIntentServiceForFrame(toAPI(page), toAPI(frame), toAPI(serviceInfo), toAPI(userData), m_client.clientInfo);
 }
 #endif
 
diff --git a/Source/WebKit2/UIProcess/WebLoaderClient.h b/Source/WebKit2/UIProcess/WebLoaderClient.h
index f8e44c74f..f1291a288 100644
--- a/Source/WebKit2/UIProcess/WebLoaderClient.h
+++ b/Source/WebKit2/UIProcess/WebLoaderClient.h
@@ -73,11 +73,11 @@ public:
     void didRunInsecureContentForFrame(WebPageProxy*, WebFrameProxy*, APIObject*);
     void didDetectXSSForFrame(WebPageProxy*, WebFrameProxy*, APIObject*);
 #if ENABLE(WEB_INTENTS)
-    void didReceiveIntentForFrame(WebPageProxy*, WebFrameProxy*, WebIntentData*);
+    void didReceiveIntentForFrame(WebPageProxy*, WebFrameProxy*, WebIntentData*, APIObject*);
 #endif
 
 #if ENABLE(WEB_INTENTS_TAG)
-    void registerIntentServiceForFrame(WebPageProxy*, WebFrameProxy*, WebIntentServiceInfo*);
+    void registerIntentServiceForFrame(WebPageProxy*, WebFrameProxy*, WebIntentServiceInfo*, APIObject*);
 #endif
 
     // FIXME: didFirstVisuallyNonEmptyLayoutForFrame and didNewFirstVisuallyNonEmptyLayout should be merged.
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 17cc2f425..344ed9846 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -1894,13 +1894,18 @@ void WebPageProxy::didFinishProgress()
 }
 
 #if ENABLE(WEB_INTENTS_TAG)
-void WebPageProxy::registerIntentServiceForFrame(uint64_t frameID, const IntentServiceInfo& serviceInfo)
+void WebPageProxy::registerIntentServiceForFrame(uint64_t frameID, const IntentServiceInfo& serviceInfo, CoreIPC::ArgumentDecoder* arguments)
 {
+    RefPtr<APIObject> userData;
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    if (!arguments->decode(messageDecoder))
+        return;
+
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
     RefPtr<WebIntentServiceInfo> webIntentServiceInfo = WebIntentServiceInfo::create(serviceInfo);
-    m_loaderClient.registerIntentServiceForFrame(this, frame, webIntentServiceInfo.get());
+    m_loaderClient.registerIntentServiceForFrame(this, frame, webIntentServiceInfo.get(), userData.get());
 }
 #endif
 
@@ -2175,13 +2180,18 @@ void WebPageProxy::didDetectXSSForFrame(uint64_t frameID, CoreIPC::ArgumentDecod
 }
 
 #if ENABLE(WEB_INTENTS)
-void WebPageProxy::didReceiveIntentForFrame(uint64_t frameID, const IntentData& intentData)
+void WebPageProxy::didReceiveIntentForFrame(uint64_t frameID, const IntentData& intentData, CoreIPC::ArgumentDecoder* arguments)
 {
+    RefPtr<APIObject> userData;
+    WebContextUserMessageDecoder messageDecoder(userData, m_process->context());
+    if (!arguments->decode(messageDecoder))
+        return;
+
     WebFrameProxy* frame = process()->webFrame(frameID);
     MESSAGE_CHECK(frame);
 
     RefPtr<WebIntentData> webIntentData = WebIntentData::create(intentData);
-    m_loaderClient.didReceiveIntentForFrame(this, frame, webIntentData.get());
+    m_loaderClient.didReceiveIntentForFrame(this, frame, webIntentData.get(), userData.get());
 }
 #endif
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index e70036645..33c49a3ca 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -756,10 +756,10 @@ private:
     void didFinishProgress();
 
 #if ENABLE(WEB_INTENTS)
-    void didReceiveIntentForFrame(uint64_t frameID, const IntentData&);
+    void didReceiveIntentForFrame(uint64_t frameID, const IntentData&, CoreIPC::ArgumentDecoder*);
 #endif
 #if ENABLE(WEB_INTENTS_TAG)
-    void registerIntentServiceForFrame(uint64_t frameID, const IntentServiceInfo&);
+    void registerIntentServiceForFrame(uint64_t frameID, const IntentServiceInfo&, CoreIPC::ArgumentDecoder*);
 #endif
     
     void decidePolicyForNavigationAction(uint64_t frameID, uint32_t navigationType, uint32_t modifiers, int32_t mouseButton, const WebCore::ResourceRequest&, uint64_t listenerID, CoreIPC::ArgumentDecoder*, bool& receivedPolicyAction, uint64_t& policyAction, uint64_t& downloadID);
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index 7838d643f..376904701 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -97,10 +97,10 @@ messages -> WebPageProxy {
 
     # Intent messages
 #if ENABLE(WEB_INTENTS)
-    DidReceiveIntentForFrame(uint64_t frameID, WebKit::IntentData intent)
+    DidReceiveIntentForFrame(uint64_t frameID, WebKit::IntentData intent, WebKit::InjectedBundleUserMessageEncoder userData)
 #endif
 #if ENABLE(WEB_INTENTS_TAG)
-    RegisterIntentServiceForFrame(uint64_t frameID, WebKit::IntentServiceInfo serviceInfo);
+    RegisterIntentServiceForFrame(uint64_t frameID, WebKit::IntentServiceInfo serviceInfo, WebKit::InjectedBundleUserMessageEncoder userData);
 #endif
 
     # Progress messages
diff --git a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
index 82d63845d..e2b390ab3 100644
--- a/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtPageClient.cpp
@@ -35,7 +35,7 @@
 #include "qquickwebview_p.h"
 #include "qquickwebview_p_p.h"
 #include <QGuiApplication>
-#include <QQuickCanvas>
+#include <QQuickWindow>
 #include <WebCore/Cursor.h>
 #include <WebCore/DragData.h>
 #include <WebCore/FloatRect.h>
@@ -287,7 +287,7 @@ bool QtPageClient::isViewVisible()
         return false;
 
     // FIXME: this is a workaround while QWindow::isExposed() is not ready.
-    if (m_webView->canvas() && m_webView->canvas()->windowState() == Qt::WindowMinimized)
+    if (m_webView->window() && m_webView->window()->windowState() == Qt::WindowMinimized)
         return false;
 
     return m_webView->isVisible() && m_webView->page()->isVisible();
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportHandler.h b/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
index e4a8c51fb..c93b0bd32 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
+++ b/Source/WebKit2/UIProcess/qt/QtViewportHandler.h
@@ -31,11 +31,12 @@
 
 QT_BEGIN_NAMESPACE
 class QPointF;
-class QQuickWebPage;
-class QQuickWebView;
 class QWheelEvent;
 QT_END_NAMESPACE
 
+class QQuickWebPage;
+class QQuickWebView;
+
 class QWebKitTest;
 
 namespace WebKit {
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
index ea595951b..d82eba2f9 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageEventHandler.cpp
@@ -33,7 +33,7 @@
 #include <QGuiApplication>
 #include <QInputMethod>
 #include <QMimeData>
-#include <QtQuick/QQuickCanvas>
+#include <QQuickWindow>
 #include <QStyleHints>
 #include <QTextFormat>
 #include <QTouchEvent>
@@ -562,7 +562,7 @@ void QtWebPageEventHandler::startDrag(const WebCore::DragData& dragData, PassRef
     QPoint globalPosition;
     Qt::DropAction actualDropAction = Qt::IgnoreAction;
 
-    if (QWindow* window = m_webPage->canvas()) {
+    if (QWindow* window = m_webPage->window()) {
         QDrag* drag = new QDrag(window);
         drag->setPixmap(QPixmap::fromImage(dragQImage));
         drag->setMimeData(mimeData);
diff --git a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
index 4c0fcfca2..22a5bcfba 100644
--- a/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
+++ b/Source/WebKit2/UIProcess/qt/QtWebPageSGNode.h
@@ -24,7 +24,9 @@
 #include <QtQuick/QSGTransformNode>
 #include <wtf/PassRefPtr.h>
 
+QT_BEGIN_NAMESPACE
 class QSGSimpleRectNode;
+QT_END_NAMESPACE
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h
index 75a74a2f6..7872dc907 100644
--- a/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h
+++ b/Source/WebKit2/UIProcess/qt/WebColorChooserProxyQt.h
@@ -25,9 +25,12 @@
 #include <QtCore/QObject>
 #include <wtf/OwnPtr.h>
 
+QT_BEGIN_NAMESPACE
 class QQmlComponent;
 class QQmlContext;
 class QQuickItem;
+QT_END_NAMESPACE
+
 class QQuickWebView;
 
 namespace WebCore {
diff --git a/Source/WebKit2/UIProcess/qt/WebGeolocationProviderQt.h b/Source/WebKit2/UIProcess/qt/WebGeolocationProviderQt.h
index 598c74a25..e476b128d 100644
--- a/Source/WebKit2/UIProcess/qt/WebGeolocationProviderQt.h
+++ b/Source/WebKit2/UIProcess/qt/WebGeolocationProviderQt.h
@@ -26,8 +26,10 @@
 #include <WebKit2/WKGeolocationPosition.h>
 #include <WebKit2/WKRetainPtr.h>
 
+QT_BEGIN_NAMESPACE
 class QGeoPositionInfoSource;
 class QGeoPositionInfo;
+QT_END_NAMESPACE
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.h b/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.h
index 3eb544d61..e622f9006 100644
--- a/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.h
+++ b/Source/WebKit2/UIProcess/qt/WebPopupMenuProxyQt.h
@@ -31,10 +31,13 @@
 #include <QtCore/QObject>
 #include <wtf/OwnPtr.h>
 
+QT_BEGIN_NAMESPACE
 class QQmlComponent;
 class QQmlContext;
-class QQuickWebView;
 class QQuickItem;
+QT_END_NAMESPACE
+
+class QQuickWebView;
 
 namespace WebKit {
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
index bbb6adbaf..55d083b27 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.cpp
@@ -91,6 +91,11 @@ size_t WKBundleGetJavaScriptObjectsCount(WKBundleRef bundleRef)
     return toImpl(bundleRef)->javaScriptObjectsCount();
 }
 
+void WKBundleSetAlwaysAcceptCookies(WKBundleRef bundleRef, bool accept)
+{
+    toImpl(bundleRef)->setAlwaysAcceptCookies(accept);
+}
+
 void WKBundleAddUserScript(WKBundleRef bundleRef, WKBundlePageGroupRef pageGroupRef, WKBundleScriptWorldRef scriptWorldRef, WKStringRef sourceRef, WKURLRef urlRef, WKArrayRef whitelistRef, WKArrayRef blacklistRef, WKUserScriptInjectionTime injectionTimeRef, WKUserContentInjectedFrames injectedFramesRef)
 {
     toImpl(bundleRef)->addUserScript(toImpl(pageGroupRef), toImpl(scriptWorldRef), toWTFString(sourceRef), toWTFString(urlRef), toImpl(whitelistRef), toImpl(blacklistRef), toUserScriptInjectionTime(injectionTimeRef), toUserContentInjectedFrames(injectedFramesRef));
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
index 153174bc0..f70d5b36b 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.h
@@ -109,6 +109,8 @@ typedef void (*WKBundlePageWillDisconnectDOMWindowExtensionFromGlobalObjectCallb
 typedef void (*WKBundlePageDidReconnectDOMWindowExtensionToGlobalObjectCallback)(WKBundlePageRef page, WKBundleDOMWindowExtensionRef, const void* clientInfo);
 typedef void (*WKBundlePageWillDestroyGlobalObjectForDOMWindowExtensionCallback)(WKBundlePageRef page, WKBundleDOMWindowExtensionRef, const void* clientInfo);
 typedef bool (*WKBundlePageShouldForceUniversalAccessFromLocalURLCallback)(WKBundlePageRef, WKStringRef url, const void* clientInfo);
+typedef void (*WKBundlePageDidReceiveIntentForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKIntentDataRef intent, WKTypeRef* userData, const void* clientInfo);
+typedef void (*WKBundlePageRegisterIntentServiceForFrameCallback)(WKBundlePageRef page, WKBundleFrameRef frame, WKIntentServiceInfoRef serviceInfo, WKTypeRef* userData, const void* clientInfo);
 
 struct WKBundlePageLoaderClient {
     int                                                                     version;
@@ -147,10 +149,14 @@ struct WKBundlePageLoaderClient {
     // Version 2
     WKBundlePageDidFinishProgressCallback                                   didFinishProgress;
     WKBundlePageShouldForceUniversalAccessFromLocalURLCallback              shouldForceUniversalAccessFromLocalURL;
+
+    // Version 3
+    WKBundlePageDidReceiveIntentForFrameCallback                            didReceiveIntentForFrame;
+    WKBundlePageRegisterIntentServiceForFrameCallback                       registerIntentServiceForFrame;
 };
 typedef struct WKBundlePageLoaderClient WKBundlePageLoaderClient;
 
-enum { kWKBundlePageLoaderClientCurrentVersion = 2 };
+enum { kWKBundlePageLoaderClientCurrentVersion = 3 };
 
 enum {
     WKBundlePagePolicyActionPassThrough,
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
index ccda367f6..12e933ea8 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePrivate.h
@@ -86,6 +86,7 @@ WK_EXPORT bool WKBundleIsPageBoxVisible(WKBundleRef bundle, WKBundleFrameRef fra
 WK_EXPORT void WKBundleAddOriginAccessWhitelistEntry(WKBundleRef bundle, WKStringRef, WKStringRef, WKStringRef, bool);
 WK_EXPORT void WKBundleRemoveOriginAccessWhitelistEntry(WKBundleRef bundle, WKStringRef, WKStringRef, WKStringRef, bool);
 WK_EXPORT void WKBundleResetOriginAccessWhitelists(WKBundleRef bundle);
+WK_EXPORT void WKBundleSetAlwaysAcceptCookies(WKBundleRef bundle, bool);
 
 WK_EXPORT bool WKBundleIsProcessingUserGesture(WKBundleRef bundle);
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index 076d3b6c8..d809d611b 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -36,6 +36,7 @@
 #include "WKBundleAPICast.h"
 #include "WebApplicationCacheManager.h"
 #include "WebContextMessageKinds.h"
+#include "WebCookieManager.h"
 #include "WebCoreArgumentCoders.h"
 #include "WebDatabaseManager.h"
 #include "WebFrame.h"
@@ -114,6 +115,11 @@ void InjectedBundle::setShouldTrackVisitedLinks(bool shouldTrackVisitedLinks)
     WebProcess::shared().setShouldTrackVisitedLinks(shouldTrackVisitedLinks);
 }
 
+void InjectedBundle::setAlwaysAcceptCookies(bool accept)
+{
+    WebCookieManager::shared().setHTTPCookieAcceptPolicy(accept ? HTTPCookieAcceptPolicyAlways : HTTPCookieAcceptPolicyOnlyFromMainDocumentDomain);
+}
+
 void InjectedBundle::removeAllVisitedLinks()
 {
     PageGroup::removeAllVisitedLinks();
@@ -263,12 +269,16 @@ void InjectedBundle::resetOriginAccessWhitelists()
 
 void InjectedBundle::clearAllDatabases()
 {
+#if ENABLE(SQL_DATABASE)
     WebDatabaseManager::shared().deleteAllDatabases();
+#endif
 }
 
 void InjectedBundle::setDatabaseQuota(uint64_t quota)
 {
+#if ENABLE(SQL_DATABASE)
     WebDatabaseManager::shared().setQuotaForOrigin("file:///", quota);
+#endif
 }
 
 void InjectedBundle::clearApplicationCache()
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index 5ba1a2f27..f3e36a85d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -101,6 +101,7 @@ public:
 
     // TestRunner only SPI
     void setShouldTrackVisitedLinks(bool);
+    void setAlwaysAcceptCookies(bool);
     void removeAllVisitedLinks();
     void activateMacFontAscentHack();
     void overrideBoolPreferenceForTestRunner(WebPageGroupProxy*, const String& preference, bool enabled);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
index 2963dc268..74f8efb1d 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
@@ -33,6 +33,13 @@
 #include "WebError.h"
 #include <wtf/text/WTFString.h>
 
+#if ENABLE(WEB_INTENTS)
+#include "WebIntentData.h"
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+#include "WebIntentServiceInfo.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -187,6 +194,30 @@ void InjectedBundlePageLoaderClient::didDetectXSSForFrame(WebPage* page, WebFram
     userData = adoptRef(toImpl(userDataToPass));
 }
 
+#if ENABLE(WEB_INTENTS)
+void InjectedBundlePageLoaderClient::didReceiveIntentForFrame(WebPage* page, WebFrame* frame, WebIntentData* intent, RefPtr<APIObject>& userData)
+{
+    if (!m_client.didReceiveIntentForFrame)
+        return;
+
+    WKTypeRef userDataToPass = 0;
+    m_client.didReceiveIntentForFrame(toAPI(page), toAPI(frame), toAPI(intent), &userDataToPass, m_client.clientInfo);
+    userData = adoptRef(toImpl(userDataToPass));
+}
+#endif
+
+#if ENABLE(WEB_INTENTS_TAG)
+void InjectedBundlePageLoaderClient::registerIntentServiceForFrame(WebPage* page, WebFrame* frame, WebIntentServiceInfo* service, RefPtr<APIObject>& userData)
+{
+    if (!m_client.registerIntentServiceForFrame)
+        return;
+
+    WKTypeRef userDataToPass = 0;
+    m_client.registerIntentServiceForFrame(toAPI(page), toAPI(frame), toAPI(service), &userDataToPass, m_client.clientInfo);
+    userData = adoptRef(toImpl(userDataToPass));
+}
+#endif
+
 void InjectedBundlePageLoaderClient::didFirstLayoutForFrame(WebPage* page, WebFrame* frame, RefPtr<APIObject>& userData)
 {
     if (!m_client.didFirstLayoutForFrame)
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
index 299f19da1..403037e12 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
@@ -46,6 +46,12 @@ class APIObject;
 class InjectedBundleBackForwardListItem;
 class WebPage;
 class WebFrame;
+#if ENABLE(WEB_INTENTS)
+class WebIntentData;
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+class WebIntentServiceInfo;
+#endif
 
 class InjectedBundlePageLoaderClient : public APIClient<WKBundlePageLoaderClient, kWKBundlePageLoaderClientCurrentVersion> {
 public:
@@ -65,6 +71,13 @@ public:
     void didRunInsecureContentForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
     void didDetectXSSForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
 
+#if ENABLE(WEB_INTENTS)
+    void didReceiveIntentForFrame(WebPage*, WebFrame*, WebIntentData*, RefPtr<APIObject>& userData);
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+    void registerIntentServiceForFrame(WebPage*, WebFrame*, WebIntentServiceInfo*, RefPtr<APIObject>& userData);
+#endif
+
     void didFirstLayoutForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
     void didFirstVisuallyNonEmptyLayoutForFrame(WebPage*, WebFrame*, RefPtr<APIObject>& userData);
     void didLayoutForFrame(WebPage*, WebFrame*);
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index aa5457799..383eeac3e 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -218,7 +218,6 @@ private:
     virtual bool shouldRubberBandInDirection(WebCore::ScrollDirection) const OVERRIDE;
     
     virtual void numWheelEventHandlersChanged(unsigned) OVERRIDE;
-    virtual void numTouchEventHandlersChanged(unsigned) OVERRIDE { }
 
     String m_cachedToolTip;
     mutable RefPtr<WebFrame> m_cachedFrameSetLargestFrame;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
index 6104a50eb..53d3895cd 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "WebDatabaseManager.h"
 
+#if ENABLE(SQL_DATABASE)
+
 #include "Connection.h"
 #include "MessageID.h"
 #include "OriginAndDatabases.h"
@@ -181,3 +183,5 @@ void WebDatabaseManager::dispatchDidModifyDatabase(WebCore::SecurityOrigin* orig
 }
 
 } // namespace WebKit
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
index 18fc8f936..60ffb10cd 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.h
@@ -26,6 +26,8 @@
 #ifndef WebDatabaseManager_h
 #define WebDatabaseManager_h
 
+#if ENABLE(SQL_DATABASE)
+
 #include "Arguments.h"
 #include <WebCore/DatabaseTrackerClient.h>
 #include <wtf/Noncopyable.h>
@@ -70,4 +72,6 @@ private:
 
 } // namespace WebKit
 
+#endif // ENABLE(SQL_DATABASE)
+
 #endif // WebDatabaseManager_h
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.messages.in b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.messages.in
index e928ef654..a344c0054 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.messages.in
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebDatabaseManager.messages.in
@@ -20,6 +20,8 @@
 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+#if ENABLE(SQL_DATABASE)
+
 messages -> WebDatabaseManager {
     void GetDatabasesByOrigin(uint64_t callbackID)
     void GetDatabaseOrigins(uint64_t callbackID)
@@ -28,3 +30,5 @@ messages -> WebDatabaseManager {
     void DeleteAllDatabases()
     void SetQuotaForOrigin(WTF::String originIdentifier, uint64_t quota)
 }
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
index 9a7d29377..918e74acd 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -75,10 +75,15 @@
 
 #if ENABLE(WEB_INTENTS)
 #include "IntentData.h"
-#include "IntentServiceInfo.h"
+#include "WebIntentData.h"
 #include <WebCore/IntentRequest.h>
 #endif
 
+#if ENABLE(WEB_INTENTS_TAG)
+#include "IntentServiceInfo.h"
+#include "WebIntentServiceInfo.h"
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -1567,7 +1572,11 @@ void WebFrameLoaderClient::dispatchIntent(PassRefPtr<IntentRequest> request)
     intentData.extras = coreIntent->extras();
     intentData.suggestions = coreIntent->suggestions();
 
-    webPage->send(Messages::WebPageProxy::DidReceiveIntentForFrame(m_frame->frameID(), intentData));
+    RefPtr<APIObject> userData;
+    RefPtr<WebIntentData> webIntent = WebIntentData::create(intentData);
+    webPage->injectedBundleLoaderClient().didReceiveIntentForFrame(webPage, m_frame, webIntent.get(), userData);
+
+    webPage->send(Messages::WebPageProxy::DidReceiveIntentForFrame(m_frame->frameID(), intentData, InjectedBundleUserMessageEncoder(userData.get())));
 }
 #endif
 
@@ -1585,7 +1594,11 @@ void WebFrameLoaderClient::registerIntentService(const String& action, const Str
     serviceInfo.title = title;
     serviceInfo.disposition = disposition;
 
-    webPage->send(Messages::WebPageProxy::RegisterIntentServiceForFrame(m_frame->frameID(), serviceInfo));
+    RefPtr<APIObject> userData;
+    RefPtr<WebIntentServiceInfo> webIntentServiceInfo = WebIntentServiceInfo::create(serviceInfo);
+    webPage->injectedBundleLoaderClient().registerIntentServiceForFrame(webPage, m_frame, webIntentServiceInfo.get(), userData);
+
+    webPage->send(Messages::WebPageProxy::RegisterIntentServiceForFrame(m_frame->frameID(), serviceInfo, InjectedBundleUserMessageEncoder(userData.get())));
 }
 #endif
 
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 3a9940442..6eb8ab7ee 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -633,10 +633,12 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+#if ENABLE(SQL_DATABASE)
     if (messageID.is<CoreIPC::MessageClassWebDatabaseManager>()) {
         WebDatabaseManager::shared().didReceiveMessage(connection, messageID, arguments);
         return;
     }
+#endif
 
     if (messageID.is<CoreIPC::MessageClassWebGeolocationManager>()) {
         m_geolocationManager.didReceiveMessage(connection, messageID, arguments);
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 090d4d82d..0d005a4b7 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -50,7 +50,9 @@
 #endif
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QNetworkAccessManager;
+QT_END_NAMESPACE
 #endif
 
 #if PLATFORM(MAC)
diff --git a/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp b/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
index e20eb160f..d5c60fcc0 100644
--- a/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/qt/QtBuiltinBundlePage.cpp
@@ -76,6 +76,8 @@ QtBuiltinBundlePage::QtBuiltinBundlePage(QtBuiltinBundle* bundle, WKBundlePageRe
         0, // willDestroyGlobalObjectForDOMWindowExtension
         0, // didFinishProgress
         0, // shouldForceUniversalAccessFromLocalURL
+        0, // didReceiveIntentForFrame
+        0, // registerIntentServiceForFrame
     };
     WKBundlePageSetPageLoaderClient(m_page, &loaderClient);
 }
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index d8e0a6f52..563758064 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -253,7 +253,6 @@ EXPORTS
         ??1ContextDestructionObserver@WebCore@@MAE@XZ
         ?contextDestroyed@ContextDestructionObserver@WebCore@@UAEXXZ
         ??0ContextDestructionObserver@WebCore@@QAE@PAVScriptExecutionContext@1@@Z
-        ?nullInstance@TreeScope@WebCore@@SAPAV12@XZ
         ?nodesFromRect@Document@WebCore@@QBE?AV?$PassRefPtr@VNodeList@WebCore@@@WTF@@HHIIII_N0@Z
         ?selectionStartHasMarkerFor@Editor@WebCore@@QBE_NW4MarkerType@DocumentMarker@2@HH@Z
         ?webkitWillEnterFullScreenForElement@Document@WebCore@@QAEXPAVElement@2@@Z
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index 32f4e8748..0e5d1b2c7 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -246,7 +246,6 @@ EXPORTS
         ?userPreferredLanguages@WebCore@@YA?AV?$Vector@VString@WTF@@$0A@@WTF@@XZ
         ?utf8@String@WTF@@QBE?AVCString@2@_N@Z
         ?view@Document@WebCore@@QBEPAVFrameView@2@XZ
-        ?nullInstance@TreeScope@WebCore@@SAPAV12@XZ
         ?nodesFromRect@Document@WebCore@@QBE?AV?$PassRefPtr@VNodeList@WebCore@@@WTF@@HHIIII_N0@Z
         ?selectionStartHasMarkerFor@Editor@WebCore@@QBE_NW4MarkerType@DocumentMarker@2@HH@Z
         ?restrictScaleFactorToInitialScaleIfNotUserScalable@WebCore@@YAXAAUViewportAttributes@1@@Z
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index 08b2664a0..8605125a2 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -84,6 +84,7 @@ _ZN7WebCore24ComposedShadowTreeWalker4nextEv;
 _ZN7WebCore24ComposedShadowTreeWalker8previousEv;
 _ZN7WebCore24ComposedShadowTreeWalker9lastChildEv;
 _ZN7WebCore24DocumentMarkerController10markersForEPNS_4NodeENS_14DocumentMarker11MarkerTypesE;
+_ZN7WebCore24DocumentMarkerController18addTextMatchMarkerEPKNS_5RangeEb;
 _ZN7WebCore25computeViewportAttributesENS_17ViewportArgumentsEiiifNS_7IntSizeE;
 _ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELj0EEE;
 _ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE;
@@ -167,7 +168,6 @@ _ZNK7WebCore14InsertionPoint8isActiveEv;
 _ZN7WebCore26ContextDestructionObserverD2Ev;
 _ZN7WebCore26ContextDestructionObserverC2EPNS_22ScriptExecutionContextE;
 _ZN7WebCore26ContextDestructionObserver16contextDestroyedEv;
-_ZN7WebCore9TreeScope12nullInstanceEv;
 local:
 _Z*;
 cti*;
diff --git a/Source/cmake/OptionsWinCE.cmake b/Source/cmake/OptionsWinCE.cmake
index 4fe775c0d..270f00307 100644
--- a/Source/cmake/OptionsWinCE.cmake
+++ b/Source/cmake/OptionsWinCE.cmake
@@ -1,5 +1,6 @@
 INCLUDE(OptionsWindows)
 
+ADD_DEFINITIONS(-D_CE_CRT_ALLOW_WIN_MINMAX)
 ADD_DEFINITIONS(-DWTF_USE_WINCE_UNICODE=1)
 ADD_DEFINITIONS(-DWTF_USE_WININET=1)
 ADD_DEFINITIONS(-DWTF_CPU_ARM_TRADITIONAL -DWINCEBASIC)
diff --git a/Source/cmake/OptionsWindows.cmake b/Source/cmake/OptionsWindows.cmake
index 9ed7c2d87..3fdcf687e 100644
--- a/Source/cmake/OptionsWindows.cmake
+++ b/Source/cmake/OptionsWindows.cmake
@@ -1,7 +1,7 @@
 ADD_DEFINITIONS(-DWTF_PLATFORM_WIN=1)
 SET(WTF_PLATFORM_WIN 1)
 
-ADD_DEFINITIONS(-DUNICODE)
+ADD_DEFINITIONS(-DNOMINMAX -DUNICODE)
 
 INCLUDE_DIRECTORIES(${JAVASCRIPTCORE_DIR}/os-win32)
 
diff --git a/Source/cmake/WebKitFeatures.cmake b/Source/cmake/WebKitFeatures.cmake
index efba1344e..280a9de5e 100644
--- a/Source/cmake/WebKitFeatures.cmake
+++ b/Source/cmake/WebKitFeatures.cmake
@@ -29,6 +29,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_SET "Toggle CSS image-set support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_REGIONS "Toggle CSS regions support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_SHADERS "Toggle CSS Shaders (within CSS Filters) support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_CSS_STICKY_POSITION "Toggle CSS sticky position support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_VARIABLES "Toggle CSS Variables support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CUSTOM_SCHEME_HANDLER "Toggle Custom Scheme Handler support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_DATALIST_ELEMENT "Toggle HTML5 datalist support" OFF)
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index b9a39eb24..d2ed72cd1 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -15,14 +15,15 @@
 #cmakedefine01 ENABLE_CHANNEL_MESSAGING
 #cmakedefine01 ENABLE_CLIENT_BASED_GEOLOCATION
 #cmakedefine01 ENABLE_CSP_NEXT
-#cmakedefine01 ENABLE_CSS3_FLEXBOX
 #cmakedefine01 ENABLE_CSS_BOX_DECORATION_BREAK
 #cmakedefine01 ENABLE_CSS_EXCLUSIONS
 #cmakedefine01 ENABLE_CSS_IMAGE_ORIENTATION
 #cmakedefine01 ENABLE_CSS_IMAGE_RESOLUTION
 #cmakedefine01 ENABLE_CSS_IMAGE_SET
 #cmakedefine01 ENABLE_CSS_REGIONS
+#cmakedefine01 ENABLE_CSS_STICKY_POSITION
 #cmakedefine01 ENABLE_CSS_VARIABLES
+#cmakedefine01 ENABLE_CSS3_FLEXBOX
 #cmakedefine01 ENABLE_CUSTOM_SCHEME_HANDLER
 #cmakedefine01 ENABLE_DATALIST_ELEMENT
 #cmakedefine01 ENABLE_DATA_TRANSFER_ITEMS
author	Simon Hausmann <simon.hausmann@nokia.com>	2012-07-24 17:03:20 +0200
committer	Simon Hausmann <simon.hausmann@nokia.com>	2012-07-24 17:03:20 +0200
commit	08d4a74d56ca431877819fc4566e27eafe150342 (patch)
tree	ebd8530838ab390c015c6b7e659a22852c1663ae /Source
parent	1de6cd4794bbd5a52189384189a2b8df1848b39b (diff)
download	qtwebkit-08d4a74d56ca431877819fc4566e27eafe150342.tar.gz